Function at 0x1001c8e
Capabilities:
Accept command line arguments
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x20a
lea eax, [ebp - 0x418]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x10022fd
cmp eax, esi
jae 0x10022fd
lea eax, [ebp + eax*2 - 0x418]
cmp word [eax - 2], 0x5c
je 0x1001cff
push 0x5c
pop ecx
mov word [eax], cx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x434], edi
cmp edi, ebx
jne 0x1001d49
push 0x71
call fcn.01001b22
xor eax, eax
inc eax
jmp 0x1002306
xor eax, eax
cmp dword [ebp + 8], ebx
jle 0x1001d5b
cmp dword [edi + eax*4], ebx
je 0x1001d3a
inc eax
cmp eax, dword [ebp + 8]
jl 0x1001d50
cmp dword [ebp + 8], 2
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x1001dad
mov ebx, 0x100122c
push ebx
call esi
push eax
push ebx
push dword [edi + 4]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
call ebx
test eax, eax
je 0x1001d96
push 0x100126c
call esi
push eax
push 0x100126c
push dword [edi + 4]
call ebx
test eax, eax
jne 0x1001dab
push 0x6d
push 0x7f04
push 0x6e
call fcn.01001b7b
xor eax, eax
jmp 0x1002307
xor ebx, ebx
xor eax, eax
inc eax
cmp dword [ebp + 8], eax
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x430], eax
jle 0x1001fef
jmp 0x1001dcd
mov edi, dword [ebp - 0x434]
mov eax, dword [ebp - 0x430]
mov ebx, 0x100120c
push ebx
lea edi, [edi + eax*4]
call esi
push eax
push ebx
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x1001f98
push 0x100124c
call esi
push eax
push 0x100124c
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x1001e1a
push ebx
call esi
push dword [edi]
mov ebx, eax
call esi
cmp ebx, eax
jl 0x1001f93
mov ebx, 0x1001214
push ebx
call esi
push eax
push ebx
push dword [edi]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
call ebx
test eax, eax
je 0x1001f7f
push 0x1001254
call esi
push eax
push 0x1001254
push dword [edi]
call ebx
test eax, eax
jne 0x1001e66
push 0x1001214
call esi
push dword [edi]
mov ebx, eax
call esi
cmp ebx, eax
jl 0x1001f7f
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 0x100121c
call esi
push eax
push 0x100121c
push dword [edi]
call ebx
test eax, eax
je 0x1001f6b
push 0x100125c
call esi
push eax
push 0x100125c
push dword [edi]
call ebx
test eax, eax
jne 0x1001eaf
push 0x100121c
call esi
push dword [edi]
mov ebx, eax
call esi
cmp ebx, eax
jl 0x1001f6b
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 0x1001224
call esi
push eax
push 0x1001224
push dword [edi]
call ebx
test eax, eax
je 0x1001f57
push 0x1001264
call esi
push eax
push 0x1001264
push dword [edi]
call ebx
test eax, eax
jne 0x1001ef4
push 0x1001224
call esi
push dword [edi]
mov ebx, eax
call esi
cmp ebx, eax
jl 0x1001f57
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 0x10011f4
call esi
push eax
push 0x10011f4
push dword [edi]
call ebx
test eax, eax
je 0x1001f49
push 0x1001234
call esi
push eax
push 0x1001234
push dword [edi]
call ebx
test eax, eax
jne 0x1001f2f
push 0x10011f4
call esi
push dword [edi]
mov ebx, eax
call esi
cmp ebx, eax
jl 0x1001f49
cmp dword [ebp - 0x430], 1
jne 0x1001fac
mov eax, dword [ebp - 0x434]
mov eax, dword [eax + 4]
mov dword [ebp - 0x42c], eax
jmp 0x1001fac
push 0x1001234
call esi
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
jmp 0x1001f41
push 0x1001224
call esi
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x420], eax
jmp 0x1001fa6
push 0x100121c
call esi
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x428], eax
jmp 0x1001fa6
push 0x1001214
call esi
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x41c], eax
jmp 0x1001fac
mov ebx, 0x100120c
push ebx
call esi
mov ecx, dword [edi]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x438], eax
inc dword [ebp - 0x424]
inc dword [ebp - 0x430]
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp + 8]
jl 0x1001dc7
cmp dword [ebp - 0x424], 1
jg 0x1001d96
cmp dword [ebp - 0x41c], 0
je 0x1001fed
cmp dword [ebp - 0x428], 0
je 0x1001fed
cmp dword [ebp - 0x420], 0
jne 0x1001d96
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100167d
push 0x10011d8
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010016dd
push ebx
push 0x80
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x1002061
lea eax, [ebp - 0x20c]
push eax
push 0x64
call fcn.01001b22
pop ecx
jmp 0x1002304
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp dword [ebp - 0x42c], edi
je 0x100207c
push dword [ebp - 0x42c]
call esi
mov ebx, eax
cmp dword [ebp - 0x438], edi
je 0x1002090
push dword [ebp - 0x438]
call esi
lea ebx, [ebx + eax + 4]
cmp dword [ebp - 0x428], edi
je 0x10020a2
push dword [ebp - 0x428]
call esi
add ebx, eax
cmp dword [ebp - 0x41c], edi
je 0x10020b4
push dword [ebp - 0x41c]
call esi
add ebx, eax
cmp dword [ebp - 0x420], edi
je 0x10020c8
push dword [ebp - 0x420]
call esi
lea ebx, [ebx + eax + 4]
add ebx, 0x22a
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
mov dword [ebp - 0x434], esi
test esi, esi
je 0x1001da4
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
cmp dword [ebp - 0x42c], eax
je 0x1002127
push 0x10011cc
push ebx
push esi
call fcn.010016dd
push 0x10011f4
push ebx
push esi
call fcn.010016dd
push dword [ebp - 0x42c]
push ebx
push esi
call fcn.010016dd
cmp dword [ebp - 0x438], 0
mov edi, dword [ebp - 0x434]
mov esi, 0x1001284
je 0x1002170
push 0x10011cc
push ebx
push edi
call fcn.010016dd
push 0x100120c
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
push dword [ebp - 0x438]
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
cmp dword [ebp - 0x428], 0
je 0x10021ec
push 0x10011cc
push ebx
push edi
call fcn.010016dd
push 0x100121c
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
push dword [ebp - 0x428]
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
cmp dword [ebp - 0x41c], 0
je 0x10021ec
push 0x10011cc
push ebx
push edi
call fcn.010016dd
push 0x1001214
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
push dword [ebp - 0x41c]
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
cmp dword [ebp - 0x420], 0
je 0x100226c
push 0x10011cc
push ebx
push edi
call fcn.010016dd
push 0x1001224
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
push dword [ebp - 0x420]
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
cmp dword [ebp - 0x41c], 0
je 0x10022bb
push 0x10011cc
push ebx
push edi
call fcn.010016dd
push 0x1001214
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
push dword [ebp - 0x41c]
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
xor eax, eax
cmp dword [ebp - 0x41c], eax
je 0x10022bb
cmp dword [ebp - 0x420], eax
jne 0x10022bb
cmp dword [ebp - 0x428], eax
jne 0x10022bb
push 0x10011cc
push ebx
push edi
call fcn.010016dd
push 0x1001214
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
push dword [ebp - 0x41c]
push ebx
push edi
call fcn.010016dd
push esi
push ebx
push edi
call fcn.010016dd
push 0
push 0x1001280
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x1001274
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x10022f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
je 0x10022f1
push 0x72
push eax
call fcn.01001bcf
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1001da4
push 0x66
call fcn.01001b22
xor eax, eax
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010025d5
leave
ret