Function at 0x100050a0
Capabilities:
Check if file exists
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8cc
mov eax, dword [0x100280f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ecx
push 0x10024ad4
mov dword [ebp - 0x870], eax
xor eax, eax
lea ecx, [ebp - 0x24]
mov edi, edx
push 0xf
xor esi, esi
push ecx
mov dword [ebp - 0x86c], edi
mov word [ebp - 0x24], si
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
call fcn.1000e480
mov edx, dword [ebp + 0x10]
xor eax, eax
push edx
push 0x10024ad4
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x44]
push 0xf
push eax
mov word [ebp - 0x44], si
call fcn.1000e480
mov ecx, dword [ebp + 0x14]
xor eax, eax
push ecx
push 0x10024ad4
lea edx, [ebp - 0x64]
push 0xf
push edx
mov word [ebp - 0x64], si
mov dword [ebp - 0x62], eax
mov dword [ebp - 0x5e], eax
mov dword [ebp - 0x5a], eax
mov dword [ebp - 0x56], eax
mov dword [ebp - 0x52], eax
mov dword [ebp - 0x4e], eax
mov dword [ebp - 0x4a], eax
mov word [ebp - 0x46], ax
call fcn.1000e480
push 0x7fe
lea eax, [ebp - 0x866]
push esi
push eax
mov word [ebp - 0x868], si
call fcn.1000f430
lea eax, [ebp - 0x24]
add esp, 0x3c
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, si
jne 0x10005184
sub eax, ecx
mov ecx, dword [edi]
mov edi, dword [ebx]
mov edx, dword [ecx - 8]
mov edi, dword [edi - 8]
sar eax, 1
add edi, edx
lea eax, [edi + eax + 0xc]
cmp eax, 0x400
ja 0x1000540d
add edx, edx
push edx
push ecx
lea eax, [ebp - 0x868]
push 0x800
push eax
call fcn.1000ded5
lea edi, [ebp - 0x868]
add esp, 0x10
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100051d0
mov eax, dword [ebx]
mov ecx, 6
mov esi, str.__syxq_1616
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100051f0
lea edi, [ebp - 0x868]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10005206
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x868]
add edi, 0xfffffffe
jmp 0x10005230
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005230
mov ebx, dword [0x10024914]
lea eax, [ebp - 0x24]
mov dword [edi], ebx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005250
lea edi, [ebp - 0x868]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10005266
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x868]
add edi, 0xfffffffe
jmp 0x10005290
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005290
lea eax, [ebp - 0x44]
mov dword [edi], ebx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100052a3
lea edi, [ebp - 0x868]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100052c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x868]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100052e5
lea eax, [ebp - 0x64]
mov dword [edi], ebx
mov edx, eax
jmp 0x10005300
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005300
lea edi, [ebp - 0x868]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10005316
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x44
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x8c8]
push 0
push ecx
call fcn.1000f430
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0x880]
push edx
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x874], eax
lea eax, [ebp - 0x8c8]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x868]
push ecx
push 0
mov dword [ebp - 0x8c8], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10005411
call dword [section..data]
lea edx, [ebp - 0x868]
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jg 0x100053d3
lea edi, [eax + eax]
mov eax, edi
call fcn.10017c20
mov esi, esp
mov edx, ebx
mov ecx, edi
lea eax, [ebp - 0x868]
call fcn.10008230
mov esi, dword [ebp - 0x870]
test esi, esi
je 0x1000540d
mov eax, dword [ebp - 0x86c]
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10005400
push 0xb
push str.8nQ
push eax
push 9
call esi
xor eax, eax
jmp 0x1000542e
push 0xc
push 0x10024930
push 0
push 9
call esi
xor eax, eax
jmp 0x1000542e
mov ecx, dword [ebp - 0x880]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x87c]
push edx
call esi
mov eax, 1
lea esp, [ebp - 0x8d8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dec6
mov esp, ebp
pop ebp
ret 0x10