Function at 0xbb1d34
Capabilities:
Create process on windows

Disassembly:
push 8
push 0x170
mov eax, 0xb029af
call fcn.00af8ef8
mov edi, edx
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x124], ecx
xor edx, edx
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], edx
push edx
push ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x11c], edx
call dword [sym.imp.AEPIC.dll_PicRetrieveFileInfo]
mov ecx, dword [ebx + 4]
test eax, eax
jns 0xbb1d96
push eax
push 0xa192a4
push 0x6c
pop edx
call fcn.00ab606d
jmp 0xbb1dad
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], eax
xor ecx, ecx
mov dword [ebp - 0x18], 7
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 4], 2
mov eax, dword [0x9e7eac]
mov esi, dword [ebp - 0x124]
mov dword [ebp - 0x118], eax
mov eax, dword [0x9e7eb0]
push esi
mov dword [ebp - 0x134], eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindFileNameW]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x120], ecx
mov cx, word [edx]
add edx, 2
cmp cx, word [ebp - 0x130]
jne 0xbb1df7
push dword [ebp - 0x134]
sub edx, dword [ebp - 0x120]
mov ecx, eax
push dword [ebp - 0x118]
sar edx, 1
call fcn.00a36636
test al, al
je 0xbb1ef0
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0xbb1e30
push 0x20
sub esi, ecx
sar esi, 1
pop eax
mov word [ebp - 0x120], ax
je 0xbb1e65
lea eax, [ebp - 0x120]
mov edx, esi
push eax
mov ecx, edi
call fcn.00b9d9ec
test eax, eax
je 0xbb1e65
sub eax, edi
sar eax, 1
jmp 0xbb1e68
or eax, 0xffffffff
cmp esi, eax
jb 0xbb1e6e
mov esi, eax
push ecx
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], edi
push eax
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x13c], esi
call fcn.00bafc55
lea ecx, [ebp - 0x2c]
cmp ecx, eax
je 0xbb1eab
xor ecx, ecx
mov byte [ebp - 0x118], cl
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x118]
push eax
call fcn.00b79d44
lea ecx, [ebp - 0x108]
call fcn.00a34c33
xor eax, eax
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov dword [ebp - 0x10c], eax
jb 0xbb1eca
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x10c]
call fcn.00bff403
mov ecx, dword [ebx + 4]
test eax, eax
jns 0xbb1eea
push eax
push 0xa192a4
push 0x7c
pop edx
call fcn.00ab606d
mov esi, dword [ebp - 0x124]
cmp dword [ebp - 0x18], 8
lea edi, [ebp - 0x2c]
jb 0xbb1efc
mov edi, dword [ebp - 0x2c]
push ecx
push 0xa190e4
lea ecx, [ebp - 0xf0]
call fcn.00bb088f
push dword [ebx + 8]
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf0], 0x9d6a00
push dword [ebp - 0x10c]
push edi
push dword [ebp - 0x128]
push dword [ebp - 0x12c]
push esi
call fcn.00bb25b0
push 0x3c
pop edi
xor eax, eax
mov byte [ebp - 4], 3
push edi
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.00ab4bf6
xor eax, eax
mov dword [ebp - 0x17c], edi
add esp, 0xc
mov dword [ebp - 0x16c], esi
cmp byte [ebx + 8], al
mov dword [ebp - 0x160], 1
setne al
dec eax
and eax, 0x40
add eax, 0x100
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebx + 4]
test eax, eax
jne 0xbb1fad
push 0xa192a4
lea edx, [edi + 0x4c]
call fcn.00bb3175
cmp byte [ebx + 8], 0
jne 0xbb2009
cmp dword [ebp - 0x144], 0
je 0xbb2009
lea ecx, [ebp - 0xf0]
call fcn.00bb1037
mov esi, dword [ebp - 0x144]
mov dword [ebp - 0x118], esi
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00c54347
mov ecx, dword [ebx + 4]
test eax, eax
jns 0xbb1ff5
push eax
push 0xa192a4
mov edx, 0x8c
call fcn.00b607a3
mov byte [ebp - 4], 3
test esi, esi
je 0xbb2009
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push ecx
lea ecx, [ebp - 0xf0]
call fcn.00bb286c
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf0], 0x9d6a00
call fcn.00bb10ce
lea ecx, [ebp - 0x38]
call fcn.00bb3288
lea ecx, [ebp - 0x44]
call fcn.00a48c27
lea ecx, [ebp - 0xac]
call fcn.00a7d7ad
cmp dword [ebp - 0xd4], 1
jne 0xbb206b
mov dword [ebp - 0xd4], 2
call fcn.00ab75e6
lea edx, [ebp - 0xcc]
mov ecx, dword [eax + 4]
call fcn.00b61345
cmp dword [ebp - 0xe0], 0
mov dword [ebp - 0xd4], 3
je 0xbb2089
lea ecx, [ebp - 0xec]
call fcn.00a59db6
mov byte [ebp - 4], 1
cmp dword [ebp - 0x10c], 0
je 0xbb20a2
push dword [ebp - 0x10c]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
lea ecx, [ebp - 0x2c]
call fcn.00a34c33
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x11c], 0
je 0xbb20c3
push dword [ebp - 0x11c]
call dword [sym.imp.AEPIC.dll_PicFreeFileInfo]
mov ecx, dword [ebp - 0x14]
call fcn.00af8ed3
ret 4