Function at 0xc8393c
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x108
push 0
push 0
dec ecx
jne 0xc83944
push ecx
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x5d8]
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x800]
xor eax, eax
push ebp
push 0xc83d7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00c838b0
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00c81b50
je 0xc839a4
mov eax, dword [ebp - 4]
call fcn.00c81a98
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.00c81a88
mov ecx, 0xc83d8c
pop edx
call fcn.00c82704
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00c81b50
je 0xc83d53
jmp 0xc83d43
lea eax, [ebp - 0xc]
call fcn.00c8190c
lea eax, [ebp - 8]
call fcn.00c8190c
mov eax, ebx
mov edx, 0x228
call fcn.00c82650
mov eax, dword [ebp - 4]
call fcn.00c81a88
mov edx, eax
mov eax, ebx
mov ecx, 0x228
call fcn.00c82648
lea eax, [ebp - 4]
mov ecx, 0x228
mov edx, 1
call fcn.00c81c20
lea eax, [ebp - 0xc]
push eax
push 0
push 2
mov eax, dword [ebx + 0x210]
mov edx, dword [ebx + 0x214]
call fcn.00c81ee0
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00c81bd4
push 0
push 2
mov eax, dword [ebx + 0x210]
mov edx, dword [ebx + 0x214]
call fcn.00c81ee0
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.00c81c20
cmp byte [ebx + 0x220], 0
jne 0xc83ae1
push 0
lea eax, [ebp - 0x804]
push eax
lea edx, [ebp - 0x304]
mov eax, 0xc83d9c
call fcn.00c82e98
mov edx, eax
lea eax, [ebp - 0x808]
call fcn.00c81a24
mov eax, dword [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
mov edx, ebx
mov ecx, 0x105
call fcn.00c81a6c
mov ecx, dword [ebp - 0x80c]
mov eax, 0x80000001
pop edx
call fcn.00c82960
mov eax, dword [ebp - 0x804]
mov edx, 0xc83db4
call fcn.00c81b50
je 0xc83d43
push 0xc83dbc
push 2
lea edx, [ebp - 0x304]
mov eax, 0xc83d9c
call fcn.00c82e98
mov edx, eax
mov ecx, ebx
mov eax, 0x80000001
call fcn.00c82a80
mov eax, dword [ebx + 0x218]
test eax, eax
jne 0xc83b2a
lea eax, [ebp - 0x810]
mov edx, ebx
mov ecx, 0x105
call fcn.00c81a6c
mov eax, dword [ebp - 0x810]
push eax
call fcn.00c82af8
mov edx, eax
lea eax, [ebp - 0x814]
call fcn.00c81a24
mov edx, dword [ebp - 0x814]
lea eax, [ebp - 8]
pop ecx
call fcn.00c81aa4
jmp 0xc83c45
cmp eax, 1
jne 0xc83b6e
lea eax, [ebp - 0x818]
mov edx, ebx
mov ecx, 0x105
call fcn.00c81a6c
mov eax, dword [ebp - 0x818]
push eax
call fcn.00c82b24
mov edx, eax
lea eax, [ebp - 0x81c]
call fcn.00c81a24
mov edx, dword [ebp - 0x81c]
lea eax, [ebp - 8]
pop ecx
call fcn.00c81aa4
jmp 0xc83c45
cmp eax, 2
jne 0xc83bb2
lea eax, [ebp - 0x820]
mov edx, ebx
mov ecx, 0x105
call fcn.00c81a6c
mov eax, dword [ebp - 0x820]
push eax
call fcn.00c82b50
mov edx, eax
lea eax, [ebp - 0x824]
call fcn.00c81a24
mov edx, dword [ebp - 0x824]
lea eax, [ebp - 8]
pop ecx
call fcn.00c81aa4
jmp 0xc83c45
cmp eax, 3
jne 0xc83bf3
lea eax, [ebp - 0x828]
mov edx, ebx
mov ecx, 0x105
call fcn.00c81a6c
mov eax, dword [ebp - 0x828]
push eax
call fcn.00c82ad0
mov edx, eax
lea eax, [ebp - 0x82c]
call fcn.00c81a24
mov edx, dword [ebp - 0x82c]
lea eax, [ebp - 8]
pop ecx
call fcn.00c81aa4
jmp 0xc83c45
cmp eax, 4
jne 0xc83c45
call fcn.00c82bf0
test eax, eax
je 0xc83c45
call fcn.00c82bf0
mov edx, 0xc83dc4
call fcn.00c82e98
mov edx, eax
lea eax, [ebp - 0x830]
call fcn.00c81a24
mov eax, dword [ebp - 0x830]
push eax
lea eax, [ebp - 0x834]
mov edx, ebx
mov ecx, 0x105
call fcn.00c81a6c
mov ecx, dword [ebp - 0x834]
lea eax, [ebp - 8]
pop edx
call fcn.00c81aa4
push 0
push 4
lea eax, [ebp - 0x838]
mov ecx, 0xc83dcc
mov edx, dword [ebp - 8]
call fcn.00c81aa4
mov eax, dword [ebp - 0x838]
call fcn.00c81a88
mov edx, 0xc83dbc
call fcn.00c82d08
test al, al
jne 0xc83cbb
call fcn.00c82ad0
mov edx, 0xc83dc4
call fcn.00c82e98
mov edx, eax
lea eax, [ebp - 0x83c]
call fcn.00c81a24
mov eax, dword [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
mov edx, ebx
mov ecx, 0x105
call fcn.00c81a6c
mov ecx, dword [ebp - 0x840]
lea eax, [ebp - 8]
pop edx
call fcn.00c81aa4
jmp 0xc83cdf
lea eax, [ebp - 0x844]
mov ecx, 0xc83ddc
mov edx, dword [ebp - 8]
call fcn.00c81aa4
mov eax, dword [ebp - 0x844]
call fcn.00c81a88
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 0xc]
call fcn.00c81a98
add eax, eax
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.00c81a88
push eax
mov eax, dword [ebp - 8]
call fcn.00c81a88
mov esi, eax
mov eax, esi
pop edx
call fcn.00c82d08
mov eax, dword [ebx + 0x21c]
cmp eax, 2
je 0xc83d43
cmp eax, 1
jne 0xc83d2c
push 0
push 0
push 0
push esi
push 0xc83de8
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0xc83d43
test eax, eax
jne 0xc83d43
push 1
push 0
push 0
push esi
push 0xc83de8
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00c81b50
jne 0xc839b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc83d85
lea eax, [ebp - 0x844]
mov edx, 0x11
call fcn.00c81924
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00c81924
ret