Function at 0x1002684
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xafc
or dword [ebp + 0x50], 0xffffffff
lea eax, [ebp - 0xa8c]
push esi
mov dword [ebp + 0x58], eax
xor eax, eax
push 0x8007
mov dword [ebp + 0x40], 4
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x48], eax
mov dword [ebp + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x10021d0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 2
pop esi
cmp dword [ebp + 0x78], esi
jl 0x1002b74
cmp dword [ebp + 0x78], 8
jg 0x1002b74
push ebx
mov ebx, dword [ebp + 0x7c]
push edi
push dword [ebx + 4]
call fcn.01002e44
pop ecx
mov dword [ebp + 0x3c], eax
xor eax, eax
mov ecx, 0x21a
lea edi, [ebp - 0xa8c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x78]
cmp edi, esi
jle 0x1002b72
lea eax, [ebx - 4]
mov dword [ebp + 0x6c], 3
mov dword [ebp + 0x68], 4
mov dword [ebp + 0x60], 5
mov dword [ebp + 0x64], eax
mov ecx, dword [ebx + esi*4]
cmp word [ecx], 0x2d
jne 0x10029ed
mov dx, word [ecx + 2]
movzx eax, dx
cmp eax, 0x64
jg 0x100291e
je 0x1002751
sub eax, 0x44
je 0x1002751
dec eax
jmp 0x1002921
cmp dword [ebp + 0x60], edi
jge 0x1002b63
cmp dword [ebp + 0x48], 0
jne 0x1002b63
cmp dword [ebp + 0x5c], 0
jne 0x1002b63
add dword [ebp + 0x64], 4
xor eax, eax
inc esi
inc dword [ebp + 0x60]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
mov ecx, 0x21a
lea edi, [ebp - 0xa8c]
rep stosd dword es:[edi], eax
push dword [ebx + esi*4]
mov dword [ebp + 0x5c], 2
call fcn.01002e44
inc esi
inc dword [ebp + 0x60]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
push 4
pop edi
add dword [ebp + 0x64], edi
mov dword [ebp - 0xa80], eax
push dword [ebx + esi*4]
call fcn.01002e44
add dword [ebp + 0x64], edi
inc esi
inc dword [ebp + 0x60]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebx + esi*4]
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x64]
mov eax, dword [eax]
mov ax, word [eax + 4]
cmp ax, 0x54
pop ecx
pop ecx
je 0x10028e7
cmp ax, 0x74
je 0x10028e7
cmp ax, 0x53
je 0x1002894
cmp ax, 0x73
je 0x1002894
cmp ax, 0x4d
je 0x1002814
cmp ax, 0x6d
jne 0x10029ed
mov eax, dword [ebp + 0x6c]
cmp eax, dword [ebp + 0x78]
jge 0x1002b63
push dword [ebp + 0x3c]
push 0
push 0x50
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [ebp + 0x54], eax
je 0x1002b72
add dword [ebp + 0x64], 4
inc esi
inc dword [ebp + 0x60]
push dword [ebx + esi*4]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
call fcn.01002e44
pop ecx
push 2
push 0
mov edi, eax
push 0
lea eax, [ebp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push edi
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1002b63
xor edi, edi
push edi
push edi
push edi
push 2
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
je 0x1002b63
mov dword [ebp + 0x58], eax
jmp 0x10029ed
mov eax, dword [ebp + 0x68]
cmp eax, dword [ebp + 0x78]
jge 0x1002b63
add dword [ebp + 0x64], edi
inc esi
inc dword [ebp + 0x60]
push dword [ebx + esi*4]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
call fcn.01002e44
add dword [ebp + 0x64], edi
inc esi
inc dword [ebp + 0x60]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
mov dword [ebp - 0xa7c], eax
push dword [ebx + esi*4]
call fcn.01002e44
pop ecx
pop ecx
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa78], 2
jmp 0x10029ed
mov eax, dword [ebp + 0x6c]
cmp eax, dword [ebp + 0x78]
jge 0x1002b63
