Function at 0x10862bc
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x308c
call fcn.0106bfb4
mov eax, dword [0x1099a38]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
lea edx, [ebp - 0x3034]
push edx
push 0x102b2fc
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x3030], eax
mov dword [ebp - 0x302c], ecx
xor esi, esi
mov word [ebp - 0x414], bx
call fcn.010854a2
test eax, eax
jne 0x108630f
inc esi
jmp 0x1086dbb
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0xe1c]
push eax
call fcn.01085502
test eax, eax
je 0x1086da4
push edi
lea eax, [ebp - 0x1824]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xe1c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01085567
test eax, eax
je 0x1086da4
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x3028], eax
jne 0x1086392
lea eax, [ebp - 0x414]
push eax
push 0x102b2d8
call fcn.01071ac0
pop ecx
pop ecx
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0x3038]
push eax
push 2
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
mov word [ebp - 0x20c], 0xfeff
call edi
mov esi, eax
cmp esi, ebx
jne 0x10863d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102b2bc
jmp 0x1086c9e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x3038]
push eax
mov esi, 0x102b2b4
push esi
call ebx
shl eax, 1
push eax
push esi
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x108640a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102b2a0
jmp 0x1086c9e
push 0x102b280
push 0x102b274
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1086463
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102b280
jmp 0x1086c9e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
push 0x102ab3c
push 0x102b264
push 0x102ab28
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x10864cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102b264
jmp 0x1086c9e
and dword [ebp - 0x3034], 0
lea eax, [ebp - 0x3034]
push eax
mov esi, 0x102b244
push esi
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.010854a2
test eax, eax
jne 0x10864fa
and dword [ebp - 0x3034], eax
cmp dword [0x109ab70], 0
jne 0x108650c
or dword [ebp - 0x3034], 1
jmp 0x1086513
or dword [ebp - 0x3034], 8
push dword [ebp - 0x3034]
lea eax, [ebp - 0x20c]
push 0x102ab3c
push esi
push 0x102ab28
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1086573
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102b244
jmp 0x1086c9e
lea eax, [ebp - 0x3034]
push eax
mov esi, 0x102b234
push esi
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.010854a2
test eax, eax
jne 0x108659b
and dword [ebp - 0x3034], eax
cmp dword [0x109ab70], 0
je 0x10865ab
or dword [ebp - 0x3034], 1
push dword [ebp - 0x3034]
lea eax, [ebp - 0x20c]
push 0x102ab3c
push esi
push 0x102ab28
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x108660b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102b234
jmp 0x1086c9e
push 0
push dword [ebp - 0x3028]
push 0x102b218
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.010852b6
push 0
push dword [ebp - 0x3028]
push 0x102b204
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.010852b6
push dword [ebp - 0x3028]
push 0xf300
push 0x102b1e4
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x1086679
push 0x102b1e4
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf301
push 0x102b1c8
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x10866ab
push 0x102b1c8
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf302
push 0x102b1a8
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x10866dd
push 0x102b1a8
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf303
push 0x102b188
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x108670f
push 0x102b188
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf304
push 0x102b168
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x1086741
push 0x102b168
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf305
push 0x102b14c
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x1086773
push 0x102b14c
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf306
push 0x102b128
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x10867a5
push 0x102b128
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf307
push 0x102b108
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x10867d7
push 0x102b108
jmp 0x1086a7f
push 0
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 0x102b0f4
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
push 0
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
test eax, eax
jne 0x1086812
push dword [ebp - 0x302c]
push 0x102b0d4
jmp 0x1086a84
lea eax, [ebp - 0x20c]
push eax
push 0x102ab3c
push 0x102b0f4
push 0x102ab60
lea eax, [ebp - 0xc14]
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
and word [ebp - 0xa0e], 0
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0xc14]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0xc14]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
je 0x1086562
push dword [ebp - 0x3028]
push 0xf309
push 0x102b0cc
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x10868a4
push 0x102b0cc
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf30a
push 0x102b0c4
