Function at 0x10001a60
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Read file on windows
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10cc
call fcn.10003120
mov eax, dword [0x1001e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x10c], 0
push 0x105
push 0
lea eax, [ebp - 0x10b]
push eax
call fcn.10004590
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
push 0x208
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.10004590
add esp, 0xc
cmp dword [ebp - 0x110], 0
je 0x10001add
cmp dword [ebp - 0x110], 0x104
jbe 0x10001b02
mov eax, dword [ebp - 0x110]
push eax
push 0x100172f4
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x10
or eax, 0xffffffff
jmp 0x10002348
cmp dword [ebp + 8], 0
je 0x10001b12
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10001b32
push 0x1001730c
push 0x800
mov eax, dword [ebp + 0x10]
push eax
call fcn.10002d90
add esp, 0xc
mov eax, 0xfffffffe
jmp 0x10002348
mov byte [ebp - 0x214], 0
push 0x103
push 0
lea eax, [ebp - 0x213]
push eax
call fcn.10004590
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0
push 0x10017324
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x10001b9e
mov eax, dword [ebp - 0x110]
push eax
push 0x10017328
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x10
or eax, 0xffffffff
jmp 0x10002348
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
jne 0x10001bf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x10017340
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x14
or eax, 0xffffffff
jmp 0x10002348
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push sym.SetupPackageTool.dll_SetupFindFileHandleProc
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x21c], 0
jne 0x10001c2e
jmp 0x10001ce8
push 0x1001735c
push 0x66
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x10001c56
jmp 0x10001ce8
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x228], 0
jne 0x10001c95
jmp 0x10001ce8
mov dword [ebp - 0x230], 0
push 0
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10001cc9
jmp 0x10001ce8
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0x220], 1
xor eax, eax
jne 0x10001c20
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x218], 0xffffffff
cmp dword [ebp - 0x220], 0
jne 0x10001d3a
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x214]
push eax
push 0x10017360
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x10
or eax, 0xffffffff
jmp 0x10002348
mov dword [ebp - 0x240], 0
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x284], 0x44
push 0x40
push 0
lea eax, [ebp - 0x280]
push eax
call fcn.10004590
add esp, 0xc
mov byte [ebp - 0x48c], 0
push 0x207
push 0
lea eax, [ebp - 0x48b]
push eax
call fcn.10004590
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x48c]
push ecx
call fcn.100011a0
add esp, 8
push str.__accepteula__
lea eax, [ebp - 0x48c]
push eax
call fcn.10001110
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x48c]
push ecx
call fcn.10001110
add esp, 8
push 0x10017388
lea eax, [ebp - 0x48c]
push eax
call fcn.10001110
add esp, 8
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x4a0], 0
xor eax, eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x498], 1
mov dword [ebp - 0x4a0], 0xc
push 0
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x494]
push ecx
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x10001e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001738c
push 0x800
mov eax, dword [ebp + 0x10]
push eax
call fcn.10002d90
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or eax, 0xffffffff
jmp 0x10002348
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x258], 0x101
xor eax, eax
mov word [ebp - 0x254], ax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x284]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x48c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x494]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x220], 0
jne 0x10001f3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x48c]
push eax
push 0x100173a0
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x14
mov eax, dword [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0xfffffffd
jmp 0x10002348
mov byte [ebp - 0xca0], 0
push 0x7ff
push 0
lea eax, [ebp - 0xc9f]
push eax
call fcn.10004590
add esp, 0xc
mov dword [ebp - 0xca4], 0
mov dword [ebp - 0xca8], 0xfffffffd
mov dword [ebp - 0xcac], 0
mov dword [ebp - 0xcb0], 0
push 0
lea eax, [ebp - 0xca4]
push eax
mov ecx, 0x800
sub ecx, dword [ebp - 0xcb0]
push ecx
mov edx, dword [ebp - 0xcb0]
lea eax, [ebp + edx - 0xca0]
push eax
mov ecx, dword [ebp - 0x490]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10001fd2
cmp dword [ebp - 0xca4], 0
jbe 0x10001fd2
mov eax, dword [ebp - 0xcb0]
add eax, dword [ebp - 0xca4]
mov dword [ebp - 0xcb0], eax
jmp 0x10001f81
push str.No_matching_handles_found.
