Function at 0x100f6052
Capabilities:
Create process on windows
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x78], eax
lea edi, [ebp - 0x64]
xor eax, eax
mov dword [ebp - 0x74], ecx
stosd dword es:[edi], eax
xor ecx, ecx
mov esi, edx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], ecx
mov ebx, ecx
mov dword [ebp - 0xc], ecx
mov edx, 0x10039c60
stosd dword es:[edi], eax
mov ecx, esi
mov dword [ebp - 0x68], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x70]
push eax
call fcn.100eb869
mov edi, dword [ebp - 0x70]
mov esi, eax
test esi, esi
jns 0x100f60be
push 0x10039c68
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100f6292
push edi
push dword [ebp - 0x68]
lea eax, [ebp - 0x6c]
push dword [ebp - 0x74]
push 0x10039ca0
push eax
call fcn.100a6b40
mov esi, eax
add esp, 0x14
test esi, esi
jns 0x100f60e3
push 0x10039cb8
jmp 0x100f60a9
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
xor eax, eax
push eax
push eax
push 0x8004000
push eax
push eax
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x74]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x100f6146
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100f6135
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100f613c
mov esi, 0x80004005
push 0x10039ce4
jmp 0x100f60a9
push 0xffffffffffffffff
push dword [ebp - 0x64]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100f6180
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100f616f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100f6176
mov esi, 0x80004005
push 0x10039d14
jmp 0x100f624c
mov ecx, edi
call fcn.100b7fb2
test eax, eax
je 0x100f6221
push edi
push 0x10039d3c
xor ebx, ebx
push ebx
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x14
push ebx
push 0x80
push 3
push ebx
push 1
push 0x40000000
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100f61cc
push edi
push 0x10039d58
jmp 0x100f61ea
mov ecx, dword [ebp - 0x78]
lea eax, [ecx + 0x14]
push eax
push 0
lea eax, [ecx + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileTime]
test eax, eax
jne 0x100f61fb
push edi
push 0x10039d90
push 0
push 0
push 0x4000000
call fcn.100ab973
add esp, 0x14
push dword [ebp - 0x68]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x100f625c
push dword [ebp - 0x68]
push 0x10039db8
push eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100f625c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov esi, dword [ebp - 0xc]
test esi, esi
jle 0x100f6240
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100f6247
mov esi, 0x80004005
push 0x10039dec
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x100f626f
cmp eax, 0xffffffff
je 0x100f626f
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x100f6282
cmp eax, 0xffffffff
je 0x100f6282
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
je 0x100f6292
cmp ebx, 0xffffffff
je 0x100f6292
push ebx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test edi, edi
je 0x100f62a0
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x100f62b1
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 4