Function at 0x3001a89e
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov eax, 0x249c
lea ebp, [esp - 0x241c]
call fcn.3001f58a
mov eax, dword [0x30034be8]
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp + 0x2418], eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x10], ebx
call fcn.3000cc94
lea ecx, [ebp]
call fcn.3000cc94
lea ecx, [ebp + 0x68]
call fcn.3000cc94
lea ecx, [ebp + 0x38]
call fcn.3000cc94
lea ecx, [ebp - 0x18]
call fcn.3000cc94
or dword [ebp + 0x44], 0xffffffff
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
call fcn.300109a0
mov dword [ebp + 0x18], eax
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea edi, [ebp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
or dword [ebp + 0x28], 0xffffffff
or dword [ebp + 0x24], 0xffffffff
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x50], ebx
jmp 0x3001b0b3
mov esi, 0x30008d18
push esi
lea eax, [ebp + 0x14]
push eax
call fcn.30019543
cmp eax, 0xfffffe0c
je 0x3001b0e4
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea edi, [ebp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0x44
call fcn.300138ef
push esi
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call fcn.3001a4ec
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b0fc
push dword [ebp]
and dword [0x3007b5f8], 0xfffffffd
call fcn.30019a4c
mov dword [ebp + 0x40], eax
call fcn.3001c5e5
push dword [ebp + 0x40]
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.3001a20f
test eax, eax
je 0x3001b106
push esi
push dword [ebp + 0x14]
call fcn.3001a841
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b117
push dword [ebp + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
test eax, eax
jne 0x3001a9ea
push dword [ebp + 0x68]
call edi
test eax, eax
je 0x3001b015
cmp dword [ebp + 0x40], ebx
jne 0x3001ae3f
call fcn.30016c17
cmp dword [0x30076f28], ebx
jne 0x3001ada3
cmp dword [0x3007bc44], ebx
je 0x3001ada3
lea ecx, [ebp + 0x1c]
call fcn.3000cc94
push dword [0x30076cf4]
lea eax, [ebp + 0x1c]
push eax
push 0x30008f40
mov dword [ebp + 8], ebx
call fcn.3001185c
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x68]
call fcn.3001017f
mov edi, eax
xor esi, esi
cmp dword [ebp + 0x64], ebx
mov dword [ebp + 0x50], edi
jle 0x3001ad72
push dword [edi + esi*4]
push 0x3000a2f4
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x3001aa68
inc esi
cmp esi, dword [ebp + 0x64]
jl 0x3001aa4b
jmp 0x3001ad72
mov esi, dword [edi + esi*4 + 4]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x3001ad72
xor esi, esi
cmp dword [ebp + 0x64], ebx
jle 0x3001aab5
push 0xa
push dword [edi + esi*4]
push 0x3000a2dc
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x3001aa9d
inc esi
cmp esi, dword [ebp + 0x64]
jl 0x3001aa7e
jmp 0x3001aab5
push ebx
push dword [edi + esi*4]
lea eax, [ebp + 0x4c]
push eax
mov dword [ebp + 0x44], esi
call fcn.3001da0d
cmp eax, ebx
jl 0x3001b121
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x3001aae2
cmp word [eax], bx
je 0x3001aae2
push eax
xor esi, esi
push 0xa
inc esi
push 0x30077154
mov dword [0x30076f2c], esi
call fcn.3000cd1d
cmp eax, ebx
jl 0x3001b141
mov dword [ebp + 8], esi
push dword [ebp + 0x18]
lea eax, [ebp + 0x2204]
push 0x104
push eax
push dword [ebp - 8]
lea eax, [ebp + 0x4c]
push eax
mov word [ebp + 0x2204], bx
call fcn.300171be
cmp eax, ebx
jne 0x3001ad48
cmp dword [ebp + 0x44], 0xffffffff
je 0x3001ab30
mov eax, dword [ebp + 0x44]
lea esi, [edi + eax*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x3001ab24
push eax
call fcn.3001f22f
mov eax, dword [ebp + 0x4c]
or dword [ebp + 0x44], 0xffffffff
mov dword [esi], eax
mov dword [ebp + 0x4c], ebx
mov eax, dword [0x3007bc44]
