Function at 0x5001db5
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Get common file path
Get disk information
Get disk size
Get file attributes
Terminate process

Disassembly:
sub esp, 0xbc
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], 0x5c3a63
mov byte [esp + 0x13], 0x63
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x5006628], eax
call fcn.050014c4
push 0x104
mov ebp, 0x5006520
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebp
jmp 0x5001e18
lea eax, [ecx - 1]
cmp byte [eax], 0x5c
je 0x5001e1c
mov ecx, eax
cmp ecx, ebp
ja 0x5001e0e
push ecx
call fcn.05001984
mov esi, eax
push ebp
mov dword [esp + 0x34], esi
call fcn.0500151d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, eax
mov dword [esp + 0x1c], ebp
xor ecx, ecx
mov al, byte [ebp]
cmp al, 0x20
je 0x5001e4b
cmp al, 9
je 0x5001e4b
cmp al, 0x22
jne 0x5001e55
cmp al, 0x22
jne 0x5001e52
xor ecx, ecx
inc ecx
inc ebp
jmp 0x5001e3c
cmp ecx, ebx
mov dword [esp + 0x1c], ebp
je 0x5001e73
cmp byte [ebp], bl
mov eax, ebp
je 0x5001e73
cmp byte [eax], 0x22
je 0x5001e70
inc eax
cmp byte [eax], bl
jne 0x5001e64
jmp 0x5001e73
mov byte [eax], 0x20
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebp - 1]
jmp 0x5001e94
mov cl, byte [eax]
cmp cl, 0x20
je 0x5001e91
cmp cl, 9
jne 0x5001e98
mov byte [eax], bl
dec eax
cmp eax, ebp
jae 0x5001e85
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
mov byte [0x5006738], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ebx
lea edx, [ecx + esi - 1]
jmp 0x5001eba
cmp byte [edx], 0x2e
je 0x5001ec0
dec edx
cmp edx, esi
ja 0x5001eb4
jmp 0x5001ee8
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x24], ecx
inc ecx
mov eax, ecx
shr ecx, 2
mov esi, edx
mov edi, 0x5006738
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edx], bl
cmp byte [ebp], bl
mov dword [esp + 0x38], 0x50010f0
mov dword [esp + 0x14], ebp
je 0x5002012
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov al, byte [eax]
mov cl, byte [ecx]
or al, 0x20
or cl, 0x20
cmp cl, al
jne 0x5001ff3
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x30]
jmp 0x5001f24
cmp al, bl
je 0x5001f3f
inc ebp
mov dl, byte [ebp]
inc esi
mov al, byte [esi]
mov cl, al
or cl, 0x20
or dl, 0x20
cmp cl, dl
je 0x5001f20
cmp al, bl
jne 0x5001ff3
cmp byte [ebp], 0x2e
mov dword [esp + 0x20], ebx
jne 0x5001f8a
cmp dword [esp + 0x24], ebx
jbe 0x5001f8a
xor edi, edi
cmp dword [esp + 0x24], ebx
mov dword [esp + 0x20], 1
jbe 0x5001f86
mov eax, ebp
sub eax, 0x5006738
lea esi, [edi + 0x5006738]
mov cl, byte [eax + esi]
mov dl, byte [esi]
or cl, 0x20
or dl, 0x20
cmp cl, dl
jne 0x5002005
inc edi
cmp edi, dword [esp + 0x24]
jb 0x5001f66
add ebp, dword [esp + 0x24]
mov al, byte [ebp]
cmp al, 0x20
je 0x5001f99
cmp al, 9
je 0x5001f99
cmp al, bl
jne 0x5001ff3
mov esi, dword [esp + 0x1c]
mov eax, ebp
sub eax, esi
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov edi, 0x5006410
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [esp + 0x20], ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x5006410]
mov byte [edi], bl
jne 0x5001fe4
mov ecx, dword [esp + 0x24]
mov edx, ecx
shr ecx, 2
mov esi, 0x5006738
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [eax + ecx + 0x5006410], bl
push 0x5006410
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x500200e
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp byte [eax], bl
jne 0x5001efd
jmp 0x5002012
mov dword [esp + 0x20], ebx
jmp 0x5001f8a
mov dword [esp + 0x38], ebp
mov ebp, dword [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x5002092
lea eax, [ecx - 2]
cmp eax, ebx
jbe 0x5002092
mov dword [esp + 0x1c], eax
mov edi, dword [ebp]
and edi, 0xffdffdff
xor esi, esi
