Function at 0x3000901e
Capabilities:
Create process on windows
Get system information on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x30020490]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], edi
call fcn.3001d92f
xor ebx, ebx
mov esi, eax
inc ebx
cmp esi, edi
jl 0x30009272
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24c]
mov dword [0x30021364], eax
mov eax, 0x10000
mov dword [0x30021370], eax
mov dword [0x30021378], eax
mov dword [0x30021380], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [0x30021368], 0x3c
mov dword [0x3002136c], ebx
mov dword [0x30021374], ebx
mov dword [0x3002137c], ebx
mov dword [0x30021384], ebx
call fcn.30008883
mov esi, eax
cmp esi, edi
jl 0x30009272
cmp esi, ebx
je 0x30009270
cmp dword [ebp - 0x21c], edi
je 0x300090f7
push edi
push edi
call fcn.30008c45
mov esi, eax
jmp 0x30009272
cmp dword [ebp - 0x214], edi
je 0x30009222
push 0x44
pop esi
push esi
lea eax, [ebp - 0x294]
push edi
push eax
call fcn.30014b52
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
mov dword [ebp - 0x294], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x30009154
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x3000914e
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x30009272
push edi
lea eax, [ebp - 0x210]
push eax
push 0x30001ccc
push 0x30001a94
call fcn.30011f39
mov esi, eax
cmp esi, edi
jl 0x30009272
push edi
push ebx
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.30011cf0
mov esi, eax
cmp esi, edi
jl 0x30009272
push 4
push edi
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 0x210]
lea eax, [ebp - 0x218]
push 0x30001ca8
push eax
call fcn.300119ce
mov esi, eax
add esp, 0xc
cmp esi, edi
jl 0x30009272
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x294]
push eax
push edi
push edi
push 0x20
push edi
push edi
push edi
push dword [ebp - 0x218]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x30009208
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x30009206
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x30009272
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x30009272
mov eax, dword [0x30020294]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 0x228], 0x3000fd90
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x30009270
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x3000926e
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x30009272
xor esi, esi
cmp dword [0x30021390], edi
je 0x30009280
push ebx
call fcn.30013e80
cmp dword [ebp - 0x218], edi
je 0x30009293
push dword [ebp - 0x218]
call fcn.300113ed
cmp dword [ebp - 0x210], edi
je 0x300092a6
push dword [ebp - 0x210]
call fcn.300113ed
call fcn.30015acc
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.30014af0
leave
ret 0x10