Function at 0x110c2fe0
Capabilities:
Create process on windows
Delete file
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc84
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x204]
push ecx
push 0
mov dword [ebp - 0xc3c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x204]
push 0x5c
push edx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
xor ecx, ecx
push 0x104
lea edx, [ebp - 0xc24]
mov word [eax + 2], cx
push edx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
xor eax, eax
jmp 0x110c3050
movzx ecx, word [ebp + eax - 0xc24]
mov word [ebp + eax - 0x204], cx
add eax, 2
test cx, cx
jne 0x110c3050
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push str.xdomain.exe
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x60c]
push 0x111fb8fc
push edx
call edi
add esp, 0x10
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x60c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x110c30cc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
push ebx
push 0
lea ecx, [ebp - 0xc40]
push ecx
push 0xcbb
push 0x11219198
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push str.xdomain.txt
lea edx, [ebp - 0x204]
push edx
push str.xdomain.exe_
mov eax, edx
push eax
lea ecx, [ebp - 0xa1c]
push str.__s_s_s_s
push ecx
call edi
xor eax, eax
push 0x44
push eax
lea edx, [ebp - 0xc84]
push edx
mov dword [ebp - 0xc34], eax
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0xc28], eax
call sub.MSVCR100.dll_memset
add esp, 0x24
xor eax, eax
lea ecx, [ebp - 0xc34]
push ecx
lea edx, [ebp - 0xc84]
push edx
push eax
push eax
push 0x8000000
push 1
push eax
push eax
mov word [ebp - 0xc54], ax
lea eax, [ebp - 0xa1c]
push eax
push 0
mov dword [ebp - 0xc84], 0x44
mov dword [ebp - 0xc58], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x110c327a
mov ecx, dword [ebp - 0xc34]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.xdomain.txt
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x814]
push 0x111fb8fc
push eax
call edi
add esp, 0x10
push 0
push 0x80
push 4
push 0
push 1
push 0xc0000000
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
cmp esi, 0xffffffff
je 0x110c321f
mov edx, dword [ebp - 0xc34]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0xc34]
push eax
call ebx
mov ecx, dword [ebp - 0xc30]
push ecx
call ebx
push 0
lea edx, [ebp - 0xc38]
push edx
push 0x200
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x110c3234
push esi
call ebx
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc38]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + edx*2 - 0x404], cx
mov edx, dword [ebp - 0xc3c]
push eax
lea ecx, [ebp - 0x404]
push ecx
push edx
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
push esi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x60c]
push eax
call esi
lea ecx, [ebp - 0x814]
push ecx
call esi
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.111d9022
mov esp, ebp
pop ebp
ret