Function at 0x100663a
Capabilities:
Create process on windows
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7b4
mov eax, dword [0x1014b48]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x40c]
push eax
push 0x41d
mov dword [ebp - 0x750], edi
call fcn.01002c92
lea eax, [ebp - 0x40c]
push eax
push 0x856
push edi
call fcn.0100321c
push edi
call fcn.01005e7f
test eax, eax
je 0x1006978
push 0x10016ec
push dword [0x1017118]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
lea eax, [ebp - 0x20c]
jne 0x10066af
push 0x1001a04
jmp 0x10066b4
push 0x10019f8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0100366f
test eax, eax
jne 0x10066f7
xor esi, esi
push esi
push 0x10
push esi
lea eax, [ebp - 0x108]
push eax
push 0x46d
push edi
call fcn.0100373a
xor eax, eax
jmp 0x1006977
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
mov edi, 0x10160a8
push edi
call esi
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebx + eax + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor esi, esi
cmp ebx, esi
jne 0x1006742
push esi
push 0x10
push esi
push esi
push 0x44c
push dword [ebp - 0x750]
call fcn.0100373a
xor eax, eax
jmp 0x1006976
push edi
lea eax, [ebp - 0x108]
push eax
push 0x10019ec
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x11
xor eax, eax
cmp word [0x10156f8], si
pop ecx
lea edi, [ebp - 0x7b4]
rep stosd dword es:[edi], eax
mov ax, word [0x10156f0]
mov dword [ebp - 0x7b4], 0x44
je 0x100678a
mov word [ebp - 0x784], 6
jmp 0x100679f
cmp ax, si
jne 0x1006798
cmp word [0x10156f4], si
je 0x10067ae
mov word [ebp - 0x784], si
cmp ax, si
mov dword [ebp - 0x788], 1
jne 0x10067b2
xor eax, eax
jmp 0x10067b7
mov eax, 0x8000000
lea ecx, [ebp - 0x768]
push ecx
lea ecx, [ebp - 0x7b4]
push ecx
push esi
push esi
push eax
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100680d
push dword [ebp - 0x764]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x768]
call fcn.01002ad2
lea eax, [ebp - 0x770]
push eax
push dword [ebp - 0x768]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x768]
call edi
jmp 0x1006849
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0x200
lea ecx, [ebp - 0x60c]
push ecx
push esi
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push esi
push 0x10
lea eax, [ebp - 0x60c]
push eax
push ebx
push 0x46c
push dword [ebp - 0x750]
call fcn.0100373a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10019e4
push 0x856
push dword [ebp - 0x750]
call fcn.0100321c
lea eax, [ebp - 0x74c]
push eax
mov ebx, 0x10163b4
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [ebp - 0x72c]
sub edi, dword [ebp - 0x730]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x758], eax
jne 0x10068b7
push esi
push 0x10
push esi
push ebx
push 0x466
jmp 0x1006730
lea eax, [edi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp - 0x754], eax
push esi
je 0x1006727
lea ecx, [ebp - 0x76c]
push ecx
push edi
push eax
push dword [ebp - 0x758]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10068fa
push esi
push 0x10
push esi
push ebx
push 0x467
jmp 0x1006730
push dword [ebp - 0x758]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x754]
mov edi, 0x856
push edi
push dword [ebp - 0x750]
call fcn.0100321c
push dword [ebp - 0x754]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10019e4
push edi
push dword [ebp - 0x750]
call fcn.0100321c
push 0x1017700
push esi
push 0x10019d8
push 0x1001454
call fcn.01002d7f
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
jne 0x1006960
push 0x10160a8
call esi
test byte [0x101712e], 1
jne 0x1006970
push 0x10162b0
call esi
push ebx
call esi
xor eax, eax
inc eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.0100c759
leave
ret 4