Function at 0x2e0083d3
Capabilities:
Create process on windows
Get system information on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x2e022064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x2e001bf0
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
cmp eax, edi
jne 0x2e00843a
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e008434
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e00868e
push 0x2e001bd4
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x2e008476
push 0x800
call eax
test eax, eax
jne 0x2e008476
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e008470
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e00868e
call fcn.2e01f43d
mov esi, eax
cmp esi, edi
jl 0x2e00868e
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x250]
mov dword [0x2e022ee4], eax
mov eax, 0x10000
mov dword [0x2e022ef0], eax
mov dword [0x2e022ef8], eax
mov dword [0x2e022f00], eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
xor ecx, ecx
inc ecx
lea eax, [ebp - 0x218]
push eax
mov dword [0x2e022ee8], 0x3c
mov dword [0x2e022eec], ecx
mov dword [0x2e022ef4], ecx
mov dword [0x2e022efc], ecx
mov dword [0x2e022f04], ecx
call 0x2e007c30
mov esi, eax
cmp esi, edi
jl 0x2e00868e
cmp esi, 1
je 0x2e00868c
cmp dword [ebp - 0x21c], edi
je 0x2e008520
push edi
push edi
call fcn.2e007ffa
mov esi, eax
jmp 0x2e00868e
cmp dword [ebp - 0x220], edi
je 0x2e008642
push 0x44
pop esi
push esi
lea eax, [ebp - 0x298]
push edi
push eax
call fcn.2e01440c
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
mov dword [ebp - 0x298], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x2e008579
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e008573
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e00868e
push edi
lea eax, [ebp - 0x210]
push eax
push 0x2e001bcc
push 0x2e001994
call fcn.2e01174d
mov esi, eax
cmp esi, edi
jl 0x2e00868e
push edi
push 1
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.2e01151e
mov esi, eax
cmp esi, edi
jl 0x2e00868e
push 4
push edi
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push dword [ebp - 0x210]
lea eax, [ebp - 0x214]
push 0x2e001ba8
push eax
call fcn.2e01103c
mov esi, eax
add esp, 0xc
cmp esi, edi
jl 0x2e00868e
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x298]
push eax
push edi
push edi
push 0x20
push edi
push edi
push edi
push dword [ebp - 0x214]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x2e00862a
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e008628
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e00868e
push dword [ebp - 0x22c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x230]
call ebx
jmp 0x2e00868e
mov eax, dword [0x2e022050]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x22c], 0x2e00f7e7
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], edi
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x2e00868c
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e00868a
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e00868e
xor esi, esi
cmp dword [0x2e022f10], edi
je 0x2e00869d
push 1
call fcn.2e0136aa
cmp dword [ebp - 0x214], edi
je 0x2e0086b0
push dword [ebp - 0x214]
call fcn.2e010d00
cmp dword [ebp - 0x210], edi
je 0x2e0086c3
push dword [ebp - 0x210]
call fcn.2e010d00
call fcn.2e01f440
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e0142db
leave
ret 0x10