Function at 0x1001d3e
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb18
mov eax, dword [0x1003070]
or dword [ebp - 0xab0], 0xffffffff
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xa8c]
push esi
mov dword [ebp - 0xaa4], eax
xor eax, eax
push 0x8007
mov dword [ebp - 0xac0], 4
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xaa0], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x10016ac
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 2
pop esi
cmp dword [ebp + 8], esi
jl 0x10023a7
cmp dword [ebp + 8], 8
jg 0x10023a7
push edi
push dword [ebx + 4]
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [ebp - 0xabc], eax
xor eax, eax
mov ecx, 0x220
lea edi, [ebp - 0xa8c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
cmp edi, esi
jle 0x10023a6
lea eax, [ebx - 4]
mov dword [ebp - 0xa90], 3
mov dword [ebp - 0xa98], 4
mov dword [ebp - 0xa9c], 5
mov dword [ebp - 0xa94], eax
mov ecx, dword [ebx + esi*4]
cmp word [ecx], 0x2d
jne 0x10021a8
mov dx, word [ecx + 2]
movzx eax, dx
cmp eax, 0x64
jg 0x1002096
je 0x1001e3b
sub eax, 0x44
je 0x1001e3b
dec eax
jmp 0x1002099
cmp dword [ebp - 0xa9c], edi
jge 0x1002391
cmp dword [ebp - 0xab4], 0
jne 0x1002391
cmp dword [ebp - 0xaa0], 0
jne 0x1002391
add dword [ebp - 0xa94], 4
xor eax, eax
inc esi
inc dword [ebp - 0xa9c]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
mov ecx, 0x220
lea edi, [ebp - 0xa8c]
rep stosd dword es:[edi], eax
push dword [ebx + esi*4]
mov edi, dword [sym.imp.msvcrt.dll__wtol]
mov dword [ebp - 0xaa0], 2
call edi
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
mov dword [ebp - 0xa80], eax
push dword [ebx + esi*4]
call edi
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebx + esi*4]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xa94]
mov eax, dword [eax]
mov ax, word [eax + 4]
cmp ax, 0x54
pop ecx
pop ecx
je 0x1002052
cmp ax, 0x74
je 0x1002052
cmp ax, 0x53
je 0x1001fe8
cmp ax, 0x73
je 0x1001fe8
cmp ax, 0x4d
je 0x1001f33
cmp ax, 0x6d
jne 0x10021a8
mov eax, dword [ebp - 0xa90]
cmp eax, dword [ebp + 8]
jge 0x1002391
push dword [ebp - 0xabc]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp - 0xaa8], eax
je 0x10023a6
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
push dword [ebx + esi*4]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
call edi
mov edi, eax
neg eax
sbb eax, eax
and eax, 0x7ff8ffa9
add eax, 0x80070057
pop ecx
js 0x1002391
push 2
push 0
push 0
lea eax, [ebp - 0xab8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push edi
push dword [ebp - 0xaa8]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1002391
xor edi, edi
push edi
push edi
push edi
push 2
push dword [ebp - 0xab8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
je 0x1002391
mov dword [ebp - 0xaa4], eax
jmp 0x10021a8
mov eax, dword [ebp - 0xa98]
cmp eax, dword [ebp + 8]
jge 0x1002391
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
push dword [ebx + esi*4]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
call edi
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
mov dword [ebp - 0xa7c], eax
push dword [ebx + esi*4]
call edi
pop ecx
pop ecx
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa78], 2
jmp 0x10021a8
mov eax, dword [ebp - 0xa90]
cmp eax, dword [ebp + 8]
jge 0x1002391
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
inc dword [ebp - 0xa98]
push dword [ebx + esi*4]
inc dword [ebp - 0xa90]
call edi
pop ecx
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xa78], 1
jmp 0x10021a8
sub eax, 0x65
je 0x10021a8
sub eax, 3
je 0x1002123
sub eax, 3
je 0x10020b6
sub eax, 8
je 0x10020b6
dec eax
dec eax
jne 0x1002391
cmp dword [ebp - 0xaa0], 0
jne 0x1002391
mov ax, word [ecx + 4]
cmp ax, 0x47
mov dword [ebp - 0xaa0], 3
je 0x10020e1
cmp ax, 0x67
jne 0x1002257
cmp dx, 0x4b
je 0x1002117
cmp dx, 0x6b
je 0x1002117
cmp dx, 0x55
je 0x1002108
cmp dx, 0x75
je 0x1002108
mov dword [ebp - 0xab0], 2
jmp 0x10021a8
mov dword [ebp - 0xab0], 1
jmp 0x10021a8
and dword [ebp - 0xab0], 0
jmp 0x10021a8
cmp dword [ebp - 0xa90], edi
jge 0x1002391
cmp dword [ebp - 0xaa0], 0
jne 0x1002391
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
push dword [ebx + esi*4]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
mov dword [ebp - 0xaa0], 1
call dword [sym.imp.msvcrt.dll__wtol]
cmp edi, dword [ebp - 0xa90]
pop ecx
mov dword [ebp - 0xac4], eax
jle 0x10021a8
add dword [ebp - 0xa94], 4
inc esi
push dword [ebx + esi*4]
inc dword [ebp - 0xa9c]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0xaac], eax
mov edi, dword [ebp + 8]
add dword [ebp - 0xa94], 4
inc esi
inc dword [ebp - 0xa9c]
inc dword [ebp - 0xa98]
inc dword [ebp - 0xa90]
cmp esi, edi
jl 0x1001e11
cmp dword [ebp - 0xaa0], 0
je 0x1002391
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push 0x1001574
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
neg eax
sbb eax, eax
mov edi, 0x7ff8ffa9
and eax, edi
mov esi, 0x80070057
add eax, esi
js 0x1002386
mov eax, dword [ebp - 0xaa0]
dec eax
je 0x1002352
dec eax
je 0x100230a
dec eax
jne 0x1002386
push dword [ebp - 0xab0]
push ebx
call fcn.0100189f
jmp 0x1002386
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebx + esi*4]
mov ax, word [eax + 2]
cmp ax, 0x4b
je 0x1002298
cmp ax, 0x6b
je 0x1002298
cmp ax, 0x55
je 0x1002291
cmp ax, 0x75
je 0x1002291
push 0x1001564
jmp 0x100229d
push 0x1001554
jmp 0x100229d
push 0x1001544
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0xb18]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xad4]
push eax
lea eax, [ebp - 0xb18]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov dword [ebp - 0xb18], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1002391
push dword [ebp - 0xad0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xad4]
call esi
jmp 0x1002391
mov eax, dword [ebp - 0xab4]
neg eax
sbb eax, eax
and eax, edi
add eax, esi
js 0x1002386
push 0x1001534
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
add ecx, esi
js 0x1002386
push dword [ebp - 0xaa4]
push dword [ebp - 0xab4]
push dword [ebp - 0xabc]
call eax
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
jmp 0x1002380
push 0x1001528
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
add ecx, esi
js 0x1002386
push dword [ebp - 0xaac]
push 0
push dword [ebp - 0xac4]
push dword [ebp - 0xabc]
call eax
mov dword [ebp - 0xac0], eax
test ebx, ebx
je 0x1002391
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xaa8], 0
je 0x10023a6
push dword [ebp - 0xaa8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor esi, esi
cmp dword [ebp - 0xab8], esi
je 0x10023bd
push dword [ebp - 0xab8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xaac], esi
je 0x10023d1
push dword [ebp - 0xaac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xaa4], esi
pop esi
pop ebx
je 0x10023f5
lea eax, [ebp - 0xa8c]
cmp dword [ebp - 0xaa4], eax
je 0x10023f5
push dword [ebp - 0xaa4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xac0]
jmp section..htext