Function at 0x100888e7
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Delete file

Disassembly:
mov eax, 0x100deb75
call fcn.100ac440
sub esp, 0x328
mov eax, dword [0x1011c710]
push ebx
push esi
push edi
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2b8], ecx
push 0x40
xor eax, eax
xor esi, esi
mov word [ebp - 0x114], si
pop ecx
lea edi, [ebp - 0x112]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x114]
push eax
call fcn.1006d2be
pop ecx
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x2b4]
push str._sdns.txt
push eax
mov dword [ebp - 4], esi
call fcn.10001d75
add esp, 0xc
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x2bc], eax
lea eax, [ebp - 0x218]
push str.nslookup_pps.tv
push eax
mov byte [ebp - 4], 1
call fcn.100acf5b
pop ecx
pop ecx
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0x2a8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2ac]
push eax
mov dword [ebp - 0x2f0], 0xc
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], 1
xor ebx, ebx
mov dword [ebp - 0x2b0], 3
mov dword [ebp - 0x2ac], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x100889f5
cmp dword [ebp - 0x29c], 2
jne 0x100889f5
lea ebx, [ebp - 0x2f0]
mov dword [ebp - 0x2b0], 7
push esi
push 0x80
push 4
push ebx
push dword [ebp - 0x2b0]
push 0x40000000
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x44
pop edi
push edi
mov ebx, eax
lea eax, [ebp - 0x334]
push esi
push eax
call fcn.100ab720
mov dword [ebp - 0x334], edi
xor eax, eax
mov dword [ebp - 0x2e4], esi
lea edi, [ebp - 0x2e0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x334]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x218]
push eax
push esi
mov dword [ebp - 0x308], 0x101
mov word [ebp - 0x304], si
mov dword [ebp - 0x2f8], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10088aa4
push 0xffffffffffffffff
push dword [ebp - 0x2e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2e4]
call edi
push dword [ebp - 0x2e0]
call edi
push ebx
call edi
push esi
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x2d4]
call fcn.100c7737
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 2
call fcn.100c7166
inc eax
push eax
call fcn.100c6c30
pop ecx
mov edi, eax
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2c4], edi
call fcn.100c7166
inc eax
push eax
push esi
push edi
call fcn.100ab720
add esp, 0xc
lea ecx, [ebp - 0x2d4]
call fcn.100c7166
inc eax
push eax
push edi
lea ecx, [ebp - 0x2d4]
call fcn.100c6f81
lea ecx, [ebp - 0x2d4]
call fcn.100c7211
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp edi, esi
je 0x10088bde
push edi
lea ecx, [ebp - 0x2b0]
call fcn.1000223a
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 3
call fcn.10008cce
push esi
push str.address
lea ecx, [ebp - 0x2b0]
call fcn.10003f61
mov ebx, eax
cmp ebx, 0xffffffff
jle 0x10088bc0
push ebx
push 0x100e3330
lea ecx, [ebp - 0x2b0]
call fcn.10003f61
mov esi, eax
cmp esi, 0xffffffff
jle 0x10088bc0
mov edi, str.address:
push edi
call fcn.100ab7d0
pop ecx
sub esi, ebx
sub esi, eax
push esi
push edi
call fcn.100ab7d0
pop ecx
add eax, ebx
push eax
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2b0]
call fcn.10003ff3
mov ecx, dword [ebp - 0x2b8]
add ecx, 0x74
push eax
mov byte [ebp - 4], 4
call fcn.10001eb6
mov ecx, dword [ebp - 0x2c0]
add ecx, 0xfffffff0
call fcn.10001199
push dword [ebp - 0x2c4]
call fcn.100c6c35
pop ecx
mov ecx, dword [ebp - 0x2b0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.10001199
mov esi, dword [ebp - 0x2b8]
add esi, 0x74
mov ecx, esi
call fcn.100043b6
mov ecx, esi
call fcn.1000436c
lea ecx, [ebp - 0x2d4]
mov byte [ebp - 4], 1
call fcn.100c72b2
mov ecx, dword [ebp - 0x2bc]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x2b4]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret