Function at 0x1000b9c8
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2c5
push 0
push 0
dec ecx
jne 0x1000b9d0
push ecx
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x13a0]
mov ecx, 0x4e4
rep movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x15c8]
xor eax, eax
push ebp
push 0x1000be99
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.1000b93c
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.10003a34
je 0x1000ba33
lea ecx, [ebp - 0x15cc]
mov edx, 0x1000beac
mov eax, dword [ebp - 4]
call fcn.10006404
mov edx, dword [ebp - 0x15cc]
lea eax, [ebp - 4]
call fcn.100037d0
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.10003a34
je 0x1000be2e
jmp 0x1000be1e
lea eax, [ebp - 0xc]
call fcn.10003770
lea eax, [ebp - 8]
call fcn.10003770
mov eax, ebx
mov edx, 0x228
call fcn.100050d8
mov eax, dword [ebp - 4]
call fcn.1000390c
mov edx, eax
mov eax, ebx
mov ecx, 0x228
call fcn.100050d0
lea eax, [ebp - 4]
mov ecx, 0x228
mov edx, 1
call fcn.10003b04
lea eax, [ebp - 0xc]
push eax
push 0
push 2
mov eax, dword [ebx + 0x210]
mov edx, dword [ebx + 0x214]
call fcn.10003fd4
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.10003ab8
push 0
push 2
mov eax, dword [ebx + 0x210]
mov edx, dword [ebx + 0x214]
call fcn.10003fd4
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.10003b04
cmp byte [ebx + 0x220], 0
jne 0x1000bbd9
push 0
lea eax, [ebp - 0x15d0]
push eax
lea eax, [ebp - 0x15d4]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x15d4]
push eax
lea eax, [ebp - 0x15e0]
lea edx, [ebp - 0x3f6]
mov ecx, 0x3d
call fcn.100034b0
mov ecx, dword [ebp - 0x15e0]
lea eax, [ebp - 0x15dc]
mov edx, 0x1000bec4
call fcn.1000352c
mov edx, dword [ebp - 0x15dc]
lea eax, [ebp - 0x15d8]
call fcn.100038fc
mov edx, dword [ebp - 0x15d8]
mov eax, 0x80000001
pop ecx
call fcn.1000553c
mov eax, dword [ebp - 0x15d0]
mov edx, 0x1000bed4
call fcn.10003a34
je 0x1000be1e
push 0x1000bed4
push 2
lea eax, [ebp - 0x15e4]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x15e4]
push eax
lea eax, [ebp - 0x15f0]
lea edx, [ebp - 0x3f6]
mov ecx, 0x3d
call fcn.100034b0
mov ecx, dword [ebp - 0x15f0]
lea eax, [ebp - 0x15ec]
mov edx, 0x1000bec4
call fcn.1000352c
mov edx, dword [ebp - 0x15ec]
lea eax, [ebp - 0x15e8]
call fcn.100038fc
mov edx, dword [ebp - 0x15e8]
mov eax, 0x80000001
pop ecx
call fcn.1000577c
mov eax, dword [ebx + 0x218]
test eax, eax
jne 0x1000bc1b
lea eax, [ebp - 0x15f4]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x15f4]
push eax
lea eax, [ebp - 0x15f8]
call fcn.10005350
mov edx, dword [ebp - 0x15f8]
lea eax, [ebp - 8]
pop ecx
call fcn.10003988
jmp 0x1000bd29
cmp eax, 1
jne 0x1000bc58
lea eax, [ebp - 0x15fc]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x15fc]
push eax
lea eax, [ebp - 0x1600]
call fcn.100053d8
mov edx, dword [ebp - 0x1600]
lea eax, [ebp - 8]
pop ecx
call fcn.10003988
jmp 0x1000bd29
cmp eax, 2
jne 0x1000bc95
lea eax, [ebp - 0x1604]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x1604]
push eax
lea eax, [ebp - 0x1608]
call fcn.10005460
mov edx, dword [ebp - 0x1608]
lea eax, [ebp - 8]
pop ecx
call fcn.10003988
jmp 0x1000bd29
cmp eax, 3
jne 0x1000bccf
lea eax, [ebp - 0x160c]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
mov eax, dword [ebp - 0x160c]
push eax
lea eax, [ebp - 0x1610]
call fcn.10005324
mov edx, dword [ebp - 0x1610]
lea eax, [ebp - 8]
pop ecx
call fcn.10003988
jmp 0x1000bd29
cmp eax, 4
jne 0x1000bd29
lea eax, [ebp - 0x1614]
call fcn.10005638
mov eax, dword [ebp - 0x1614]
xor edx, edx
call fcn.10003a34
je 0x1000bd29
lea eax, [ebp - 0x1618]
call fcn.10005638
push dword [ebp - 0x1618]
push 0x1000bee0
lea eax, [ebp - 0x161c]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x161c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.100039ec
push 0
push 4
lea eax, [ebp - 0x1620]
mov ecx, 0x1000bee8
mov edx, dword [ebp - 8]
call fcn.10003988
mov eax, dword [ebp - 0x1620]
call fcn.1000390c
mov edx, 0x1000bef4
call fcn.10005eb4
test al, al
jne 0x1000bd96
lea eax, [ebp - 0x1624]
call fcn.10005324
push dword [ebp - 0x1624]
push 0x1000bee0
lea eax, [ebp - 0x1628]
mov edx, ebx
mov ecx, 0x105
call fcn.100038e0
push dword [ebp - 0x1628]
lea eax, [ebp - 8]
mov edx, 3
call fcn.100039ec
jmp 0x1000bdba
lea eax, [ebp - 0x162c]
mov ecx, 0x1000bf00
mov edx, dword [ebp - 8]
call fcn.10003988
mov eax, dword [ebp - 0x162c]
call fcn.1000390c
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [ebp - 0xc]
call fcn.1000391c
add eax, eax
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.1000390c
push eax
mov eax, dword [ebp - 8]
call fcn.1000390c
mov esi, eax
mov eax, esi
pop edx
call fcn.10005eb4
mov eax, dword [ebx + 0x21c]
cmp eax, 2
je 0x1000be1e
cmp eax, 1
jne 0x1000be07
push 0
push 0
push 0
push esi
push 0x1000bf0c
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x1000be1e
test eax, eax
jne 0x1000be1e
push 1
push 0
push 0
push esi
push 0x1000bf0c
push 0
call sub.shell32.dll_ShellExecuteW
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.10003a34
jne 0x1000ba48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000bea0
lea eax, [ebp - 0x162c]
mov edx, 0xf
call fcn.10003788
lea eax, [ebp - 0x15f0]
mov edx, 2
call fcn.100032f0
lea eax, [ebp - 0x15e8]
mov edx, 2
call fcn.10003788
lea eax, [ebp - 0x15e0]
mov edx, 2
call fcn.100032f0
lea eax, [ebp - 0x15d8]
mov edx, 4
call fcn.10003788
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.10003788
ret