Function at 0x1002cbda
Capabilities:
Create directory
Create process on windows
Enumerate gui resources
Get common file path

Disassembly:
sub esp, 0xb94
mov eax, dword [0x102bff3c]
xor eax, esp
mov dword [esp + 0xb90], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002cc15
test byte [eax + 0x1c], 1
je 0x1002cc15
push 0x10238268
push 0x49
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
push ebx
push ebp
push esi
push edi
call fcn.1019a5d0
xor ebx, ebx
mov edi, eax
push ebx
push 0x15
call fcn.1002a528
pop ecx
push eax
push ebx
push 0x10237cc8
push 0x10237cec
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebp, ebx
call fcn.1019a8a0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x1002cc9b
test edi, edi
je 0x1002cc5a
push 0xbb8
jmp 0x1002cc99
mov esi, 0x4e20
and dword [0x102cb090], ebp
push 0
push 0x1002c9cf
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x1002cc7e
cmp dword [0x102cb090], ebp
jne 0x1002cc8b
push 0x64
call ebx
sub esi, 0x64
test esi, esi
jg 0x1002cc5f
jmp 0x1002cc94
xor ebp, ebp
inc ebp
sub esi, 0x4268
test esi, esi
jle 0x1002cc9b
push esi
call ebx
xor bl, bl
xor bh, bh
test edi, edi
jne 0x1002ce5a
test ebp, ebp
jne 0x1002ce5a
and dword [esp + 0x2c], ebp
xor eax, eax
or dword [esp + 0x34], 0xffffffff
inc eax
and dword [esp + 0x20], ebp
and dword [esp + 0x24], ebp
push 0xf
pop edi
push 0x23
push 0x42
mov word [esp + 0x30], di
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x1002ccfc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
inc bl
jmp 0x1002ce5a
xor ebp, ebp
mov dword [eax], 0x14
push 0x10237b4c
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0x10], ebp
add eax, 0x14
push edi
push eax
call fcn.101dfa72
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x14]
mov dword [esp + 0x20], esi
push eax
push 1
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.1002860a
add esp, 0x10
test eax, eax
jne 0x1002ce46
push 0x10237cf8
lea ecx, [esp + 0x80]
call fcn.1000f4e0
push str..gadget_shellopenDropTarget
lea ecx, [esp + 0x68]
call fcn.1000f4e0
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x44]
push connect
push eax
call fcn.1002ca48
add esp, 0x10
lea ecx, [esp + 0x64]
push ebp
push 1
call fcn.10011560
push ebp
push 1
lea ecx, [esp + 0x84]
call fcn.10011560
cmp dword [esp + 0x4c], ebp
jne 0x1002cdbe
mov edi, str.6B9228DA_9C15_419e_856C_19E768A13BDC
push edi
call fcn.10010cd0
pop ecx
push eax
push edi
lea ecx, [esp + 0x44]
call fcn.10011260
cmp dword [esp + 0x50], 8
lea ecx, [esp + 0x54]
lea eax, [esp + 0x3c]
cmovae eax, dword [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jne 0x1002ce36
lea eax, [esp + 0x10]
push eax
push 0x10238278
push 3
push ebp
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1002ce28
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push ebp
push ebp
push ebp
push dword [esp + 0x24]
mov dword [esp + 0x2c], ebp
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1002ce2a
mov bl, 1
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1002ce38
mov bl, 1
push ebp
push 1
lea ecx, [esp + 0x44]
call fcn.10011560
jmp 0x1002ce48
mov bl, 1
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ole32.dll_ReleaseStgMedium]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, 0xc8
and dword [0x102cb090], 0
push 0
push 0x1002c9cf
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x1002ceac
cmp dword [0x102cb090], 0
je 0x1002cea0
mov bh, 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esp + 0xba8]
jne 0x1002ce9d
push dword [0x102cb090]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
inc esi
jmp 0x1002cea4
test bh, bh
jne 0x1002ceb5
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x1002ce5f
test bh, bh
je 0x1002cebd
test bl, bl
je 0x1002cfce
mov esi, 0x400
lea eax, [esp + 0x3a0]
push esi
push eax
call fcn.101e33da
push 0x10237d90
lea eax, [esp + 0x3ac]
push esi
push eax
call fcn.101df824
add esp, 0x14
lea eax, [esp + 0x98]
lea ecx, [esp + 0x94]
mov dword [esp + 0x94], eax
push 3
push 0x10237b4c
call fcn.1002dc5b
push dword [esp + 0x94]
lea eax, [esp + 0x3a4]
push esi
push eax
call fcn.101df824
push 0x208
xor ebx, ebx
lea eax, [esp + 0x1a8]
push ebx
push eax
call fcn.101d1720
add esp, 0x18
lea eax, [esp + 0x198]
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1002cfb1
lea eax, [esp + 0x198]
push eax
call fcn.10010cd0
pop ecx
push eax
lea eax, [esp + 0x19c]
mov esi, 0x102bb188
push eax
mov ecx, esi
call fcn.10011260
mov edi, str.MicrosoftWindows_SidebarGadgetsDTUltra.gadget_
push edi
call fcn.10010cd0
pop ecx
push eax
push edi
mov ecx, esi
call fcn.1002211c
cmp dword [0x102bb19c], 8
cmovae esi, dword [0x102bb188]
push esi
call fcn.101e33f6
pop ecx
test eax, eax
jne 0x1002cfb1
push ebx
push 0x1002cb5e
push ebx
lea eax, [esp + 0x3ac]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
lea eax, [esp + 0x98]
cmp dword [esp + 0x94], eax
je 0x1002cfce
push dword [esp + 0x94]
call fcn.101d0c16
pop ecx
mov eax, dword [section..data]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, section..data
je 0x1002cff9
test byte [eax + 0x1c], 1
je 0x1002cff9
push 0x10238268
push 0x4a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
mov ecx, dword [esp + 0xb90]
xor ecx, esp
call fcn.101b70aa
add esp, 0xb94
ret