Function at 0x10008ea4
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [ebx + 0xdfc]
call fcn.10006971
nop
nop
lea esi, [ebx + 0x1450]
push 0x1001aa8c
push esi
call fcn.10012380
pop ecx
test eax, eax
pop ecx
je 0x10008f66
push 0x1001c1a0
push esi
call fcn.10012380
pop ecx
test eax, eax
pop ecx
je 0x10008f66
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
nop
cmp esi, dword [edi + 8]
je 0x10008f3d
lea eax, [esi + 0x400]
mov dword [ebp - 4], eax
lea eax, [ebx + 0x1450]
push eax
mov eax, dword [ebp - 4]
add eax, 0x40
push eax
call fcn.10012380
pop ecx
test eax, eax
pop ecx
jne 0x10008f2e
lea eax, [ebx + 0x1870]
push eax
push dword [ebp - 4]
call fcn.10012380
pop ecx
test eax, eax
pop ecx
je 0x10008f4d
mov eax, 0x680
add dword [ebp - 4], eax
add esi, eax
cmp esi, dword [edi + 8]
jne 0x10008f00
lea eax, [ebx + 0x18b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
jmp 0x10008f69
lea eax, [ebx + 0x18b0]
add esi, 0x460
push eax
push esi
call fcn.1000abd0
pop ecx
pop ecx
nop
nop
jmp 0x10008f69
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov esi, dword [edi + 4]
nop
cmp esi, dword [edi + 8]
je 0x100091e9
cmp dword [esi + 0x660], 0
je 0x10008f94
mov ecx, ebx
call fcn.10008268
test eax, eax
je 0x100091d9
cmp dword [esi + 0x678], 0
jne 0x10008fb6
push dword [esi + 0x670]
push dword [esi + 0x66c]
call fcn.10003bd3
pop ecx
mov dword [esi + 0x678], eax
pop ecx
push 0
call fcn.1000b086
cmp eax, dword [esi + 0x678]
pop ecx
jl 0x100091d9
mov eax, dword [esi + 0x674]
cmp eax, dword [esi + 0x668]
jge 0x100091d9
cmp dword [esi + 0x67c], 0
jne 0x100091d9
lea eax, [esi + 0x460]
push eax
call fcn.1000a990
test eax, eax
pop ecx
jne 0x10009046
mov al, byte [0x1001c1a0]
push 0x40
mov byte [ebp - 0x108], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
push 1
lea eax, [esi + 0x460]
push esi
push eax
lea eax, [ebp - 0x108]
push 0x1001abc0
push eax
call fcn.10003abf
add esp, 0x14
lea eax, [esi + 0x440]
push eax
lea eax, [ebx + 0x1450]
push eax
call fcn.1000abd0
nop
lea eax, [ebx + 0x1470]
push esi
push eax
call fcn.1000abd0
lea edi, [esi + 0x400]
lea eax, [ebx + 0x1870]
push edi
push eax
call fcn.1000abd0
lea eax, [esi + 0x460]
lea ecx, [ebx + 0x18b0]
push eax
push ecx
call fcn.1000abd0
add esp, 0x20
lea ecx, [ebx + 0xdfc]
call fcn.10006b78
push 1
lea eax, [esi + 0x460]
push edi
push eax
lea ecx, [ebx + 0xdf8]
push esi
call fcn.10002607
cmp eax, 1
mov dword [ebp - 4], eax
je 0x100090fb
lea eax, [ebx + 0x1450]
push 0x1001aa8c
push eax
call fcn.1000abd0
mov edi, str.null
lea eax, [ebx + 0x1470]
push edi
push eax
call fcn.1000abd0
nop
lea eax, [ebx + 0x1870]
push edi
push eax
call fcn.1000abd0
nop
lea eax, [ebx + 0x18b0]
push edi
push eax
call fcn.1000abd0
add esp, 0x20
lea edi, [ebx + 0xdfc]
mov ecx, edi
call fcn.10006b78
nop
xor ecx, ecx
cmp dword [ebp - 4], ecx
jne 0x10009184
cmp dword [esi + 0x664], ecx
je 0x10009129
lea eax, [esi + 0x460]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10009146
lea eax, [esi + 0x460]
push ecx
push eax
mov ecx, ebx
call fcn.10008297
nop
lea eax, [esi + 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0x440]
mov ecx, edi
push eax
call fcn.1000674a
push eax
mov ecx, edi
call fcn.10006744
push eax
mov ecx, edi
call fcn.10006606
push eax
mov ecx, edi
call fcn.10006620
push eax
lea ecx, [ebx + 0xdf8]
call fcn.100021e2
mov dword [esi + 0x67c], 1
jmp 0x100091d6
mov eax, dword [esi + 0x674]
cmp eax, 4
jbe 0x10009192
push 4
pop eax
mov edi, dword [eax*4 + 0x1001ab90]
push ecx
call fcn.1000b086
add eax, edi
mov dword [esi + 0x678], eax
nop
inc dword [esi + 0x674]
nop
lea edi, [esi + 0x460]
push edi
call fcn.10003c26
pop ecx
test eax, eax
pop ecx
je 0x100091c7
cmp dword [ebp - 4], 5
jne 0x100091ce
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
cmp dword [ebp - 4], eax
je 0x100091e4
mov edi, dword [ebp + 8]
add esi, 0x680
jmp 0x10008f73
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 8