Function at 0x1008f230
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10178106
mov eax, dword fs:[0]
push eax
sub esp, 0x94c
mov eax, dword [0x101e8118]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.100187b0
mov dword [ebp - 0x4e8], eax
push 0x10190a20
push 1
lea eax, [ebp - 0x90c]
push eax
call fcn.100addf0
add esp, 8
mov dword [ebp - 0x91c], eax
mov ecx, dword [ebp - 0x91c]
mov dword [ebp - 0x920], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x920]
push edx
lea eax, [ebp - 0x4d8]
push eax
call fcn.10019630
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x90c]
call fcn.10006030
push str.tbhelperU.dll
push 1
lea ecx, [ebp - 0x910]
push ecx
call fcn.100addf0
add esp, 8
mov dword [ebp - 0x924], eax
mov edx, dword [ebp - 0x924]
mov dword [ebp - 0x928], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x928]
push eax
lea ecx, [ebp - 0xc4]
push ecx
call fcn.10019630
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x910]
call fcn.10006030
mov ecx, 0x29
mov esi, str.:Repeat_r_ndel__F__Q___s__r_ndel__F__Q___s__r_ndel__F__Q___s__r_nif_exist___s__goto_Repeat_r_nif_exist___s__goto_Repeat_r_nif_exist___s__goto_Repeat_r_nrmdir___s__r_ndel__F__Q___s_
lea edi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x8fc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x8fc]
push ecx
call fcn.10140690
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x4d4]
push eax
call fcn.10140680
add esp, 8
push 0x5c
lea ecx, [ebp - 0x4d4]
push ecx
call fcn.10090c20
add esp, 8
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0
je 0x1008f37b
mov edx, dword [ebp - 0x4e4]
mov byte [edx], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x8fc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xffffffff
je 0x1008f6fc
push 0xfa00
call fcn.10139b2d
add esp, 4
mov dword [ebp - 0x914], eax
mov ecx, dword [ebp - 0x914]
mov dword [ebp - 0x904], ecx
push 0
lea ecx, [ebp - 0xc4]
call fcn.10005f10
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x1008f3f4
mov dword [ebp - 0x92c], 0
jmp 0x1008f46a
mov edx, dword [ebp - 0x4dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x3fffffff
jle 0x1008f422
mov dword [ebp - 0x930], 0
jmp 0x1008f45e
mov eax, dword [ebp - 0xc0]
shl eax, 1
call fcn.1013ecc0
mov dword [ebp - 0x934], esp
mov eax, dword [ebp - 0x4e8]
push eax
mov ecx, dword [ebp - 0xc0]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x4dc]
push edx
mov eax, dword [ebp - 0x934]
push eax
call fcn.10028520
mov dword [ebp - 0x930], eax
mov ecx, dword [ebp - 0x930]
mov dword [ebp - 0x92c], ecx
push 0
lea ecx, [ebp - 0x4d8]
call fcn.10005f10
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x1008f492
mov dword [ebp - 0x938], 0
jmp 0x1008f508
mov edx, dword [ebp - 0x4dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x3fffffff
jle 0x1008f4c0
mov dword [ebp - 0x93c], 0
jmp 0x1008f4fc
mov eax, dword [ebp - 0xc0]
shl eax, 1
call fcn.1013ecc0
mov dword [ebp - 0x940], esp
mov eax, dword [ebp - 0x4e8]
push eax
mov ecx, dword [ebp - 0xc0]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x4dc]
push edx
mov eax, dword [ebp - 0x940]
push eax
call fcn.10028520
mov dword [ebp - 0x93c], eax
mov ecx, dword [ebp - 0x93c]
mov dword [ebp - 0x938], ecx
push 0
lea ecx, [ebp - 0xc4]
call fcn.10005f10
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x1008f530
mov dword [ebp - 0x944], 0
jmp 0x1008f5a6
mov edx, dword [ebp - 0x4dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x3fffffff
jle 0x1008f55e
mov dword [ebp - 0x948], 0
jmp 0x1008f59a
mov eax, dword [ebp - 0xc0]
shl eax, 1
call fcn.1013ecc0
mov dword [ebp - 0x94c], esp
mov eax, dword [ebp - 0x4e8]
push eax
mov ecx, dword [ebp - 0xc0]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x4dc]
push edx
mov eax, dword [ebp - 0x94c]
push eax
call fcn.10028520
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x948]
mov dword [ebp - 0x944], ecx
push 0
lea ecx, [ebp - 0x4d8]
call fcn.10005f10
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x1008f5ce
mov dword [ebp - 0x950], 0
jmp 0x1008f644
mov edx, dword [ebp - 0x4dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x3fffffff
jle 0x1008f5fc
mov dword [ebp - 0x954], 0
jmp 0x1008f638
mov eax, dword [ebp - 0xc0]
shl eax, 1
call fcn.1013ecc0
mov dword [ebp - 0x958], esp
mov eax, dword [ebp - 0x4e8]
push eax
mov ecx, dword [ebp - 0xc0]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x4dc]
push edx
mov eax, dword [ebp - 0x958]
push eax
call fcn.10028520
mov dword [ebp - 0x954], eax
mov ecx, dword [ebp - 0x954]
mov dword [ebp - 0x950], ecx
lea edx, [ebp - 0x8fc]
push edx
lea eax, [ebp - 0x4d4]
push eax
mov ecx, dword [ebp - 0x92c]
push ecx
mov edx, dword [ebp - 0x938]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x944]
push ecx
mov edx, dword [ebp - 0x950]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xbc]
push ecx
mov edx, dword [ebp - 0x904]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x28
push 0
lea eax, [ebp - 0x908]
push eax
mov ecx, dword [ebp - 0x904]
push ecx
call fcn.1013ec30
add esp, 4
push eax
mov edx, dword [ebp - 0x904]
push edx
mov eax, dword [ebp - 0x4e0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x4e0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea edx, [ebp - 0x8fc]
push edx
push 0x10190b00
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x918], eax
mov ecx, dword [ebp - 0x918]
push ecx
call fcn.10139d64
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc4]
call fcn.10006030
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.10006030
lea esp, [ebp - 0x964]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1013a297
mov esp, ebp
pop ebp
ret