Function at 0x3001cfbe
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1f0]
sub esp, 0x270
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp + 0x1ec], eax
call fcn.3000d430
push dword [ebp + 0x1f8]
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x20], bx
mov ecx, 0x82
lea edi, [ebp - 0x1e]
push 0x3000ba14
rep stosd dword es:[edi], eax
call fcn.300106d0
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 0x24], eax
je 0x3001d04c
push 0x3000b9c0
call fcn.300105be
push 0x3000b980
call fcn.300105be
mov dword [ebp - 0x24], 0x1f
push 0x3000b930
jmp 0x3001d1ca
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3000d622
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001d069
push 0x3000b8fc
jmp 0x3001d1ca
push 0x3000b220
lea ecx, [ebp - 0x2c]
call fcn.3000d701
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001d087
push 0x3000b8c8
jmp 0x3001d1ca
cmp dword [0x30077200], ebx
lea ecx, [ebp - 0x2c]
je 0x3001d099
push 0x3000b8b4
jmp 0x3001d09e
push 0x3000b8a0
call fcn.3000d701
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001d0b4
push 0x3000b86c
jmp 0x3001d1ca
push dword [ebp + 0x1f8]
lea ecx, [ebp - 0x2c]
call fcn.3000d701
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001d0d3
push 0x3000b83c
jmp 0x3001d1ca
cmp dword [ebp + 0x1fc], ebx
je 0x3001d133
push 0x30003be8
lea ecx, [ebp - 0x2c]
call fcn.3000d701
cmp eax, ebx
mov dword [ebp - 0x24], eax
jge 0x3001d101
push eax
push 0x30001420
call fcn.30010597
push 0x3000b800
jmp 0x3001d126
push dword [ebp + 0x1fc]
lea ecx, [ebp - 0x2c]
call fcn.3000d701
cmp eax, ebx
mov dword [ebp - 0x24], eax
jge 0x3001d133
push eax
push 0x30001420
call fcn.30010597
push 0x3000b7c4
call fcn.30010597
add esp, 0xc
jmp 0x3001d223
push 0x3000b770
call fcn.300105be
push dword [ebp - 0x2c]
call fcn.300105be
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x80]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x80], 0x44
push ebx
mov dword [ebp - 0x54], 0x40
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x3001d19a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001d193
push eax
push 0x3000b754
call fcn.30010642
push 0x3000b6f0
jmp 0x3001d20b
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jne 0x3001d1d2
call esi
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x3001d1d2
push 0x3000b6c8
call fcn.30010597
pop ecx
jmp 0x3001d223
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x3001d1ec
call esi
cmp eax, ebx
mov dword [ebp - 0x24], eax
jne 0x3001d223
mov eax, dword [ebp - 0x24]
sub eax, ebx
je 0x3001d223
sub eax, 0x64e
je 0x3001d220
sub eax, 0x1b
je 0x3001d219
sub eax, 0x559
je 0x3001d212
push 0x3000b670
call fcn.300105be
jmp 0x3001d223
push 0x3000b610
jmp 0x3001d20b
push 0x3000b5b0
jmp 0x3001d20b
mov dword [ebp - 0x24], ebx
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x2c]
call fcn.3000d43a
mov ecx, dword [ebp + 0x1ec]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.3001fd67
add ebp, 0x1f0
leave
ret 8