Function at 0x10231cf
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x308c
call sub.ntdll.dll__chkstk
mov eax, dword [0x102c22c]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
lea edx, [ebp - 0x3034]
push edx
push 0x10096f8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x3030], eax
mov dword [ebp - 0x302c], ecx
xor esi, esi
mov word [ebp - 0x414], bx
call fcn.01022391
test eax, eax
jne 0x1023222
inc esi
jmp 0x1023cce
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0xe1c]
push eax
call fcn.010223f6
test eax, eax
je 0x1023cb7
push edi
lea eax, [ebp - 0x1824]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xe1c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01022460
test eax, eax
je 0x1023cb7
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x3028], eax
jne 0x10232a5
lea eax, [ebp - 0x414]
push eax
push 0x10096d4
call fcn.01015c5a
pop ecx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0x3038]
push eax
push 2
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
mov word [ebp - 0x20c], 0xfeff
call edi
mov esi, eax
cmp esi, ebx
jne 0x10232e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10096b8
jmp 0x1023bb1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x3038]
push eax
mov esi, 0x10096b0
push esi
call ebx
shl eax, 1
push eax
push esi
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x102331d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100969c
jmp 0x1023bb1
push 0x100967c
push 0x1009670
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x10
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1023376
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100967c
jmp 0x1023bb1
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
push 0x1008ef8
push 0x1009660
push 0x1008ee4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x10233de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1009660
jmp 0x1023bb1
and dword [ebp - 0x3034], 0
lea eax, [ebp - 0x3034]
push eax
mov esi, 0x1009640
push esi
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022391
test eax, eax
jne 0x102340d
and dword [ebp - 0x3034], eax
cmp dword [0x102c8d0], 0
jne 0x102341f
or dword [ebp - 0x3034], 1
jmp 0x1023426
or dword [ebp - 0x3034], 8
push dword [ebp - 0x3034]
lea eax, [ebp - 0x20c]
push 0x1008ef8
push esi
push 0x1008ee4
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1023486
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1009640
jmp 0x1023bb1
lea eax, [ebp - 0x3034]
push eax
mov esi, 0x1009630
push esi
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022391
test eax, eax
jne 0x10234ae
and dword [ebp - 0x3034], eax
cmp dword [0x102c8d0], 0
je 0x10234be
or dword [ebp - 0x3034], 1
push dword [ebp - 0x3034]
lea eax, [ebp - 0x20c]
push 0x1008ef8
push esi
push 0x1008ee4
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x102351e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1009630
jmp 0x1023bb1
push 0
push dword [ebp - 0x3028]
push 0x1009614
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.0102219b
push 0
push dword [ebp - 0x3028]
push 0x1009600
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.0102219b
push dword [ebp - 0x3028]
push 0xf300
push 0x10095e0
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x102358c
push 0x10095e0
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf301
push 0x10095c4
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x10235be
push 0x10095c4
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf302
push 0x10095a4
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x10235f0
push 0x10095a4
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf303
push 0x1009584
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x1023622
push 0x1009584
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf304
push 0x1009564
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x1023654
push 0x1009564
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf305
push 0x1009548
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x1023686
push 0x1009548
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf306
push 0x1009524
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x10236b8
push 0x1009524
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf307
push 0x1009504
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x10236ea
push 0x1009504
jmp 0x1023992
push 0
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 0x10094f0
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
push 0
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
test eax, eax
jne 0x1023725
push dword [ebp - 0x302c]
push 0x10094d0
jmp 0x1023997
lea eax, [ebp - 0x20c]
push eax
push 0x1008ef8
push 0x10094f0
push 0x1008f1c
lea eax, [ebp - 0xc14]
push 0x103
push eax
call sub.ntdll.dll__snwprintf
and word [ebp - 0xa0e], 0
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0xc14]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0xc14]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
je 0x1023475
push dword [ebp - 0x3028]
push 0xf309
push 0x10094c8
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x10237b7
push 0x10094c8
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf30a