add dword [ebp + 0x64], edi
inc esi
inc dword [ebp + 0x60]
inc dword [ebp + 0x68]
push dword [ebx + esi*4]
inc dword [ebp + 0x6c]
call fcn.01002e44
pop ecx
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xa78], 1
jmp 0x10029ed
sub eax, 0x65
je 0x10029ed
sub eax, 3
je 0x1002993
sub eax, 3
je 0x100293e
sub eax, 8
je 0x100293e
dec eax
dec eax
jne 0x1002b63
cmp dword [ebp + 0x5c], 0
jne 0x1002b63
mov ax, word [ecx + 4]
cmp ax, 0x47
mov dword [ebp + 0x5c], 3
je 0x1002963
cmp ax, 0x67
jne 0x1002a76
cmp dx, 0x4b
je 0x100298d
cmp dx, 0x6b
je 0x100298d
cmp dx, 0x55
je 0x1002984
cmp dx, 0x75
je 0x1002984
mov dword [ebp + 0x50], 2
jmp 0x10029ed
mov dword [ebp + 0x50], 1
jmp 0x10029ed
and dword [ebp + 0x50], 0
jmp 0x10029ed
cmp dword [ebp + 0x6c], edi
jge 0x1002b63
cmp dword [ebp + 0x5c], 0
jne 0x1002b63
add dword [ebp + 0x64], 4
inc esi
inc dword [ebp + 0x60]
push dword [ebx + esi*4]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
mov dword [ebp + 0x5c], 1
call fcn.01002e44
cmp edi, dword [ebp + 0x6c]
pop ecx
mov dword [ebp + 0x38], eax
jle 0x10029ed
add dword [ebp + 0x64], 4
inc esi
push dword [ebx + esi*4]
inc dword [ebp + 0x60]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp + 0x44], eax
mov edi, dword [ebp + 0x78]
add dword [ebp + 0x64], 4
inc esi
inc dword [ebp + 0x60]
inc dword [ebp + 0x68]
inc dword [ebp + 0x6c]
cmp esi, edi
jl 0x1002727
cmp dword [ebp + 0x5c], 0
je 0x1002b63
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x224]
push 0x10015ac
push eax
call fcn.01002dfe
pop ecx
pop ecx
push 0
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x1002b63
mov eax, dword [ebp + 0x5c]
dec eax
je 0x1002b3c
dec eax
je 0x1002b0f
dec eax
jne 0x1002b5c
push dword [ebp + 0x50]
push esi
call fcn.010022d0
jmp 0x1002b5c
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebx + esi*4]
mov ax, word [eax + 2]
cmp ax, 0x4b
je 0x1002ab7
cmp ax, 0x6b
je 0x1002ab7
cmp ax, 0x55
je 0x1002ab0
cmp ax, 0x75
je 0x1002ab0
push 0x100159c
jmp 0x1002abc
push 0x100158c
jmp 0x1002abc
push 0x100157c
lea eax, [ebp - 0x224]
push eax
call fcn.01002dfe
pop ecx
pop ecx
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x224]
push ecx
push eax
mov dword [ebp - 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1002b63
push dword [ebp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x28]
call esi
jmp 0x1002b63
cmp dword [ebp + 0x48], 0
je 0x1002b5c
push 0x100156c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002b5c
push dword [ebp + 0x58]
push dword [ebp + 0x48]
push dword [ebp + 0x3c]
call eax
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
jmp 0x1002b59
push 0x1001560
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002b5c
push dword [ebp + 0x44]
push 0
push dword [ebp + 0x38]
push dword [ebp + 0x3c]
call eax
mov dword [ebp + 0x40], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp + 0x54], 0
je 0x1002b72
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor esi, esi
cmp dword [ebp + 0x4c], esi
je 0x1002b84
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x44], esi
je 0x1002b92
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x58], esi
pop esi
je 0x1002bac
lea eax, [ebp - 0xa8c]
cmp dword [ebp + 0x58], eax
je 0x1002bac
push dword [ebp + 0x58]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp + 0x40]
add ebp, 0x70
leave
ret