Function at 0x13146160
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x10c
push 0
push 0
dec ecx
jne 0x13146168
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x5d8]
mov ecx, 0x173
rep movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x800]
xor eax, eax
push ebp
push 0x1314662d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.131460d4
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.13143c40
je 0x131461c7
mov eax, dword [ebp - 4]
call fcn.13143b28
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.13143b18
mov ecx, 0x13146640
pop edx
call fcn.13144dfc
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.13143c40
je 0x131465c2
jmp 0x131465b2
lea eax, [ebp - 0xc]
call fcn.131439d0
lea eax, [ebp - 8]
call fcn.131439d0
mov eax, ebx
mov edx, 0x228
call fcn.13145d2c
mov eax, dword [ebp - 4]
call fcn.13143b18
mov edx, eax
mov eax, ebx
mov ecx, 0x228
call fcn.13144cc8
lea eax, [ebp - 4]
mov ecx, 0x228
mov edx, 1
call fcn.13143d10
lea eax, [ebp - 0xc]
push eax
push 0
push 2
mov eax, dword [ebx + 0x210]
mov edx, dword [ebx + 0x214]
call fcn.131441bc
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.13143cc4
push 0
push 2
mov eax, dword [ebx + 0x210]
mov edx, dword [ebx + 0x214]
call fcn.131441bc
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.13143d10
cmp byte [ebx + 0x220], 0
jne 0x1314636d
push 0
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x808]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x808]
push eax
lea eax, [ebp - 0x814]
lea edx, [ebp - 0x304]
mov ecx, 0xb
call fcn.13143718
mov ecx, dword [ebp - 0x814]
lea eax, [ebp - 0x810]
mov edx, 0x13146658
call fcn.13143794
mov edx, dword [ebp - 0x810]
lea eax, [ebp - 0x80c]
call fcn.13143b08
mov edx, dword [ebp - 0x80c]
mov eax, 0x80000001
pop ecx
call fcn.13145100
mov eax, dword [ebp - 0x804]
mov edx, 0x13146668
call fcn.13143c40
je 0x131465b2
push 0x13146668
push 2
lea eax, [ebp - 0x818]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x818]
push eax
lea eax, [ebp - 0x824]
lea edx, [ebp - 0x304]
mov ecx, 0xb
call fcn.13143718
mov ecx, dword [ebp - 0x824]
lea eax, [ebp - 0x820]
mov edx, 0x13146658
call fcn.13143794
mov edx, dword [ebp - 0x820]
lea eax, [ebp - 0x81c]
call fcn.13143b08
mov edx, dword [ebp - 0x81c]
mov eax, 0x80000001
pop ecx
call fcn.131451fc
mov eax, dword [ebx + 0x218]
test eax, eax
jne 0x131463af
lea eax, [ebp - 0x828]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
call fcn.131452e4
mov edx, dword [ebp - 0x82c]
lea eax, [ebp - 8]
pop ecx
call fcn.13143b94
jmp 0x131464bd
cmp eax, 1
jne 0x131463ec
lea eax, [ebp - 0x830]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x830]
push eax
lea eax, [ebp - 0x834]
call fcn.1314536c
mov edx, dword [ebp - 0x834]
lea eax, [ebp - 8]
pop ecx
call fcn.13143b94
jmp 0x131464bd
cmp eax, 2
jne 0x13146429
lea eax, [ebp - 0x838]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x838]
push eax
lea eax, [ebp - 0x83c]
call fcn.131453f4
mov edx, dword [ebp - 0x83c]
lea eax, [ebp - 8]
pop ecx
call fcn.13143b94
jmp 0x131464bd
cmp eax, 3
jne 0x13146463
lea eax, [ebp - 0x840]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
mov eax, dword [ebp - 0x840]
push eax
lea eax, [ebp - 0x844]
call fcn.131452b8
mov edx, dword [ebp - 0x844]
lea eax, [ebp - 8]
pop ecx
call fcn.13143b94
jmp 0x131464bd
cmp eax, 4
jne 0x131464bd
lea eax, [ebp - 0x848]
call fcn.131454d0
mov eax, dword [ebp - 0x848]
xor edx, edx
call fcn.13143c40
je 0x131464bd
lea eax, [ebp - 0x84c]
call fcn.131454d0
push dword [ebp - 0x84c]
push 0x13146674
lea eax, [ebp - 0x850]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
push dword [ebp - 0x850]
lea eax, [ebp - 8]
mov edx, 3
call fcn.13143bf8
push 0
push 4
lea eax, [ebp - 0x854]
mov ecx, 0x1314667c
mov edx, dword [ebp - 8]
call fcn.13143b94
mov eax, dword [ebp - 0x854]
call fcn.13143b18
mov edx, 0x13146688
call fcn.13145640
test al, al
jne 0x1314652a
lea eax, [ebp - 0x858]
call fcn.131452b8
push dword [ebp - 0x858]
push 0x13146674
lea eax, [ebp - 0x85c]
mov edx, ebx
mov ecx, 0x105
call fcn.13143aec
push dword [ebp - 0x85c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.13143bf8
jmp 0x1314654e
lea eax, [ebp - 0x860]
mov ecx, 0x13146694
mov edx, dword [ebp - 8]
call fcn.13143b94
mov eax, dword [ebp - 0x860]
call fcn.13143b18
push eax
call sub.KERNEL32.DLL_DeleteFileW
mov eax, dword [ebp - 0xc]
call fcn.13143b28
add eax, eax
cdq
push edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.13143b18
push eax
mov eax, dword [ebp - 8]
call fcn.13143b18
mov esi, eax
mov eax, esi
pop edx
call fcn.13145640
mov eax, dword [ebx + 0x21c]
cmp eax, 2
je 0x131465b2
cmp eax, 1
jne 0x1314659b
push 0
push 0
push 0
push esi
push 0x131466a0
push 0
call sub.shell32.dll_ShellExecuteW_1
jmp 0x131465b2
test eax, eax
jne 0x131465b2
push 1
push 0
push 0
push esi
push 0x131466a0
push 0
call sub.shell32.dll_ShellExecuteW_1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.13143c40
jne 0x131461dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13146634
lea eax, [ebp - 0x860]
mov edx, 0xf
call fcn.131439e8
lea eax, [ebp - 0x824]
mov edx, 2
call fcn.13143568
lea eax, [ebp - 0x81c]
mov edx, 2
call fcn.131439e8
lea eax, [ebp - 0x814]
mov edx, 2
call fcn.13143568
lea eax, [ebp - 0x80c]
mov edx, 3
call fcn.131439e8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.131439e8
ret