or edi, 0x20000000
inc esi
cmp edi, 0x20582d20
jne 0x5002052
mov dword [0x5006004], esi
cmp edi, 0x3a582d20
jne 0x5002069
lea eax, [ebp + 4]
push eax
mov dword [0x5006004], esi
call fcn.05001478
cmp edi, 0x20552d20
jne 0x5002077
mov dword [0x5016840], esi
cmp edi, 0x20512d20
jne 0x500208b
mov dword [0x5006008], esi
mov dword [0x5016840], esi
inc ebp
dec dword [esp + 0x1c]
jne 0x5002032
mov eax, dword [0x50010d4]
and eax, 0xffff0000
cmp eax, 0xcab00000
jne 0x50020ad
push 0x20000001
jmp 0x50025f4
test byte [0x50010d7], 0x80
jne 0x50020c0
mov dword [0x5006004], 1
and byte [0x50010d7], 0x7f
cmp dword [0x5006008], ebx
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jne 0x5002159
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x500651c], eax
lea eax, [esp + 0x60]
push eax
push ebx
push ebx
push 0x50018af
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x5002107
push 8
jmp 0x50025f4
push 0xffffffffffffffff
push dword [0x500651c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x30]
push ebx
push 0xc
push 0x68
push dword [0x5006514]
call esi
mov eax, dword [0x50010d0]
add eax, 0xffff
shr eax, 0x10
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5006514]
call esi
push ebx
push 1
push 0x404
push 0x6a
push dword [0x5006514]
call esi
push ebx
push ebx
push 0x5006520
call fcn.050018f5
mov edi, dword [0x50010d0]
or dword [esp + 0x3c], 0xffffffff
add esp, 0xc
cmp edi, ebx
mov dword [esp + 0x20], eax
je 0x50020a3
mov ebp, 0x5006840
mov eax, 0x10000
cmp edi, eax
mov dword [esp + 0x14], edi
jbe 0x5002195
mov dword [esp + 0x14], eax
push dword [esp + 0x14]
push ebp
push dword [esp + 0x28]
call fcn.05001934
add esp, 0xc
push dword [esp + 0x14]
push ebp
push dword [esp + 0x38]
call fcn.050014ee
cmp dword [0x5006008], ebx
mov dword [esp + 0x30], eax
jne 0x50021d9
mov eax, dword [0x5006514]
cmp eax, ebx
je 0x5002317
push ebx
push ebx
push 0x405
push 0x6a
push eax
call esi
sub edi, dword [esp + 0x14]
jne 0x5002184
cmp dword [esp + 0x30], ebx
jne 0x50020a3
lea eax, [esp + 0x64]
push eax
push ebx
push fcn.050012bb
push 0x500129c
push 0x500195c
push fcn.05001934
push fcn.050018f5
push 0x5001289
push fcn.050018d7
call fcn.050026a2
push ebx
push ebx
push dword [esp + 0x4c]
mov dword [esp + 0x4c], eax
call fcn.050012bb
lea eax, [esp + 0xa0]
push eax
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.05002732
add esp, 0x3c
test eax, eax
je 0x50020a3
cmp dword [0x5006008], ebx
jne 0x500225b
push ebx
push dword [0x5006514]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x5006630], bl
mov edi, 0x5006630
je 0x5002284
push edi
call fcn.05001b83
test eax, eax
jne 0x5002278
mov byte [0x5006630], bl
cmp byte [0x5006630], bl
jne 0x50023e4
cmp dword [0x5016840], ebx
jne 0x5002298
cmp dword [0x5006004], ebx
jne 0x50023d8
push 0xffff
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [0x5006840]
or al, 0x20
mov byte [esp + 0x12], al
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x18], 0x61
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x50022d1
cmp eax, 6
jne 0x500233b
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x500233b
mov eax, dword [esp + 0x40]
imul eax, dword [esp + 0x44]
mul dword [esp + 0x48]
mov cl, byte [esp + 0x18]
cmp cl, byte [esp + 0x12]
mov ebp, edx
jne 0x5002321
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebp
jmp 0x500233b
push 0x4c7
jmp 0x50025f4
cmp ebp, dword [esp + 0x2c]
jb 0x500233b
ja 0x500232f
cmp eax, dword [esp + 0x28]
jbe 0x500233b
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x13], cl
inc byte [esp + 0x18]
cmp byte [esp + 0x18], 0x7a
jle 0x50022bc
mov eax, dword [0x50010d8]
cmp eax, 0xcab00eee
je 0x5002364
cmp dword [esp + 0x2c], ebx