lea eax, [ebp - 0xca0]
push eax
call fcn.10001730
add esp, 8
test eax, eax
je 0x1000200f
mov dword [ebp - 0xca8], 0
push 0x100173d4
push 0x800
mov eax, dword [ebp + 0x10]
push eax
call fcn.10002d90
add esp, 0xc
jmp 0x10002248
push str.Access_denied_r_n
lea eax, [ebp - 0xca0]
push eax
call fcn.10001730
add esp, 8
test eax, eax
je 0x1000203f
push 0x100173f4
push 0x800
mov eax, dword [ebp + 0x10]
push eax
call fcn.10002d90
add esp, 0xc
jmp 0x100020a4
push str.Insufficient_system_resources_r_n
lea eax, [ebp - 0xca0]
push eax
call fcn.10001730
add esp, 8
test eax, eax
je 0x1000206f
push str.Insufficient_system_resources.
push 0x800
mov eax, dword [ebp + 0x10]
push eax
call fcn.10002d90
add esp, 0xc
jmp 0x100020a4
push str.Error_obtaining_handle_information
lea eax, [ebp - 0xca0]
push eax
call fcn.10001730
add esp, 8
test eax, eax
je 0x100020a4
lea eax, [ebp - 0xca0]
push eax
push 0x10017468
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x10
mov dword [ebp - 0xcb4], 0
lea eax, [ebp - 0xcb4]
push eax
push 0x10017478
lea ecx, [ebp - 0xca0]
push ecx
call fcn.10005419
add esp, 0xc
mov dword [ebp - 0xcb8], eax
cmp dword [ebp - 0xcb8], 0
jne 0x100020e2
mov dword [ebp - 0xca8], 0xfffffffa
cmp dword [ebp - 0xcb8], 0
je 0x10002248
mov byte [ebp - 0xdbc], 0
push 0x103
push 0
lea eax, [ebp - 0xdbb]
push eax
call fcn.10004590
add esp, 0xc
mov byte [ebp - 0xec0], 0
push 0x103
push 0
lea eax, [ebp - 0xebf]
push eax
call fcn.10004590
add esp, 0xc
lea eax, [ebp - 0xdbc]
push eax
push 0x1001747c
push str.pid:
mov ecx, dword [ebp - 0xcb8]
push ecx
call fcn.10001610
add esp, 0x10
test eax, eax
je 0x10002227
lea eax, [ebp - 0xec0]
push eax
push 0x10017488
push str.type:_File
mov ecx, dword [ebp - 0xcb8]
push ecx
call fcn.10001610
add esp, 0x10
test eax, eax
je 0x10002227
mov dword [ebp - 0xec4], 0
mov dword [ebp - 0xec8], 0
lea eax, [ebp - 0xec4]
push eax
push 0x100174a4
lea ecx, [ebp - 0xdbc]
push ecx
call fcn.10002de0
add esp, 0xc
lea eax, [ebp - 0xec8]
push eax
push 0x100174a8
lea ecx, [ebp - 0xec0]
push ecx
call fcn.10002de0
add esp, 0xc
cmp dword [ebp + 0xc], 1
jne 0x10002210
mov eax, dword [ebp - 0xec4]
push eax
mov ecx, dword [ebp - 0xec8]
push ecx
call fcn.100011f0
add esp, 8
test eax, eax
jne 0x100021ff
xor eax, eax
sub eax, dword [ebp - 0xec4]
mov dword [ebp - 0xca8], eax
mov dword [ebp - 0xcac], 0
jmp 0x10002248
mov eax, dword [ebp - 0xcac]
add eax, 1
mov dword [ebp - 0xcac], eax
jmp 0x10002227
cmp dword [ebp - 0xca8], 0
jg 0x10002227
mov eax, dword [ebp - 0xec4]
mov dword [ebp - 0xca8], eax
jmp 0x10002248
lea eax, [ebp - 0xcb4]
push eax
push 0x10017478
push 0
call fcn.10005419
add esp, 0xc
mov dword [ebp - 0xcb8], eax
jmp 0x100020e2
mov eax, dword [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0xcac], 0
jle 0x1000227b
mov eax, dword [ebp - 0xcac]
jmp 0x10002348
cmp dword [ebp - 0xca8], 0
je 0x10002335
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10002335
push 0x3e8
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xecc], 0
lea eax, [ebp - 0xecc]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x10002318
cmp dword [ebp - 0xecc], 0
je 0x100022f9
mov eax, dword [ebp - 0xca8]
push eax
mov ecx, dword [ebp - 0xecc]
push ecx
push 0x100174ac
push 0x800
mov edx, dword [ebp + 0x10]
push edx
call fcn.10002d90
add esp, 0x14
jmp 0x10002316
mov eax, dword [ebp - 0xca8]
push eax
push 0x100174c8
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x10
jmp 0x10002335
mov eax, dword [ebp - 0xca8]
push eax
push 0x100174e0
push 0x800
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10002d90
add esp, 0x10
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xca8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003098
mov esp, ebp
pop ebp
ret 0xc