Function at 0x1001b78
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push 0x508
push 0x1001220
call fcn.0100227c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
xor esi, esi
inc esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edi, dword [ebp + 8]
mov dword [0x1005660], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x100565c], eax
push ebx
push esi
push edi
call fcn.010027e9
push 0x104
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1001c4d
push 0x1001204
lea eax, [ebp - 0x258]
push eax
push ebx
call fcn.01002679
mov dword [0x1005528], eax
push ebx
push eax
call fcn.010022f4
test eax, eax
je 0x1001c32
push 0x80000000
push dword [0x1005528]
call fcn.0100164d
test eax, eax
mov dword [0x1005518], esi
jne 0x1001c38
mov dword [0x1005518], ebx
push 0x10011ec
lea eax, [ebp - 0x258]
push eax
push ebx
call fcn.01002679
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x26f], 8
je 0x1001c9f
push ebx
push dword [ebp - 0x290]
call fcn.01002474
mov dword [0x100552c], eax
push ebx
push eax
call fcn.010022f4
test eax, eax
je 0x1001c99
push 0xc0000000
push dword [0x100552c]
call fcn.0100164d
test eax, eax
mov dword [0x1005520], esi
jne 0x1001c9f
mov dword [0x1005520], ebx
cmp dword [ebp - 0x38], ebx
je 0x1001f67
mov dword [ebp - 4], ebx
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x38]
call fcn.01002378
mov dword [ebp - 0x3c], eax
cmp eax, ebx
je 0x1001f0f
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_atoi]
pop ecx
dec eax
mov dword [ebp - 0x2a0], eax
js 0x1001f0f
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x2a4], eax
mov eax, dword [eax]
add eax, ecx
mov dword [ebp - 0x1c], eax
push ebx
push eax
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
call edi
push 2
pop esi
add eax, esi
mov dword [ebp - 0x20], eax
push ebx
push eax
call edi
add eax, esi
mov dword [ebp - 0x24], eax
push ebx
push eax
call edi
add eax, esi
mov dword [ebp - 0x28], eax
push ebx
push eax
call edi
add eax, esi
mov dword [ebp - 0x2c], eax
push ebx
push eax
call edi
add esp, 0x28
mov esi, eax
inc esi
inc esi
mov dword [ebp - 0x2a8], esi
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
push 4
pop eax
add esi, eax
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi]
mov dword [ebp - 0x34], ecx
add esi, eax
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi]
mov dword [section..data], ecx
add esi, eax
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi]
mov dword [0x1005004], ecx
add esi, eax
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi]
mov dword [ebp - 0x2b0], ecx
add esi, eax
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi]
mov dword [ebp - 0x2ac], ecx
add esi, eax
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x48], ebx
cmp word [esi], bx
je 0x1001e65
cmp dword [ebp - 0x48], ebx
jne 0x1001e04
push ebx
push dword [ebp - 0x20]
call fcn.01002474
mov dword [ebp - 0x2b8], eax
push eax
call fcn.01002632
mov dword [ebp - 0x2bc], eax
cmp eax, ebx
je 0x1001dc5
mov word [eax], bx
push esi
push dword [ebp - 0x2b8]
push ebx
call fcn.01002679
mov dword [ebp - 0x2c0], eax
lea ecx, [ebp - 0x510]
push ecx
push eax
call fcn.010022f4
test eax, eax
jne 0x1001dec
mov dword [ebp - 0x48], ebx
push dword [ebp - 0x2c0]
push ebx
call fcn.010024ab
push dword [ebp - 0x2b8]
push ebx
call fcn.010024ab
push ebx
push esi
call edi
pop ecx
pop ecx
inc eax
inc eax
mov esi, eax
mov dword [ebp - 0x2a8], esi
mov eax, dword [esi]
mov dword [ebp - 0x518], eax
add esi, 4