dec eax
push ebx
mov esi, 0x30076cf8
push esi
je 0x3001ab50
dec eax
je 0x3001ab49
push 0x3000446c
jmp 0x3001ab55
push 0x3000a2d8
jmp 0x3001ab55
push 0x3000444c
push 0x30008f60
call fcn.30011653
cmp dword [0x3007bc44], ebx
je 0x3001ad72
cmp dword [0x3003410c], ebx
je 0x3001ab7e
push esi
push 0x3000a2b4
call fcn.30011722
lea ecx, [ebp + 0x68]
call fcn.3000ccd8
cmp dword [ebp + 0x64], ebx
mov dword [ebp + 0x70], ebx
jle 0x3001acb5
cmp dword [ebp + 0x70], ebx
je 0x3001aba4
push 0x30003ba8
lea ecx, [ebp + 0x68]
call fcn.3000cf63
mov eax, dword [ebp + 0x70]
mov esi, dword [edi + eax*4]
push esi
push 0x3000a294
call fcn.3000ff32
cmp esi, dword [ebp - 8]
pop ecx
pop ecx
jne 0x3001abc2
lea esi, [ebp + 0x2204]
push 0x3d
push esi
call fcn.30015a7f
cmp eax, ebx
je 0x3001abef
cmp word [eax + 2], bx
jne 0x3001abef
push esi
lea ecx, [ebp + 0x68]
call fcn.3000cf63
push 0x30001620
lea ecx, [ebp + 0x68]
call fcn.3000cf63
jmp 0x3001aca6
push 0x20
push esi
call fcn.30015a7f
test eax, eax
jne 0x3001ac0a
push 0x22
push esi
call fcn.30015a7f
test eax, eax
jne 0x3001ac0a
push esi
jmp 0x3001abe2
push 0x3d
xor eax, eax
mov word [ebp + 0x54], bx
lea edi, [ebp + 0x56]
push esi
stosw word es:[edi], ax
call fcn.30015a7f
test eax, eax
je 0x3001ac66
cmp word [esi], 0x2f
je 0x3001ac66
mov ax, word [esi]
cmp ax, bx
je 0x3001ac3f
mov word [ebp + 0x54], ax
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp + 0x68]
call fcn.3000cf63
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
je 0x3001ac66
cmp ax, 0x3d
jne 0x3001ac27
cmp ax, bx
je 0x3001ac66
mov word [ebp + 0x54], ax
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp + 0x68]
call fcn.3000cf63
inc esi
inc esi
mov edi, 0x30003ba0
push edi
lea ecx, [ebp + 0x68]
call fcn.3000cf63
jmp 0x3001ac92
cmp ax, 0x22
jne 0x3001ac83
push 0x30001620
jmp 0x3001ac8b
mov word [ebp + 0x54], ax
lea eax, [ebp + 0x54]
push eax
call fcn.3000cf63
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
lea ecx, [ebp + 0x68]
jne 0x3001ac76
push edi
call fcn.3000cf63
mov edi, dword [ebp + 0x50]
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp + 0x64]
jl 0x3001ab92
mov eax, dword [0x30077150]
add eax, 0x40
cmp dword [ebp + 8], ebx
mov dword [ebp + 0x34], 0x58
mov word [ebp + 0x34], ax
lea eax, [ebp + 0x34]
je 0x3001acd3
push ebx
jmp 0x3001acd5
push 1
push 0x30076cf8
push eax
push 0x30008f40
call fcn.30011653
xor eax, eax
mov word [ebp + 0x240c], bx
lea edi, [ebp + 0x240e]
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
lea eax, [ebp + 0x240c]
push eax
push 0x3000446c
push 0x30008f34
push 0x30008f10
call fcn.3001038d
lea eax, [ebp + 0x240c]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
cmp eax, ebx
pop ecx
mov dword [0x30076f24], eax
je 0x3001ad39
push 0x30076cf8
push 0x3000a284
call fcn.30011722
push 0x3000a238
call fcn.3000fe20
mov edi, dword [ebp + 0x50]
jmp 0x3001ad72
cmp eax, 0x80004004
je 0x3001b153
push ebx
push 0x30076cf8
push 0x3000446c
push 0x30008f60
call fcn.30011653
push 0x3000a1f8
call fcn.3000fe20
xor esi, esi
cmp dword [ebp + 0x64], ebx
jle 0x3001ad87
push dword [edi + esi*4]
call fcn.3001f22f
inc esi
cmp esi, dword [ebp + 0x64]
jl 0x3001ad79
push edi
call fcn.3001f22f
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x50], ebx
call fcn.3000cc9e
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, 0x30008d18
lea eax, [ebp + 0x68]
push eax
call fcn.30019f31
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b15f
push 0x30003ba8
lea ecx, [ebp + 0x68]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b169
lea eax, [ebp - 0x18]
push eax
call fcn.300119a5
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b173