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x10868d6
push 0x102b0c4
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf30b
push 0x102b0bc
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x1086908
push 0x102b0bc
jmp 0x1086a7f
and word [ebp - 0xc14], 0
push 0x101a190
push dword [ebp - 0x302c]
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
mov esi, 0x102b0b4
jne 0x108694e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x108693a
mov eax, 0x42b
push 0x10
lea ecx, [ebp - 0xc14]
push ecx
push eax
call sub.msvcrt.dll__itow
add esp, 0xc
jmp 0x108697c
push 0
push 0x103
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
push 0
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
test eax, eax
jne 0x108697c
and word [ebp - 0xc14], ax
cmp word [ebp - 0xc14], 0
je 0x108698f
lea eax, [ebp - 0x20c]
push eax
jmp 0x1086994
push 0x102b0a8
push 0x102ab3c
push esi
push 0x102ab60
lea eax, [ebp - 0xc14]
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0xc14]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0xc14]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
je 0x1086562
push dword [ebp - 0x3028]
push 0xf30c
push 0x102b080
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
push dword [ebp - 0x3028]
push 0xf30d
push 0x102b05c
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
push dword [ebp - 0x3028]
push 0xf30e
push 0x102b034
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x1086a52
push 0x102b034
jmp 0x1086a7f
push dword [ebp - 0x3028]
push 0xf30f
push 0x102b010
push dword [ebp - 0x302c]
push dword [ebp - 0x3030]
call fcn.01085376
mov esi, eax
cmp esi, 1
je 0x1086a8f
push 0x102b010
push 0x102aff8
call fcn.01071ac0
pop ecx
jmp 0x1086d88
xor esi, esi
push esi
push esi
push 0x104
lea eax, [ebp - 0xd18]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x302c]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1086d89
lea eax, [ebp - 0x3034]
push eax
push 0x400
lea eax, [ebp - 0x3024]
push eax
lea eax, [ebp - 0xc14]
push eax
mov word [ebp - 0xc14], si
mov word [ebp - 0x3024], si
mov word [ebp - 0x2824], si
mov word [ebp - 0x2024], si
call fcn.010856b7
test eax, eax
je 0x1086cb2
push dword [ebp - 0x3034]
lea eax, [ebp - 0x2024]
push 0x400
push eax
lea eax, [ebp - 0x2824]
push eax
lea eax, [ebp - 0xd18]
push eax
push dword [ebp - 0x3030]
call fcn.01085813
test eax, eax
je 0x1086be7
lea eax, [ebp - 0x2824]
push eax
push 0x102ae04
lea eax, [ebp - 0xc14]
push eax
push 0x102ab3c
push 0x102afe0
push 0x102afc4
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x20
push esi
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x161c]
push eax
mov word [ebp - 0xe1e], si
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x161c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1086ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102afe0
jmp 0x1086c9e
lea eax, [ebp - 0x2024]
push eax
push 0x102ae04
lea eax, [ebp - 0x3024]
push eax
push 0x102ab3c
push 0x102afa8
push 0x102afc4
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x20
and word [ebp - 0xe1e], 0
jmp 0x1086c68
lea eax, [ebp - 0xc14]
push eax
push 0x102ab3c
push 0x102afe0
push 0x102ab60
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push esi
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x161c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x161c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
je 0x1086b93
lea eax, [ebp - 0x3024]
push eax
push 0x102ab3c
push 0x102afa8
push 0x102ab60
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push 0
lea eax, [ebp - 0x3038]
push eax
lea eax, [ebp - 0x161c]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x161c]
push eax
push dword [ebp - 0x3028]
call edi
mov esi, eax
test esi, esi
jne 0x1086cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102afa8
push 0x102af80
call fcn.01071ac0
add esp, 0xc
jmp 0x1086d89
xor esi, esi
cmp dword [ebp - 0x3028], 0xffffffff
je 0x1086cce
push dword [ebp - 0x3028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x3028], 0xffffffff
xor eax, eax
push 0x11
mov ecx, 0x200
lea edi, [ebp - 0xc14]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x308c]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x3048]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x414]
push eax
push 0x102af70
lea eax, [ebp - 0xc14]
push 0x103
push eax
mov dword [ebp - 0x308c], 0x44
call sub.msvcrt.dll__snwprintf
add esp, 0x10
lea eax, [ebp - 0x3048]
push eax
lea eax, [ebp - 0x308c]
push eax
push esi
push esi
push 0x4000000
push 1
push esi
push esi
lea eax, [ebp - 0xc14]
push eax
lea eax, [ebp - 0x1824]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
cmp esi, 1
jne 0x1086d7e
cmp dword [0x109ab70], eax
jne 0x1086d66
push 0xffffffffffffffff
push dword [ebp - 0x3048]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x3044]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x3048]
call edi
jmp 0x1086d89
push 0x102af44
call fcn.01071ac0
pop ecx
cmp dword [ebp - 0x3028], 0xffffffff
je 0x1086d9e
push dword [ebp - 0x3028]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp esi, ebx
jne 0x1086dba
cmp word [ebp - 0x414], bx
je 0x1086dba
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 8