Function at 0x3001c820
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1f0]
sub esp, 0x270
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp + 0x1ec], eax
call fcn.3000cc94
push dword [ebp + 0x1f8]
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x20], bx
mov ecx, 0x82
lea edi, [ebp - 0x1e]
push 0x3000b8bc
rep stosd dword es:[edi], eax
call fcn.3000ff32
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 0x24], eax
je 0x3001c8ae
push 0x3000b868
call fcn.3000fe20
push 0x3000b828
call fcn.3000fe20
mov dword [ebp - 0x24], 0x1f
push 0x3000b7d8
jmp 0x3001ca2c
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3000ce85
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001c8cb
push 0x3000b7a4
jmp 0x3001ca2c
push 0x3000b1a0
lea ecx, [ebp - 0x2c]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001c8e9
push 0x3000b770
jmp 0x3001ca2c
cmp dword [0x30077198], ebx
lea ecx, [ebp - 0x2c]
je 0x3001c8fb
push 0x3000b75c
jmp 0x3001c900
push 0x3000b748
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001c916
push 0x3000b714
jmp 0x3001ca2c
push dword [ebp + 0x1f8]
lea ecx, [ebp - 0x2c]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001c935
push 0x3000b6e4
jmp 0x3001ca2c
cmp dword [ebp + 0x1fc], ebx
je 0x3001c995
push 0x30003ba8
lea ecx, [ebp - 0x2c]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp - 0x24], eax
jge 0x3001c963
push eax
push 0x30001400
call fcn.3000fdf9
push 0x3000b6a8
jmp 0x3001c988
push dword [ebp + 0x1fc]
lea ecx, [ebp - 0x2c]
call fcn.3000cf63
cmp eax, ebx
mov dword [ebp - 0x24], eax
jge 0x3001c995
push eax
push 0x30001400
call fcn.3000fdf9
push 0x3000b66c
call fcn.3000fdf9
add esp, 0xc
jmp 0x3001ca85
push 0x3000b618
call fcn.3000fe20
push dword [ebp - 0x2c]
call fcn.3000fe20
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x80], 0x44
push ebx
mov dword [ebp - 0x54], 0x40
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x3001c9fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001c9f5
push eax
push 0x3000b5fc
call fcn.3000fea4
push 0x3000b598
jmp 0x3001ca6d
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jne 0x3001ca34
call esi
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001ca34
push 0x3000b570
call fcn.3000fdf9
pop ecx
jmp 0x3001ca85
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x3001ca4e
call esi
cmp eax, ebx
mov dword [ebp - 0x24], eax
jne 0x3001ca85
mov eax, dword [ebp - 0x24]
sub eax, ebx
je 0x3001ca85
sub eax, 0x64e
je 0x3001ca82
sub eax, 0x1b
je 0x3001ca7b
sub eax, 0x559
je 0x3001ca74
push 0x3000b518
call fcn.3000fe20
jmp 0x3001ca85
push 0x3000b4b8
jmp 0x3001ca6d
push 0x3000b458
jmp 0x3001ca6d
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
call fcn.3000cc9e
mov ecx, dword [ebp + 0x1ec]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.3001f57d
add ebp, 0x1f0
leave
ret 8