Function at 0x5001c00
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Get common file path
Get disk information
Get disk size
Get file attributes
Terminate process

Disassembly:
sub esp, 0xb4
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x14], 0x5c3a63
mov byte [esp + 0x13], 0x63
mov dword [esp + 0x2c], ebx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x501632c], eax
call fcn.050014bc
mov ebp, 0x5016338
push 0x104
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
jmp 0x5001c5f
lea eax, [ecx - 1]
cmp byte [eax], 0x5c
je 0x5001c63
mov ecx, eax
cmp ecx, ebp
ja 0x5001c55
push ecx
call fcn.0500198b
mov esi, eax
push ebp
mov dword [esp + 0x24], esi
call fcn.05001515
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, eax
xor ecx, ecx
mov dword [esp + 0x18], ebp
mov al, byte [ebp]
cmp al, 0x20
je 0x5001c92
cmp al, 9
je 0x5001c92
cmp al, 0x22
jne 0x5001c9c
cmp al, 0x22
jne 0x5001c99
xor ecx, ecx
inc ecx
inc ebp
jmp 0x5001c83
cmp ecx, ebx
mov dword [esp + 0x18], ebp
je 0x5001cbc
mov cl, byte [ebp]
mov eax, ebp
jmp 0x5001cb3
cmp cl, 0x22
je 0x5001cb9
inc eax
mov cl, byte [eax]
cmp cl, bl
jne 0x5001cab
jmp 0x5001cbc
mov byte [eax], 0x20
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebp - 1]
jmp 0x5001cdd
mov cl, byte [eax]
cmp cl, 0x20
je 0x5001cda
cmp cl, 9
jne 0x5001ce1
mov byte [eax], bl
dec eax
cmp eax, ebp
jae 0x5001cce
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [section..zero], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ebx
lea edx, [ecx + esi - 1]
jmp 0x5001d03
cmp byte [edx], 0x2e
je 0x5001d09
dec edx
cmp edx, esi
ja 0x5001cfd
jmp 0x5001d31
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov esi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, section..zero
mov dword [esp + 0x1c], ecx
inc ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edx], bl
cmp byte [ebp], bl
mov dword [esp + 0x30], 0x50010e4
mov dword [esp + 0x28], ebp
je 0x5001e61
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov al, byte [eax]
mov cl, byte [ecx]
or al, 0x20
or cl, 0x20
cmp cl, al
jne 0x5001e42
mov eax, dword [esp + 0x28]
lea ebp, [eax + 1]
mov eax, dword [esp + 0x20]
lea esi, [eax + 1]
jmp 0x5001d75
cmp al, bl
je 0x5001d8e
inc ebp
inc esi
mov al, byte [esi]
mov dl, byte [ebp]
mov cl, al
or dl, 0x20
or cl, 0x20
cmp cl, dl
je 0x5001d6f
cmp al, bl
jne 0x5001e42
cmp byte [ebp], 0x2e
mov dword [esp + 0x24], ebx
jne 0x5001dd9
cmp dword [esp + 0x1c], ebx
jbe 0x5001dd9
xor edi, edi
cmp dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 1
jbe 0x5001dd5
mov eax, ebp
sub eax, section..zero
lea esi, [edi + section..zero]
mov cl, byte [eax + esi]
mov dl, byte [esi]
or cl, 0x20
or dl, 0x20
cmp cl, dl
jne 0x5001e54
inc edi
cmp edi, dword [esp + 0x1c]
jb 0x5001db5
add ebp, dword [esp + 0x1c]
mov al, byte [ebp]
cmp al, 0x20
je 0x5001de8
cmp al, 9
je 0x5001de8
cmp al, bl
jne 0x5001e42
mov esi, dword [esp + 0x18]
mov eax, ebp
sub eax, esi
mov edi, 0x5006108
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [esp + 0x24], ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x5006108]
mov byte [edi], bl
jne 0x5001e33
mov ecx, dword [esp + 0x1c]
mov esi, section..zero
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [eax + ecx + 0x5006108], bl
push 0x5006108
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x5001e5d
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp byte [eax], bl
jne 0x5001d46
jmp 0x5001e61
mov dword [esp + 0x24], ebx
jmp 0x5001dd9
mov dword [esp + 0x30], ebp