push 0x10094c0
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x10237e9
push 0x10094c0
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf30b
push 0x10094b8
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x102381b
push 0x10094b8
jmp 0x1023992
and word [ebp - 0xc14], 0
push 0x1009484
push dword [ebp - 0x302c]
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
mov esi, 0x100947c
jne 0x1023861
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x102384d
mov eax, 0x42b
push 0x10
lea ecx, [ebp - 0xc14]
push ecx
push eax
call sub.msvcrt.dll__itow
add esp, 0xc
jmp 0x102388f
push 0
push 0x103
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
push 0
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
test eax, eax
jne 0x102388f
and word [ebp - 0xc14], ax
cmp word [ebp - 0xc14], 0
je 0x10238a2
lea eax, [ebp - 0x20c]
push eax
jmp 0x10238a7
push 0x1009470
push 0x1008ef8
push esi
push 0x1008f1c
lea eax, [ebp - 0xc14]
push 0x103
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0xc14]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0xc14]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
je 0x1023475
push dword [ebp - 0x3028]
push 0xf30c
push 0x1009448
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
push dword [ebp - 0x3028]
push 0xf30d
push 0x1009424
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
push dword [ebp - 0x3028]
push 0xf30e
push 0x10093fc
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x1023965
push 0x10093fc
jmp 0x1023992
push dword [ebp - 0x3028]
push 0xf30f
push 0x10093d8
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01022260
mov esi, eax
cmp esi, 1
je 0x10239a2
push 0x10093d8
push 0x10093c0
call fcn.01015c5a
pop ecx
jmp 0x1023c9b
xor esi, esi
push esi
push esi
push 0x104
lea eax, [ebp - 0xd18]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x302c]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1023c9c
lea eax, [ebp - 0x3034]
push eax
push 0x400
lea eax, [ebp - 0x3024]
push eax
lea eax, [ebp - 0xc14]
push eax
mov word [ebp - 0xc14], si
mov word [ebp - 0x3024], si
mov word [ebp - 0x2824], si
mov word [ebp - 0x2024], si
call fcn.010225ba
test eax, eax
je 0x1023bc5
push dword [ebp - 0x3034]
lea eax, [ebp - 0x2024]
push 0x400
push eax
lea eax, [ebp - 0x2824]
push eax
lea eax, [ebp - 0xd18]
push eax
push dword [ebp - 0x3030]
call fcn.0102271b
test eax, eax
je 0x1023afa
lea eax, [ebp - 0x2824]
push eax
push 0x10091cc
lea eax, [ebp - 0xc14]
push eax
push 0x1008ef8
push 0x10093a8
push 0x100938c
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x20
push esi
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x161c]
push eax
mov word [ebp - 0xe1e], si
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x161c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1023ab7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10093a8
jmp 0x1023bb1
lea eax, [ebp - 0x2024]
push eax
push 0x10091cc
lea eax, [ebp - 0x3024]
push eax
push 0x1008ef8
push 0x1009370
push 0x100938c
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x20
and word [ebp - 0xe1e], 0
jmp 0x1023b7b
lea eax, [ebp - 0xc14]
push eax
push 0x1008ef8
push 0x10093a8
push 0x1008f1c
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push esi
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x161c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x161c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
je 0x1023aa6
lea eax, [ebp - 0x3024]
push eax
push 0x1008ef8
push 0x1009370
push 0x1008f1c
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.ntdll.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x161c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x161c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1023bc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1009370
push 0x1009348
call fcn.01015c5a
add esp, 0xc
jmp 0x1023c9c
xor esi, esi
cmp dword [ebp - 0x3028], 0xffffffff
je 0x1023be1
push dword [ebp - 0x3028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x3028], 0xffffffff
xor eax, eax
push 0x11
mov ecx, 0x200
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x308c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x3048]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x414]
push eax
push 0x1009338
lea eax, [ebp - 0xc14]
push 0x103
push eax
mov dword [ebp - 0x308c], 0x44
call sub.ntdll.dll__snwprintf
add esp, 0x10
lea eax, [ebp - 0x3048]
push eax
lea eax, [ebp - 0x308c]
push eax
push esi
push esi
push 0x4000000
push 1
push esi
push esi
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0x1824]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, 1
jne 0x1023c91
cmp dword [0x102c8d0], eax
jne 0x1023c79
push 0xffffffffffffffff
push dword [ebp - 0x3048]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x3044]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x3048]
call edi
jmp 0x1023c9c
push 0x100930c
call fcn.01015c5a
pop ecx
cmp dword [ebp - 0x3028], 0xffffffff
je 0x1023cb1
push dword [ebp - 0x3028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp esi, ebx
jne 0x1023ccd
cmp word [ebp - 0x414], bx
je 0x1023ccd
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.0101439a
leave
ret 8