push dword [ebp - 0x18]
lea ecx, [ebp + 0x68]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b17d
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.30019543
cmp eax, 0xfffffe0c
je 0x3001ae22
push 0x3000a1c4
lea ecx, [ebp + 0x68]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b187
cmp dword [ebp + 0x48], ebx
je 0x3001ae3f
push 0x3000a194
lea ecx, [ebp + 0x68]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b191
push dword [ebp + 0x68]
call edi
test eax, eax
je 0x3001ae55
push dword [ebp + 0x38]
call edi
test eax, eax
je 0x3001b19b
lea ecx, [ebp + 0x58]
call fcn.3000cc94
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp + 0x3c]
push 0x20
lea eax, [ecx + eax + 4]
pop esi
push eax
lea ecx, [ebp + 0x58]
call fcn.3000cd95
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b1a5
push 0x30003ba0
lea ecx, [ebp + 0x58]
call fcn.3000ce85
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b1b2
push dword [ebp + 0x38]
lea ecx, [ebp + 0x58]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b1b9
push 0x30001628
lea ecx, [ebp + 0x58]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b1b2
push dword [ebp + 0x68]
lea ecx, [ebp + 0x58]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b1b9
call fcn.3000fe6a
push 0x3000a174
call fcn.3000fe20
push dword [ebp - 0x10]
call fcn.3000fe20
push dword [ebp + 0x58]
call fcn.3000fe20
push dword [ebp + 4]
push dword [ebp]
push 0x3000a160
call fcn.3000ff32
add esp, 0xc
cmp dword [ebp + 0xc], ebx
mov ecx, 0x30008c44
jne 0x3001af1b
mov ecx, 0x30008c50
cmp dword [ebp - 4], ebx
mov eax, 0x30008c44
jne 0x3001af2a
mov eax, 0x30008c50
push ecx
push eax
push 0x3000a110
call fcn.3000ff32
add esp, 0xc
test byte [ebp + 0x10], 1
je 0x3001af44
mov esi, 0x8000020
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 0x58]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x3001b1c0
push dword [ebp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
or dword [ebp + 0x28], 0xffffffff
cmp dword [ebp + 0x40], ebx
jne 0x3001af7f
push 0x3000a0c8
jmp 0x3001af84
push 0x3000a070
call fcn.3000fe20
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 0xff
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x24]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x3001b1e0
cmp dword [ebp + 0x60], 0x103
je 0x3001b059
push dword [ebp + 0x60]
lea eax, [ebp + 0x2074]
push 0xc8
push eax
call fcn.3001510b
push eax
push 0x3000a020
call fcn.3000ff32
add esp, 0xc
push dword [ebp + 0x24]
call edi
or dword [ebp + 0x24], 0xffffffff
lea ecx, [ebp + 0x58]
call fcn.3000cc9e
mov esi, 0x642
cmp dword [ebp + 0x60], esi
jne 0x3001b015
push 1
call fcn.30019d12
cmp dword [0x30077214], ebx
je 0x3001b1f6
push 0x30008d18
lea eax, [ebp - 0x1c]
push eax
call fcn.30019543
xor ecx, ecx
cmp eax, 0xfffffe0c
mov eax, dword [ebp + 0x60]
setne cl
cmp eax, 0xbc2
mov esi, ecx
jne 0x3001b06d
mov dword [0x30077214], 1
jmp 0x3001b09c
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call esi
test eax, eax
jne 0x3001b045
jmp 0x3001af8f
cmp eax, 0x669
je 0x3001b32c
cmp dword [ebp + 0xc], ebx
jne 0x3001b29f
cmp esi, ebx
jne 0x3001b091
cmp dword [0x30077214], ebx
jne 0x3001b2b1
cmp eax, 0x644
je 0x3001b208
cmp dword [ebp - 4], ebx
jne 0x3001b0b3
cmp eax, 0xbc2
je 0x3001b0b3
cmp eax, ebx
mov dword [ebp + 0x70], eax
jne 0x3001b1fe
push 0x30009fd0
call fcn.3000ff32
pop ecx
push dword [0x300341b8]
lea eax, [ebp + 0x48]
push eax
push 1
call fcn.30019959
cmp eax, ebx
mov dword [ebp + 0x70], eax
je 0x3001a924
push 0x30009f9c
jmp 0x3001b313
cmp dword [ebp + 0x48], ebx
je 0x3001b0f4
cmp dword [ebp + 0x60], ebx
jne 0x3001b0f4
push ebx
call fcn.3000d780
mov dword [ebp + 0x70], ebx