mov ebp, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x5001ee1
lea eax, [ecx - 2]
cmp eax, ebx
jbe 0x5001ee1
mov dword [esp + 0x18], eax
mov edi, dword [ebp]
xor esi, esi
and edi, 0xffdffdff
inc esi
or edi, 0x20000000
cmp edi, 0x20582d20
jne 0x5001ea1
mov dword [0x501643c], esi
cmp edi, 0x3a582d20
jne 0x5001eb8
lea eax, [ebp + 4]
mov dword [0x501643c], esi
push eax
call fcn.05001470
cmp edi, 0x20552d20
jne 0x5001ec6
mov dword [0x500620c], esi
cmp edi, 0x20512d20
jne 0x5001eda
mov dword [0x5016330], esi
mov dword [0x500620c], esi
inc ebp
dec dword [esp + 0x18]
jne 0x5001e81
mov eax, dword [0x50010d0]
xor ax, ax
cmp eax, 0xcab00000
jne 0x5001efa
push 0x20000001
call fcn.0500182f
test byte [0x50010d3], 0x80
jne 0x5001f0d
mov dword [0x501643c], 1
and byte [0x50010d3], 0x7f
cmp dword [0x5016330], ebx
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jne 0x5001fa6
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5016334], eax
lea eax, [esp + 0x58]
push eax
push ebx
push ebx
push 0x50018b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x5001f54
push 8
call fcn.0500182f
push 0xffffffffffffffff
push dword [0x5016334]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x20]
push ebx
push 0xc
push 0x68
push dword [0x5016440]
call esi
mov eax, dword [0x50010cc]
add eax, 0xffff
shr eax, 0x10
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5016440]
call esi
push ebx
push 1
push 0x404
push 0x6a
push dword [0x5016440]
call esi
push ebx
push ebx
push 0x5016338
call fcn.050018fc
mov edi, dword [0x50010cc]
or dword [esp + 0x2c], 0xffffffff
add esp, 0xc
cmp edi, ebx
mov dword [esp + 0x24], eax
je 0x500202f
mov eax, 0x10000
mov ebp, edi
cmp edi, eax
jbe 0x5001fd5
mov ebp, eax
push ebp
push 0x5006218
push dword [esp + 0x2c]
call fcn.0500193b
add esp, 0xc
push ebp
push 0x5006218
push dword [esp + 0x28]
call fcn.050014e6
cmp dword [0x5016330], ebx
mov dword [esp + 0x20], eax
jne 0x5002025
cmp dword [0x5016440], ebx
jne 0x5002014
push 0x4c7
call fcn.0500182f
push ebx
push ebx
push 0x405
push 0x6a
push dword [0x5016440]
call esi
sub edi, ebp
jne 0x5001fc8
cmp dword [esp + 0x20], ebx
je 0x5002039
push 0x20000001
call fcn.0500182f
lea eax, [esp + 0x74]
push eax
push ebx
push fcn.050012b1
push 0x5001292
push 0x5001963
push fcn.0500193b
push fcn.050018fc
push 0x500127f
push fcn.050018d8
call fcn.0500264d
push ebx
push ebx
push dword [esp + 0x50]
mov dword [esp + 0x48], eax
call fcn.050012b1
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x58]
push dword [esp + 0x50]
call fcn.050026e0
add esp, 0x3c
test eax, eax
jne 0x500209c
push 0x20000001
call fcn.0500182f
cmp dword [0x5016330], ebx
jne 0x50020b1
push ebx
push dword [0x5016440]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x5016220], bl
mov ebp, 0x5016220
je 0x50020da
push ebp
call fcn.05001b8a
test eax, eax
jne 0x50020ce
mov byte [0x5016220], bl
cmp byte [0x5016220], bl
jne 0x50021b2
cmp dword [0x500620c], ebx
jne 0x50020ee
cmp dword [0x501643c], ebx
jne 0x50021a6
mov byte [esp + 0x14], 0x61
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x5002108
cmp eax, 6
jne 0x5002153
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x5002153
mov eax, dword [esp + 0x40]
xor ecx, ecx
imul eax, dword [esp + 0x38]
mul dword [esp + 0x3c]
or ecx, edx
je 0x5002141
or eax, 0xffffffff
cmp eax, dword [esp + 0x2c]
jbe 0x5002153
mov dword [esp + 0x2c], eax
mov al, byte [esp + 0x14]
mov byte [esp + 0x13], al
inc byte [esp + 0x14]
cmp byte [esp + 0x14], 0x7a
jle 0x50020f3
mov al, byte [esp + 0x13]
push ebp