mov dword [ebp - 0x2a8], esi
mov ecx, dword [esi]
mov dword [ebp - 0x514], ecx
add esi, 4
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2b4], esi
cmp dword [ebp - 0x48], ebx
jne 0x1001d95
cmp dword [ebp - 0x4fc], eax
jne 0x1001e59
cmp dword [ebp - 0x4f8], ecx
je 0x1001d95
mov dword [ebp - 0x48], 1
jmp 0x1001d95
push ebx
push dword [ebp - 0x1c]
call fcn.01002474
mov dword [ebp - 0x1c], eax
push ebx
push dword [ebp - 0x20]
call fcn.01002474
mov dword [ebp - 0x20], eax
push ebx
push dword [ebp - 0x24]
call fcn.01002474
mov dword [ebp - 0x24], eax
push ebx
push dword [ebp - 0x28]
call fcn.01002474
mov dword [ebp - 0x28], eax
push ebx
push dword [ebp - 0x2c]
call fcn.01002474
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x510]
push eax
push dword [ebp - 0x20]
call fcn.010022f4
mov dword [0x100551c], eax
cmp dword [0x1005520], ebx
je 0x1001ec6
cmp eax, ebx
je 0x1001ec6
xor ecx, ecx
inc ecx
jmp 0x1001ec8
xor ecx, ecx
mov dword [0x1005524], ecx
cmp dword [ebp - 0x48], ebx
jne 0x1001efb
mov ecx, dword [ebp - 0x2b0]
cmp dword [ebp - 0x4fc], ecx
jne 0x1001eef
mov ecx, dword [ebp - 0x2ac]
cmp dword [ebp - 0x4f8], ecx
je 0x1001ef6
mov dword [ebp - 0x48], 1
cmp dword [ebp - 0x48], ebx
je 0x1001f04
cmp eax, ebx
je 0x1001f04
xor eax, eax
inc eax
jmp 0x1001f06
xor eax, eax
mov dword [ebp - 0x48], eax
xor esi, esi
inc esi
mov edi, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
jmp 0x1001f54
cmp dword [ebp - 0x3c], ebx
je 0x1001f67
push dword [ebp - 0x44]
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
call fcn.010023fb
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x1001f79
cmp word [eax], bx
je 0x1001f79
push dword [ebp - 0x30]
push eax
jmp 0x1001f7f
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call fcn.01001600
cmp dword [ebp - 0x48], ebx
je 0x1001f97
mov dword [0x100550c], esi
mov dword [0x1005510], esi
jmp 0x1001fd4
mov eax, dword [section..data]
dec eax
je 0x1001fc4
sub eax, 5
je 0x1001fc4
push ebx
push 0x100181b
push ebx
dec eax
je 0x1001fc0
dec eax
je 0x1001fbc
dec eax
je 0x1001fb8
push 0x67
jmp 0x1001fcd
push 0x6b
jmp 0x1001fcd
push 0x6a
jmp 0x1001fcd
push 0x69
jmp 0x1001fcd
push ebx
push 0x100181b
push ebx
push 0x68
push edi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [0x100550c], ebx
je 0x1001ffb
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
dec eax
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [0x100552c]
call fcn.0100167e
cmp dword [0x1005510], ebx
je 0x1002016
push 0xa
push dword [ebp - 0x28]
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x1005508], ebx
je 0x100202a
push dword [0x100552c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x2c], ebx
je 0x1002038
push dword [ebp - 0x2c]
push ebx
call fcn.010024ab
cmp dword [ebp - 0x28], ebx
je 0x1002046
push dword [ebp - 0x28]
push ebx
call fcn.010024ab
cmp dword [ebp - 0x24], ebx
je 0x1002054
push dword [ebp - 0x24]
push ebx
call fcn.010024ab
cmp dword [ebp - 0x20], ebx
je 0x1002062
push dword [ebp - 0x20]
push ebx
call fcn.010024ab
cmp dword [ebp - 0x1c], ebx
je 0x1002070
push dword [ebp - 0x1c]
push ebx
call fcn.010024ab
mov eax, dword [0x100552c]
cmp eax, ebx
je 0x1002086
push eax
push ebx
call fcn.010024ab
mov dword [0x100552c], ebx
cmp dword [ebp - 0x38], ebx
je 0x1002094
push dword [ebp - 0x38]
push ebx
call fcn.010024ab
mov eax, dword [0x1005528]
cmp eax, ebx
je 0x10020a4
push eax
push ebx
call fcn.010024ab
push ebx
push ebx
push edi
call fcn.010027e9
xor eax, eax
call fcn.010022b5
ret 0x10