Function at 0x10005ac0
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10020ace
mov eax, dword fs:[0]
push eax
sub esp, 0x744
mov eax, dword [0x100280f0]
xor eax, esp
mov dword [esp + 0x740], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100280f0]
xor eax, esp
push eax
lea eax, [esp + 0x758]
mov dword fs:[0], eax
mov eax, dword [esp + 0x76c]
mov ebp, dword [esp + 0x768]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [ecx - 8]
push eax
lea edi, [esp + 0x134]
call fcn.1000b210
add esp, 4
xor ebx, ebx
mov dword [esp + 0x760], ebx
push 1
mov edi, 0xf
push 0x100249ac
lea ecx, [esp + 0x64]
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call fcn.10001780
mov byte [esp + 0x760], 1
push 1
push 0x100249ac
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.10001780
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x48]
mov byte [esp + 0x768], 2
call fcn.10007880
lea edx, [esp + 0x64]
push edx
push eax
lea edi, [esp + 0x88]
mov byte [esp + 0x770], 3
call fcn.10007880
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x13c]
mov byte [esp + 0x76c], 4
call fcn.10001460
mov edi, 0x10
cmp dword [esp + 0x90], edi
jb 0x10005bdc
mov eax, dword [esp + 0x7c]
push eax
call fcn.1000dcfa
add esp, 4
cmp dword [esp + 0x58], edi
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x10005c05
mov ecx, dword [esp + 0x44]
push ecx
call fcn.1000dcfa
add esp, 4
cmp dword [esp + 0x2c], edi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
jb 0x10005c28
mov edx, dword [esp + 0x18]
push edx
call fcn.1000dcfa
add esp, 4
mov byte [esp + 0x760], bl
cmp dword [esp + 0x74], edi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
jb 0x10005c52
mov eax, dword [esp + 0x60]
push eax
call fcn.1000dcfa
add esp, 4
push 0xb
push str.__s___path
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.10001780
lea ecx, [esp + 0x14]
push ecx
push esi
lea edi, [esp + 0x48]
mov byte [esp + 0x768], 5
call fcn.10007880
lea edx, [esp + 0x138]
push edx
push eax
lea edi, [esp + 0x108]
mov byte [esp + 0x770], 6
call fcn.10007880
add esp, 0x10
mov edi, 0x10
cmp dword [esp + 0x58], edi
jb 0x10005cc1
mov eax, dword [esp + 0x44]
push eax
call fcn.1000dcfa
add esp, 4
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov byte [esp + 0x760], 9
cmp dword [esp + 0x2c], edi
jb 0x10005cec
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1000dcfa
add esp, 4
push 0x3ff
lea edx, [esp + 0x359]
push ebx
push edx
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x360], bl
call fcn.1000f430
mov eax, dword [esp + 0x108]
add esp, 0xc
cmp dword [esp + 0x110], edi
jae 0x10005d30
lea eax, [esp + 0xfc]
mov ecx, dword [esp + 0x10c]
push ecx
push eax
lea edx, [esp + 0x35c]
push 0x400
push edx
call fcn.1000ded5
add esp, 0x10
cmp ebp, ebx
je 0x10005d5e
push 4
push 0x100249bc
push ebx
push 4
call ebp
push 0x206
lea eax, [esp + 0x152]
push ebx
push eax
mov word [esp + 0x158], bx
call fcn.1000f430
add esp, 0xc
lea ecx, [esp + 0x14c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x44
lea edx, [esp + 0x98]
push ebx
push edx
call fcn.1000f430
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
add esp, 0xc
lea ebx, [esp + 0x354]
lea ecx, [esp + 0x114]
mov dword [esp + 0x94], 0x44
call fcn.1000b390
mov byte [esp + 0x760], 0xa
cmp dword [esi + 0x18], edi
jb 0x10005de2
mov esi, dword [esi + 4]
jmp 0x10005de5
add esi, 4
mov ebx, esi
lea ecx, [esp + 0xdc]
call fcn.1000b390
mov byte [esp + 0x760], 0xb
mov eax, dword [esp + 0x118]
mov edi, 8
cmp dword [esp + 0x12c], edi
jae 0x10005e17
lea eax, [esp + 0x118]
lea ecx, [esp + 0x30]
push ecx
xor ebx, ebx
lea edx, [esp + 0x98]
push edx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10005f27
cmp dword [esp + 0xf4], edi
mov eax, dword [esp + 0xe0]
jae 0x10005e57
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebp, ebx
je 0x10005e6d
push edi
push 0x100249c8
push ebx
push 6
call ebp
cmp dword [esp + 0xf4], edi
jb 0x10005e86
mov eax, dword [esp + 0xe0]
push eax
call fcn.1000dcfa
add esp, 4
cmp dword [esp + 0x12c], edi
mov esi, 7
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], ebx
mov word [esp + 0xe0], bx
jb 0x10005eba
mov ecx, dword [esp + 0x118]
push ecx
call fcn.1000dcfa
add esp, 4
mov dword [esp + 0x12c], esi
mov esi, 0x10
cmp dword [esp + 0x110], esi
mov dword [esp + 0x128], ebx
mov word [esp + 0x118], bx
jb 0x10005eee
mov edx, dword [esp + 0xfc]
push edx
call fcn.1000dcfa
add esp, 4
cmp dword [esp + 0x148], esi
mov dword [esp + 0x110], 0xf
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
jb 0x10005f20
mov eax, dword [esp + 0x134]
push eax
call fcn.1000dcfa
add esp, 4
xor eax, eax
jmp 0x10006021
mov ecx, dword [esp + 0x30]
push 0xea60
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x34]
push eax
call esi
cmp dword [esp + 0xf4], edi
mov eax, dword [esp + 0xe0]
jae 0x10005f62
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0xf4], edi
jb 0x10005f82
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.1000dcfa
add esp, 4
cmp dword [esp + 0x12c], edi
mov esi, 7
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], ebx
mov word [esp + 0xe0], bx
jb 0x10005fb6
mov edx, dword [esp + 0x118]
push edx
call fcn.1000dcfa
add esp, 4
mov dword [esp + 0x12c], esi
mov esi, 0x10
cmp dword [esp + 0x110], esi
mov dword [esp + 0x128], ebx
mov word [esp + 0x118], bx
jb 0x10005fea
mov eax, dword [esp + 0xfc]
push eax
call fcn.1000dcfa
add esp, 4
cmp dword [esp + 0x148], esi
mov dword [esp + 0x110], 0xf
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
jb 0x1000601c
mov ecx, dword [esp + 0x134]
push ecx
call fcn.1000dcfa
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x758]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x740]
xor ecx, esp
call fcn.1000dec6
add esp, 0x750
ret 8