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 0x50010e8
push eax
call fcn.05001220
push eax
mov eax, dword [0x50010cc]
and eax, 0xffff
push eax
call fcn.050012dc
push ebp
call fcn.05001b8a
test eax, eax
jne 0x50021b2
push ebp
mov byte [0x5016228], 0x5f
call fcn.05001b8a
test eax, eax
jne 0x50021b2
mov dword [esp + 0x2c], ebx
push ebp
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [0x500620c], ebx
jne 0x500221d
cmp dword [0x501643c], ebx
jne 0x50021d0
mov eax, dword [0x50010cc]
lea eax, [eax + eax*2]
cmp dword [esp + 0x2c], eax
jae 0x500221d
push ebx
push 0x50019c0
push dword [0x5016440]
push 0x6b
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x50021ef
push eax
jmp 0x50021fc
cmp edi, ebx
je 0x50021f7
cmp byte [edi], bl
jne 0x5002201
push 0x4c7
call fcn.0500182f
mov edx, ebp
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x5002207
push ebp
call fcn.05001b8a
test eax, eax
je 0x50021d0
jmp 0x500222e
push ebp
call fcn.05001b8a
test eax, eax
jne 0x500222e
push 0x52
call fcn.0500182f
cmp dword [0x5016330], ebx
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebp, section..zero
jne 0x50022cf
push 0x104
push ebp
push 0x20000004
push ebx
call edi
push 0x104
push 0x5006108
push 0x20000006
push ebx
call edi
push ebp
push ebx
push 0xc
push 0x65
push dword [0x5016440]
call esi
push 0x5006108
push ebx
push 0xc
push 0x66
push dword [0x5016440]
call esi
push 0x5016220
push ebx
push 0xc
push 0x69
push dword [0x5016440]
call esi
push ebx
push ebx
push 0x402
push 0x6a
push dword [0x5016440]
call esi
movzx eax, word [esp + 0x62]
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5016440]
call esi
push 5
push dword [0x5016440]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x5002482
push ebx
push 0x50010e4
push 0x5016338
push dword [esp + 0x30]
call fcn.0500276f
add esp, 0x1c
test eax, eax
jne 0x50022fb
push 0x20000001
call fcn.0500182f
cmp dword [0x500620c], ebx
jne 0x5002315
cmp dword [0x5016440], ebx
jne 0x5002315
push 0x4c7
call fcn.0500182f
cmp dword [0x5016444], ebx
je 0x500243a
cmp dword [0x501643c], ebx
jne 0x500243a
cmp dword [0x5016330], ebx
jne 0x5002348
push dword [0x5016328]
push ebx
push 0xc
push 0x68
push dword [0x5016440]
call esi
mov eax, dword [0x5016444]
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x5002351
mov edi, dword [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
push 0x11
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
lea edi, [esp + 0x80]
rep stosd dword es:[edi], eax
inc eax
mov dword [esp + 0x80], 0x44
mov dword [esp + 0xac], eax
mov word [esp + 0xb0], ax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x84]
push eax
push dword [0x5016218]
push ebx
push 0x20
push ebx
push ebx
push ebx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x50023d7
push 0xffffffffffffffff
call fcn.0500182f
cmp dword [0x5016330], ebx
jne 0x50023ec
push ebx
push dword [0x5016440]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x44]
push 0xffffffffffffffff
push eax
mov dword [0x5016324], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x34]
mov dword [0x5016324], ebx
push eax
mov dword [esp + 0x38], ebx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x48]
call esi
cmp dword [esp + 0x34], 0xcabf00d1
je 0x5002470
call fcn.0500138b
jmp 0x5002470
cmp dword [0x500620c], ebx
jne 0x5002470
push ebx
push dword [0x5016440]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
push ebp
push 0x20000002
push ebx
call edi
push 0x10030
push ebp
push ebp
push dword [0x5016440]
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]