Function at 0x100bbe87
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push 0x4b0
mov eax, 0x101116a4
call fcn.10062882
mov ebx, ecx
mov dword [ebp - 0x454], ebx
push 0x44
xor eax, eax
pop esi
mov dword [ebp - 4], eax
push esi
push eax
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.10063540
xor eax, eax
mov dword [ebp - 0x4bc], esi
lea edi, [ebp - 0x470]
add esp, 0xc
stosd dword es:[edi], eax
mov ecx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.100bb5f9
push 7
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x10005c5c
pop ecx
xor eax, eax
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2dc], ecx
mov word [ebp - 0x2f0], ax
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2c4], ecx
mov word [ebp - 0x2d8], ax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x2f4]
call fcn.100e39eb
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], edi
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x230]
call fcn.1004a302
push ebx
push ecx
lea ecx, [ebp - 0x230]
call fcn.1004a302
cmp eax, 0xffffffff
je 0x100bbfa3
lea ecx, [ebp - 0x230]
call fcn.100e39ba
test al, al
jne 0x100bbfa3
push 1
mov esi, 0x1003078c
lea ecx, [ebp - 0x230]
push esi
push ebx
call fcn.1004a302
push esi
push dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
call fcn.1004a302
xor eax, eax
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], edi
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x290]
call fcn.1004a302
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x260]
call fcn.1004a302
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 7
call fcn.100e39ba
test al, al
je 0x100bc02f
push 1
push 0x22
lea ecx, [ebp - 0x260]
call fcn.1004a302
dec eax
lea ecx, [ebp - 0x260]
push eax
push 1
lea eax, [ebp - 0x2a8]
push eax
call fcn.1004a302
push eax
lea ecx, [ebp - 0x260]
call fcn.1004a302
lea ecx, [ebp - 0x2a8]
call fcn.1006ab66
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x260]
jb 0x100bc044
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x250]
push ecx
push ecx
call fcn.1007c3bb
cmp eax, 0xffffffff
jne 0x100bc071
xor eax, eax
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], 7
mov word [ebp - 0x2c0], ax
jmp 0x100bc087
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x260]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.1004a302
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x248]
call fcn.1004a302
cmp dword [ebp - 0x280], 0
je 0x100bc0dd
push 0x10035f44
lea ecx, [ebp - 0x248]
call fcn.1004a302
cmp dword [ebp - 0x27c], 8
lea eax, [ebp - 0x290]
jb 0x100bc0cb
mov eax, dword [ebp - 0x290]
push dword [ebp - 0x280]
lea ecx, [ebp - 0x248]
push eax
call fcn.1004a302
mov esi, dword [ebp + 8]
cmp byte [esi + 0xe4], 0
je 0x100bc15f
add esi, 0x14
lea edi, [ebp - 0x270]
push 1
lea edx, [ebp - 0x270]
lea ecx, [ebp - 0x2a8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10088339
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 9
push eax
mov edx, 0x10035f44
lea ecx, [ebp - 0x278]
call fcn.1004a302
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x100bc133
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.1004a302
lea ecx, [ebp - 0x278]
call fcn.1006ab66
push 8
pop edi
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 8
call fcn.1006ab66
jmp 0x100bc165
mov edi, dword [ebp - 0x44c]
push 0x10035f48
lea ecx, [ebp - 0x248]
call fcn.1004a302
mov dword [ebp - 0x450], ebx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], ebx
push eax
push 1
push 0xb
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, eax
test esi, esi
je 0x100bc1bb
lea eax, [ebp - 0x450]
push eax
push 1
push 2
push ebx
push 0xb
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, eax
cmp dword [ebp - 0x44c], 0
je 0x100bc1d0
push dword [ebp - 0x44c]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp esi, 1
jne 0x100bc20d
push 0x118
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.10063540
add esp, 0xc
mov dword [ebp - 0x448], 0x11c
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [ebp - 0x444], 6
sbb bl, bl
inc bl
push ecx
push 0x1013c750
