Function at 0x100bc237
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push 0x4b0
mov eax, 0x10112044
call fcn.10062c32
mov ebx, ecx
mov dword [ebp - 0x454], ebx
push 0x44
xor eax, eax
pop esi
mov dword [ebp - 4], eax
push esi
push eax
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.100638f0
xor eax, eax
mov dword [ebp - 0x4bc], esi
lea edi, [ebp - 0x470]
add esp, 0xc
stosd dword es:[edi], eax
mov ecx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.100bb9a9
push 7
xor ebx, ebx
mov dword [ebp - 0x2f4], 0x10005c5c
pop ecx
xor eax, eax
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2dc], ecx
mov word [ebp - 0x2f0], ax
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2c4], ecx
mov word [ebp - 0x2d8], ax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x2f4]
call fcn.100e3dcb
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], edi
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x230]
call fcn.1007c7f0
push ebx
push ecx
lea ecx, [ebp - 0x230]
call fcn.100db65a
cmp eax, 0xffffffff
je 0x100bc353
lea ecx, [ebp - 0x230]
call fcn.100e3d9a
test al, al
jne 0x100bc353
push 1
mov esi, 0x1003078c
lea ecx, [ebp - 0x230]
push esi
push ebx
call fcn.1007ede1
push esi
push dword [ebp - 0x220]
lea ecx, [ebp - 0x230]
call fcn.10081c62
xor eax, eax
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], edi
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x290]
call fcn.1007c7f0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x260]
call fcn.1006e7cf
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 7
call fcn.100e3d9a
test al, al
je 0x100bc3df
push 1
push 0x22
lea ecx, [ebp - 0x260]
call fcn.1007dee8
dec eax
lea ecx, [ebp - 0x260]
push eax
push 1
lea eax, [ebp - 0x2a8]
push eax
call fcn.1007cf62
push eax
lea ecx, [ebp - 0x260]
call fcn.1006f90c
lea ecx, [ebp - 0x2a8]
call fcn.1006af06
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x260]
jb 0x100bc3f4
mov ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x250]
push ecx
push ecx
call fcn.1007c75b
cmp eax, 0xffffffff
jne 0x100bc421
xor eax, eax
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], 7
mov word [ebp - 0x2c0], ax
jmp 0x100bc437
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x260]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.1007cf62
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x248]
call fcn.1007c7f0
cmp dword [ebp - 0x280], 0
je 0x100bc48d
push 0x10035df8
lea ecx, [ebp - 0x248]
call fcn.10071d02
cmp dword [ebp - 0x27c], 8
lea eax, [ebp - 0x290]
jb 0x100bc47b
mov eax, dword [ebp - 0x290]
push dword [ebp - 0x280]
lea ecx, [ebp - 0x248]
push eax
call fcn.10071d31
mov esi, dword [ebp + 8]
cmp byte [esi + 0xe4], 0
je 0x100bc50f
add esi, 0x14
lea edi, [ebp - 0x270]
push 1
lea edx, [ebp - 0x270]
lea ecx, [ebp - 0x2a8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100886d9
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 9
push eax
mov edx, 0x10035df8
lea ecx, [ebp - 0x278]
call fcn.1008beb0
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x100bc4e3
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.10071d31
lea ecx, [ebp - 0x278]
call fcn.1006af06
push 8
pop edi
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 8
call fcn.1006af06
jmp 0x100bc515
mov edi, dword [ebp - 0x44c]
push 0x10035f38
lea ecx, [ebp - 0x248]
call fcn.10071d02
mov dword [ebp - 0x450], ebx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], ebx
push eax
push 1
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, eax
test esi, esi
je 0x100bc56b
lea eax, [ebp - 0x450]
push eax
push 1
push 2
push ebx
push 0xb
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, eax
cmp dword [ebp - 0x44c], 0
je 0x100bc580
push dword [ebp - 0x44c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
jne 0x100bc5bd
push 0x118
lea eax, [ebp - 0x444]
push 0
push eax
call fcn.100638f0
add esp, 0xc
mov dword [ebp - 0x448], 0x11c
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x444], 6
sbb bl, bl
inc bl
push ecx
push 0x1013d750
lea ecx, [ebp - 0x26c]
