Function at 0x2e008353
Capabilities:
Create process on windows
Get system information on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], edi
call fcn.2e01f0db
xor ebx, ebx
mov esi, eax
inc ebx
cmp esi, edi
jl 0x2e0085a7
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24c]
mov dword [0x2e021e94], eax
mov eax, 0x10000
mov dword [0x2e021ea0], eax
mov dword [0x2e021ea8], eax
mov dword [0x2e021eb0], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [0x2e021e98], 0x3c
mov dword [0x2e021e9c], ebx
mov dword [0x2e021ea4], ebx
mov dword [0x2e021eac], ebx
mov dword [0x2e021eb4], ebx
call fcn.2e007bb0
mov esi, eax
cmp esi, edi
jl 0x2e0085a7
cmp esi, ebx
je 0x2e0085a5
cmp dword [ebp - 0x21c], edi
je 0x2e00842c
push edi
push edi
call fcn.2e007f7a
mov esi, eax
jmp 0x2e0085a7
cmp dword [ebp - 0x214], edi
je 0x2e008557
push 0x44
pop esi
push esi
lea eax, [ebp - 0x294]
push edi
push eax
call fcn.2e0140ad
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
mov dword [ebp - 0x294], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x2e008489
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x2e008483
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e0085a7
push edi
lea eax, [ebp - 0x210]
push eax
push 0x2e001c0c
push 0x2e0019d4
call fcn.2e0115b0
mov esi, eax
cmp esi, edi
jl 0x2e0085a7
push edi
push ebx
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.2e011381
mov esi, eax
cmp esi, edi
jl 0x2e0085a7
push 4
push edi
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 0x210]
lea eax, [ebp - 0x218]
push 0x2e001be8
push eax
call fcn.2e010ecd
mov esi, eax
add esp, 0xc
cmp esi, edi
jl 0x2e0085a7
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x294]
push eax
push edi
push edi
push 0x20
push edi
push edi
push edi
push dword [ebp - 0x218]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x2e00853d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x2e00853b
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e0085a7
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x2e0085a7
mov eax, dword [section..data]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 0x228], 0x2e00f66c
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x2e0085a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x2e0085a3
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e0085a7
xor esi, esi
cmp dword [0x2e021ec0], edi
je 0x2e0085b5
push ebx
call fcn.2e013385
cmp dword [ebp - 0x218], edi
je 0x2e0085c8
push dword [ebp - 0x218]
call fcn.2e0110b3
cmp dword [ebp - 0x210], edi
je 0x2e0085db
push dword [ebp - 0x210]
call fcn.2e0110b3
call fcn.2e015485
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e013f7c
leave
ret 0x10