Function at 0x10005b9c
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Query environment variable
Set current directory
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3a4
push esi
push edi
push ebx
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
test dword [esi + 0xd], 0x20
je 0x10005bc0
call fcn.100040cf
lea edi, [esi + 0x421]
push 0x400
lea eax, [ebp - 0x405]
push eax
push edi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push 0x400
push 0x1000d911
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push esi
mov esi, 0x1000d911
mov bl, 0
jmp 0x10005c16
lodsb al, byte [esi]
cmp al, 0x25
jne 0x10005c16
push 0x1000d911
call fcn.10006ea0
push eax
push 0x1000d911
call sub.KERNEL32.DLL_lstrcpyA
mov bl, 1
jmp 0x10005c1b
cmp byte [esi], 0
jne 0x10005bf8
pop esi
mov edi, 0x1000d911
cmp byte [edi + 1], 0x3a
je 0x10005c76
push 0x400
lea eax, [ebp - 0x405]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
lea eax, [ebp - 0x405]
push eax
call fcn.1000226a
cmp byte [edi], 0x5c
je 0x10005c5c
push 0x1000d7a9
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcatA
push edi
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 0x405]
push eax
push edi
call sub.KERNEL32.DLL_lstrcpyA
push 0x400
push 0x1001e645
push 5
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001e645
call sym.dup2patcher.dll_AddMsg
push edi
call sym.dup2patcher.dll_AddMsg
cmp bl, 1
je 0x10005cab
test dword [esi + 0xd], 1
je 0x10005cf8
cmp byte [0x1000e95c], 0
jne 0x10005cee
push edi
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x405]
push eax
call fcn.1000226a
push edi
call fcn.10006ea0
push eax
push dword [0x1000d8a6]
lea eax, [ebp - 0x405]
push eax
push 0x1000d7ab
push edi
call fcn.10007100
jmp 0x10005cf0
xor eax, eax
test al, al
je 0x1000602e
mov byte [ebp - 5], 0
push edi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x10005dc3
test dword [esi + 0xd], 0x10
je 0x10005d16
jmp 0x10005d65
cmp byte [0x1000e95c], 0
jne 0x10005d4b
push 0x400
push 0x1001ea45
push 0x29
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x24
push edi
push 0x1001ea45
push dword [0x1000d8a6]
call sub.user32.dll_MessageBoxA
jmp 0x10005d60
cmp byte [0x1000e95e], 1
jne 0x10005d5b
mov eax, 6
jmp 0x10005d60
mov eax, 7
cmp eax, 6
jne 0x10005d9d
mov byte [ebp - 5], 1
push edi
call fcn.10002313
push 0x80
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
push 0x400
push 0x1001ee45
push 0x2a
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001ee45
call sym.dup2patcher.dll_AddMsg
jmp 0x10005dc3
push 0x400
push 0x1001f245
push 0x2b
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001f245
call sym.dup2patcher.dll_AddMsg
jmp 0x1000602e
cmp byte [edi + 1], 0x3a
jne 0x10005df4
cmp byte [edi + 2], 0x5c
jne 0x10005df4
push edi
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x405]
push eax
call fcn.1000226a
lea eax, [ebp - 0x405]
push eax
call fcn.10007170
mov eax, dword [esi + 5]
lea eax, [eax + esi]
push dword [esi + 1]
push eax
push edi
call sym.dup2patcher.dll_write_disk_file
or eax, eax
jne 0x10005e3d
push edi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x1000602e
push 0x400
push 0x1001f645
push 0x2b
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001f645
call sym.dup2patcher.dll_AddMsg
jmp 0x1000602e
mov eax, dword [esi + 9]
or eax, eax
je 0x10005e71
push eax
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
cmp eax, 1
jne 0x10005e71
push 0x400
push 0x1001fa45
push 0x2c
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001fa45
call sym.dup2patcher.dll_AddMsg
test dword [esi + 0xd], 2
je 0x10006006
push 0x400
push 0x1001fe45
push 0x2d
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001fe45
call sym.dup2patcher.dll_AddMsg
cmp byte [edi + 1], 0x3a
jne 0x10005eca
push edi
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x405]
push eax
call fcn.1000226a
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
lea ebx, [esi + 0x21]
cmp byte [ebx], 0
jne 0x10005ed6
xor ebx, ebx
jmp 0x10005eee
push 0x400
lea eax, [ebp - 0x805]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea ebx, [ebp - 0x805]
test dword [esi + 0xd], 4
je 0x10005fc4
push 0x44
lea eax, [ebp - 0xc4c]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x10
lea eax, [ebp - 0xc5c]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0x1000d7bc
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcpyA
cmp byte [edi + 1], 0x3a
je 0x10005f63
lea eax, [ebp - 0xc05]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0xc05]
push eax
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0x1000d7c0
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcatA
push edi
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0x1000d7c2
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcatA
push ebx
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 0xc5c]
push eax
lea eax, [ebp - 0xc4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x405]
push eax
push edi
call sub.KERNEL32.DLL_CreateProcessA
push 0xffffffffffffffff
push dword [ebp - 0xc5c]
call sub.KERNEL32.DLL_WaitForSingleObject
jmp 0x10005fd6
push 0xa
push 0
push ebx
push edi
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
test dword [esi + 0xd], 8
je 0x10006006
push 0x400
push 0x10020245
push 0x2e
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10020245
call sym.dup2patcher.dll_AddMsg
push edi
call sub.KERNEL32.DLL_DeleteFileA
push 0x400
push 0x10020645
push 0x2f
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10020645
call sym.dup2patcher.dll_AddMsg
mov dword [ebp - 4], 1
cmp byte [ebp - 5], 0
je 0x1000603c
push dword [ebp - 4]
call fcn.10002368
push edi
push str.dup2_last_file
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push edi
lea eax, [ebp - 0x405]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x405]
push eax
call fcn.1000226a
lea eax, [ebp - 0x405]
push eax
push str.dup2_last_path
call sub.KERNEL32.DLL_SetEnvironmentVariableA
test dword [esi + 0xd], 0x20
je 0x1000607f
call fcn.100040fa
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 4