ja 0x500238c
jb 0x5002364
cmp dword [esp + 0x28], eax
jae 0x500238c
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x2c], eax
ja 0x500238c
jb 0x500237a
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x30]
jae 0x500238c
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov al, byte [esp + 0x12]
mov dword [esp + 0x28], ecx
jmp 0x5002390
mov al, byte [esp + 0x13]
push edi
mov byte [esp + 0x1c], al
push 0x50010f4
lea eax, [esp + 0x20]
push eax
call fcn.0500122a
push eax
mov eax, dword [0x50010d0]
and eax, 0xffff
push eax
call fcn.050012e6
push edi
call fcn.05001b83
test eax, eax
jne 0x50023e4
push edi
mov byte [0x5006638], 0x5f
call fcn.05001b83
test eax, eax
jne 0x50023e4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [0x5016840], ebx
jne 0x50025f9
cmp dword [0x5006004], ebx
jne 0x5002418
mov eax, dword [0x50010d0]
push 3
pop ecx
mul ecx
cmp dword [esp + 0x2c], edx
ja 0x50025f9
jb 0x5002418
cmp dword [esp + 0x28], eax
jae 0x50025f9
push ebx
push 0x50019b9
push dword [0x5006514]
push 0x6b
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x50025f2
cmp eax, ebx
je 0x5002317
cmp byte [eax], bl
je 0x5002317
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x500244a
push edi
call fcn.05001b83
test eax, eax
je 0x5002418
cmp dword [0x5006008], ebx
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov ebp, 0x5006738
jne 0x50024ff
push 0x104
push ebp
push 0x20000004
push ebx
call edi
push 0x104
push 0x5006410
push 0x20000006
push ebx
call edi
push ebp
push ebx
push 0xc
push 0x65
push dword [0x5006514]
call esi
push 0x5006410
push ebx
push 0xc
push 0x66
push dword [0x5006514]
call esi
push 0x5006630
push ebx
push 0xc
push 0x69
push dword [0x5006514]
call esi
push ebx
push ebx
push 0x402
push 0x6a
push dword [0x5006514]
call esi
movzx eax, word [esp + 0x76]
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5006514]
call esi
push 5
push dword [0x5006514]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x5001bf9
push ebx
push 0x50010f0
push 0x5006520
push dword [esp + 0x34]
call fcn.050027be
add esp, 0x1c
test eax, eax
je 0x50020a3
mov ecx, dword [0x5016840]
cmp ecx, ebx
mov eax, dword [0x5006514]
jne 0x500253c
cmp eax, ebx
je 0x5002317
cmp dword [0x500662c], ebx
je 0x500266e
cmp dword [0x5006004], ebx
jne 0x500266e
cmp dword [0x5006008], ebx
jne 0x500256a
push dword [0x5006518]
push ebx
push 0xc
push 0x68
push eax
call esi
mov eax, dword [0x500662c]
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x5002573
mov edi, dword [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
push 0x11
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
inc eax
mov dword [esp + 0xb4], eax
mov word [esp + 0xb8], ax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x8c]
push eax
push dword [0x5016844]
mov dword [esp + 0x94], 0x44
push ebx
push 0x20
push ebx
push ebx
push ebx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x500260b
push 0xffffffffffffffff
call fcn.05001830
push edi
call fcn.05001b83
test eax, eax
jne 0x500245e
push 0x52
jmp 0x50025f4
cmp dword [0x5006008], ebx
jne 0x5002620
push ebx
push dword [0x5006514]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x4c]
push 0xffffffffffffffff
push eax
mov dword [0x5006624], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x50]
mov dword [0x5006624], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x50]
call esi
cmp dword [esp + 0x3c], 0xcabf00d1
je 0x500269b
call fcn.05001395
jmp 0x500269b
cmp ecx, ebx
jne 0x500269b
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
push ebp
push 0x20000002
push ebx
call edi
push 0x10030
push ebp
push ebp
push dword [0x5006514]
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]