Function at 0x10003959
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb04
mov eax, dword [0x10017014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10017834], 0
jne 0x1000397c
xor eax, eax
jmp 0x10003c0d
push ebx
push edi
push str.WBXZIP_PROCESS_MUTEX
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0xab0], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x100039bf
cmp eax, 0xb7
jne 0x100039bf
push str.WBXZIP_PROCESS_INTERNAL__already_have_a_zip_process_running
call fcn.1000150d
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10003c0b
push esi
mov esi, 0x208
lea eax, [ebp - 0x8a4]
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, 0x104
lea eax, [ebp - 0x8a4]
push ebx
push eax
call fcn.100015e7
push esi
lea eax, [ebp - 0x69c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x8a4]
push eax
lea eax, [ebp - 0x69c]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0x2c
lea eax, [ebp - 0x69c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp - 0x28c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x28c]
push ebx
push eax
call fcn.10004295
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x28c]
add esp, 0x18
push str.wbxTraceZip.ini
push eax
call ebx
lea eax, [ebp - 0x28c]
push eax
push str.wbxTraceZip_ini_name___s
call fcn.1000150d
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x80
mov esi, eax
lea eax, [ebp - 0x84]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x84]
push 0x10011c8c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x28c]
add esp, 0x18
mov edi, str.Config
push eax
lea eax, [ebp - 0x84]
push eax
push str.ParentPID
push edi
call esi
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x8a4]
push eax
push str.wbxTraceFile
push edi
call esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0xb04]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0xb04], esi
lea edi, [ebp - 0xac0]
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x494]
mov edi, 0x208
push edi
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [ebp - 0x494]
push esi
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.10001785
add esp, 0x10
lea eax, [ebp - 0x494]
push str.wbxreport.exe
push eax
call ebx
lea eax, [ebp - 0x494]
push esi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
pop ecx
pop ecx
test eax, eax
je 0x10003b6c
push dword [ebp - 0xab0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x494]
push eax
push str.WBXZIP_PROCESS_INTERNAL__wbxreport.exe_file_is_missing___s
call fcn.1000150d
pop ecx
pop ecx
xor eax, eax
jmp 0x10003c0a
push edi
lea eax, [ebp - 0xaac]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0xaac]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0xb04]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0xaac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10003bdf
push str.CreateProcess_wbxreport_for_Zip_wbxtrace_file_success_r_n
call fcn.1000150d
pop ecx
push dword [ebp - 0xabc]
call esi
jmp 0x10003bff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_wbxreport_failed__err___d_r_n
call fcn.1000150d
pop ecx
pop ecx
lea eax, [ebp - 0x28c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0xab0]
call esi
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100085db
leave
ret