jmp 0x3001b32c
push 0x30009f84
jmp 0x3001b313
push 1
call fcn.3000d780
mov esi, 0x80070015
jmp 0x3001b3ac
push 0x30009f6c
jmp 0x3001b313
push eax
push 0x30001400
call fcn.3000fdf9
push 0x30009f38
call fcn.3000fdf9
add esp, 0xc
lea ecx, [ebp + 0x1c]
jmp 0x3001b1ec
push eax
push 0x30001400
call fcn.3000fdf9
push 0x30009f00
jmp 0x3001b131
push 0x30009ea8
call fcn.3000fe20
jmp 0x3001b139
push 0x30009e7c
jmp 0x3001b313
push 0x300093d0
jmp 0x3001b313
push 0x30009e5c
jmp 0x3001b313
push 0x30009e1c
jmp 0x3001b313
push 0x30009ddc
jmp 0x3001b313
push 0x30009da0
jmp 0x3001b313
mov esi, 0xfffffe0b
jmp 0x3001b3ac
push 0x300017d0
call fcn.3000fdf9
pop ecx
jmp 0x3001b1e9
push 0x300058cc
jmp 0x3001b1aa
push 0x30009d8c
jmp 0x3001b1aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x30003bac
mov dword [ebp + 0x70], eax
call fcn.3000fe20
push dword [ebp + 0x38]
push dword [ebp + 0x70]
call fcn.3000db14
jmp 0x3001b1e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x70], eax
lea ecx, [ebp + 0x58]
call fcn.3000cc9e
jmp 0x3001b32c
mov dword [ebp + 0x70], esi
jmp 0x3001b32c
push 0x30009d74
jmp 0x3001b313
cmp esi, ebx
je 0x3001b217
push dword [ebp + 0x2424]
call fcn.30012a37
mov edi, 0x800
push edi
lea eax, [ebp + 0x1074]
push eax
push 0x49
call fcn.3000ffad
push 0x30056888
lea eax, [ebp + 0x1074]
push eax
lea eax, [ebp + 0x74]
push edi
push eax
call fcn.3000d759
add esp, 0x10
cmp esi, ebx
mov dword [0x30076cfc], eax
jne 0x3001b256
cmp dword [ebp + 0x60], 0x644
je 0x3001b290
cmp dword [0x3007720c], ebx
jne 0x3001b290
push ebx
lea eax, [ebp + 0x74]
push eax
push ebx
call fcn.3000d173
cmp eax, 6
jne 0x3001b290
call fcn.30019ab6
cmp eax, ebx
mov dword [ebp + 0x70], eax
je 0x3001b284
push 0x30009d4c
jmp 0x3001b313
mov dword [ebp + 0x70], 0xfffffe0a
jmp 0x3001b32c
push 0x30009cf8
call fcn.3000ff32
jmp 0x3001b32b
cmp esi, ebx
je 0x3001b2b1
push dword [ebp + 0x2424]
call fcn.30012a37
mov eax, dword [ebp + 0x60]
cmp dword [0x3007720c], ebx
jne 0x3001b284
cmp esi, ebx
jne 0x3001b2e6
cmp dword [0x30077198], ebx
jne 0x3001b2e6
cmp dword [0x30077194], ebx
jne 0x3001b2e6
cmp eax, 0x644
jne 0x3001b2e6
push 0x30009c98
call fcn.3000fe20
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x70], eax
jmp 0x3001b32c
push ebx
push 0x47
push ebx
call fcn.3000d698
cmp eax, 6
jne 0x3001b31a
call fcn.30019ab6
push eax
push 0x30009c5c
mov dword [ebp + 0x70], eax
call fcn.3000ff32
cmp dword [ebp + 0x70], ebx
pop ecx
pop ecx
je 0x3001b31a
push 0x30009c34
call fcn.3000fdf9
jmp 0x3001b32b
push 0x30009be8
call fcn.3000ff32
mov dword [ebp + 0x70], 0xfffffe0a
pop ecx
push 0x30009b98
call fcn.3000ff32
cmp dword [ebp + 0x28], 0xffffffff
pop ecx
je 0x3001b346
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x24], 0xffffffff
je 0x3001b355
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x70], ebx
je 0x3001b377
test byte [0x3007b5f8], 2
je 0x3001b377
cmp dword [ebp + 0x18], ebx
je 0x3001b377
push 0x30009b68
call fcn.3000fcd6
call fcn.300166b3
cmp dword [ebp + 0x50], ebx
je 0x3001b39c
xor esi, esi
cmp dword [ebp + 0x64], ebx
jle 0x3001b394
mov eax, dword [ebp + 0x50]
push dword [eax + esi*4]
call fcn.3001f22f
inc esi
cmp esi, dword [ebp + 0x64]
jl 0x3001b383
push dword [ebp + 0x50]
call fcn.3001f22f
cmp dword [ebp + 0x4c], ebx
je 0x3001b3a9
push dword [ebp + 0x4c]
call fcn.3001f22f
mov esi, dword [ebp + 0x70]
lea ecx, [ebp - 0x18]
call fcn.3000cc9e
lea ecx, [ebp + 0x38]
call fcn.3000cc9e
lea ecx, [ebp + 0x68]
call fcn.3000cc9e
lea ecx, [ebp]
call fcn.3000cc9e
lea ecx, [ebp - 0x10]
call fcn.3000cc9e
mov ecx, dword [ebp + 0x2418]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.3001f57d
add ebp, 0x241c
leave
ret 4