call fcn.1006b5df
mov byte [ebp - 4], 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x478]
push eax
call fcn.1007556d
mov ecx, dword [eax]
lea eax, [ebp - 0x2c0]
add ecx, 0x14
push eax
call fcn.10076195
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x10002784
call fcn.1006d7a9
xor eax, eax
push ecx
mov word [ebp - 0x44a], ax
lea ecx, [ebp - 0x44a]
mov eax, dword [ebp - 0x238]
push ecx
inc eax
lea ecx, [ebp - 0x460]
push eax
call fcn.1007d6b9
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
jb 0x100bc658
mov ecx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x45c]
sub eax, dword [ebp - 0x460]
push ecx
sar eax, 1
push eax
push dword [ebp - 0x460]
call fcn.10055cdb
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100638f0
add esp, 0x18
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x1002d8e0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
lea eax, [ebp - 0x218]
je 0x100bc6cc
push 0x5c
push eax
call fcn.1006a56a
pop ecx
pop ecx
test eax, eax
je 0x100bc6c6
xor ecx, ecx
mov word [eax], cx
jmp 0x100bc6d8
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp esi, 1
jne 0x100bc71a
test bl, bl
je 0x100bc71a
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push edi
push eax
push eax
push eax
push dword [ebp - 0x460]
push eax
push dword [ebp - 0x450]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x100bc951
jmp 0x100bc745
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x218]
push eax
xor eax, eax
push eax
push edi
push eax
push eax
push eax
push dword [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x100bc710
push dword [ebp - 0x46c]
mov ebx, dword [ebp - 0x468]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x470]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x1001ddfc
lea edi, [ebp - 0x32c]
lea eax, [ebp - 0x32c]
push eax
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov edi, esp
lea esi, [esi + 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x454]
mov ecx, edi
call fcn.100bb850
mov dword [ebp - 0x44c], eax
xor ecx, ecx
mov eax, edx
mov esi, eax
mov dword [ebp - 0x454], eax
and esi, 0x80
or ecx, esi
jne 0x100bc8c4
push ecx
lea ecx, [ebp - 0x3dc]
call fcn.1006e89f
mov edx, 0x10035f50
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x3cc]
call fcn.1007f2e1
lea ecx, [ebp + 8]
mov esi, eax
call fcn.100b43d7
lea ecx, [ebp - 0x270]
push ecx
mov ecx, eax
call fcn.100bb831
mov edx, eax
mov ecx, esi
call fcn.100b2660
mov edx, 0x10035d34
mov ecx, eax
call fcn.1007f2e1
push dword [ebp - 0x454]
lea ecx, [ebp - 0x2a8]
mov esi, eax
push dword [ebp - 0x44c]
call fcn.100bcb64
mov edx, eax
mov byte [ebp - 4], 0xf
mov ecx, esi
call fcn.10080b00
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0xe
call fcn.1006ac90
push 0x18b
push 0x10035ea0
lea ecx, [ebp - 0x310]
call fcn.10080edd
mov edi, eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x3dc]
call fcn.10073f07
mov esi, eax
push 0x1001df40
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x11
call fcn.1006ab4f
push esi
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 0x12
push eax
push 1
mov ecx, edi
call fcn.10080fb8
lea ecx, [ebp - 0x2a8]
call fcn.1006ac90
lea ecx, [ebp - 0x278]
call fcn.1006ac90
lea ecx, [ebp - 0x310]
call fcn.1006b8ea
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0xd
call fcn.1006fc5c
jmp 0x100bc951
push ebx
lea eax, [ebp - 0x32c]
push eax
lea ecx, [edi + 0x60]
call fcn.100b3d06
lea ecx, [ebp - 0x460]
call fcn.10075865
cmp dword [ebp - 0x450], 0
je 0x100bc8fb
push dword [ebp - 0x450]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x450], 0
lea ecx, [ebp - 0x2c0]
call fcn.1006af06
lea ecx, [ebp - 0x260]
call fcn.1006af06
lea ecx, [ebp - 0x290]
call fcn.1006af06
lea ecx, [ebp - 0x230]
call fcn.1006af06
lea ecx, [ebp - 0x2f4]
call fcn.100e3d45
lea ecx, [ebp - 0x248]
call fcn.1006af06
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x100bc949
call fcn.10070fb6
call fcn.10062bca
ret 8
lea ecx, [ebp - 0x31c]
call fcn.100bb0d3
push 0x1011c928
lea eax, [ebp - 0x31c]
push eax
call fcn.100658b4
int3