lea ecx, [ebp - 0x26c]
call fcn.1004a302
mov byte [ebp - 4], 0xc
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x478]
push eax
call fcn.1004a302
mov ecx, dword [eax]
lea eax, [ebp - 0x2c0]
add ecx, 0x14
push eax
call fcn.1004a302
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x10002784
call fcn.1006d409
xor eax, eax
push ecx
mov word [ebp - 0x44a], ax
lea ecx, [ebp - 0x44a]
mov eax, dword [ebp - 0x238]
push ecx
inc eax
lea ecx, [ebp - 0x460]
push eax
call fcn.1004a302
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
jb 0x100bc2a8
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x45c]
sub eax, dword [ebp - 0x460]
push ecx
sar eax, 1
push eax
push dword [ebp - 0x460]
call fcn.1004a302
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10063540
add esp, 0x18
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x1002d8e0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
lea eax, [ebp - 0x218]
je 0x100bc31c
push 0x5c
push eax
call fcn.1004a302
pop ecx
pop ecx
test eax, eax
je 0x100bc316
xor ecx, ecx
mov word [eax], cx
jmp 0x100bc328
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
cmp esi, 1
jne 0x100bc36a
test bl, bl
je 0x100bc36a
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push edi
push eax
push eax
push eax
push dword [ebp - 0x460]
push eax
push dword [ebp - 0x450]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x100bc5a1
jmp 0x100bc395
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push edi
push eax
push eax
push eax
push dword [ebp - 0x460]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessW]
jmp 0x100bc360
push dword [ebp - 0x46c]
mov ebx, dword [ebp - 0x468]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x470]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, 0x1001ddfc
lea edi, [ebp - 0x32c]
lea eax, [ebp - 0x32c]
push eax
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov edi, esp
lea esi, [esi + 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x454]
mov ecx, edi
call fcn.1004a302
mov dword [ebp - 0x44c], eax
xor ecx, ecx
mov eax, edx
mov esi, eax
mov dword [ebp - 0x454], eax
and esi, 0x80
or ecx, esi
jne 0x100bc514
push ecx
lea ecx, [ebp - 0x3dc]
call fcn.1006e4ff
mov edx, 0x10035ea0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x3cc]
call fcn.1007ef41
lea ecx, [ebp + 8]
mov esi, eax
call fcn.100b4027
lea ecx, [ebp - 0x270]
push ecx
mov ecx, eax
call fcn.1004a302
mov edx, eax
mov ecx, esi
call fcn.1004a302
mov edx, 0x10035e30
mov ecx, eax
call fcn.1007ef41
push dword [ebp - 0x454]
lea ecx, [ebp - 0x2a8]
mov esi, eax
push dword [ebp - 0x44c]
call fcn.100bc7b4
mov edx, eax
mov byte [ebp - 4], 0xf
mov ecx, esi
call fcn.10080760
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0xe
call fcn.1006a8f0
push 0x18b
push 0x10035f00
lea ecx, [ebp - 0x310]
call fcn.1004a302
mov edi, eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x3dc]
call fcn.1004a302
mov esi, eax
push 0x1001df40
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x11
call fcn.1004a302
push esi
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 0x12
push eax
push 1
mov ecx, edi
call fcn.10080c18
lea ecx, [ebp - 0x2a8]
call fcn.1006a8f0
lea ecx, [ebp - 0x278]
call fcn.1006a8f0
lea ecx, [ebp - 0x310]
call fcn.1006b54a
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0xd
call fcn.1006f8bc
jmp 0x100bc5a1
push ebx
lea eax, [ebp - 0x32c]
push eax
lea ecx, [edi + 0x60]
call fcn.100b3956
lea ecx, [ebp - 0x460]
call fcn.100754c5
cmp dword [ebp - 0x450], 0
je 0x100bc54b
push dword [ebp - 0x450]
call dword [sym.imp.kernel32.dll_CloseHandle]
and dword [ebp - 0x450], 0
lea ecx, [ebp - 0x2c0]
call fcn.1006ab66
lea ecx, [ebp - 0x260]
call fcn.1006ab66
lea ecx, [ebp - 0x290]
call fcn.1006ab66
lea ecx, [ebp - 0x230]
call fcn.1006ab66
lea ecx, [ebp - 0x2f4]
call fcn.100e3965
lea ecx, [ebp - 0x248]
call fcn.1006ab66
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x100bc599
call fcn.10070c16
call fcn.1006281a
ret 8
lea ecx, [ebp - 0x31c]
call fcn.1004a302
push 0x1011bf18
lea eax, [ebp - 0x31c]
push eax
call fcn.1004a302
int3