Function at 0x10002070
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b19a
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2d4
mov eax, dword [0x10082998]
xor eax, ebp
mov dword [ebp - 0x38], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c4], ecx
mov ecx, dword [ebp - 0x2c4]
call fcn.100015c0
lea ecx, [ebp - 0x28]
call fcn.1000ba10
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ecx + 0x74]
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], 0
jne 0x100020f1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000bc70
jmp 0x10002488
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.10010c3c
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x10002479
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.1000f440
add esp, 8
test eax, eax
jne 0x10002132
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000bc70
jmp 0x10002488
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call fcn.1000bcc0
add esp, 8
mov byte [ebp - 4], 1
push 0x104
push 0
lea edx, [ebp - 0x140]
push edx
call fcn.10037bd0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x248]
push eax
call fcn.10037bd0
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x100021ae
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10003660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000bc70
jmp 0x10002488
lea edx, [ebp - 0x248]
push edx
push 0
push 0x1004eb20
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x100021f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10003660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000bc70
jmp 0x10002488
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x26c]
call fcn.10003300
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 4], 3
mov edx, 0x1004eb18
test edx, edx
jne 0x10002225
mov dword [ebp - 0x290], 0
jmp 0x10002238
push 0x1004eb18
call fcn.10037b40
add esp, 4
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
push eax
push 0x1004eb18
lea ecx, [ebp - 0x26c]
call fcn.10002eb0
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x294], ecx
push 0x1001
mov edx, dword [ebp - 0x294]
push edx
lea ecx, [ebp - 0x268]
call fcn.1001a25b
mov dword [ebp - 0x2cc], eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24c]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x298], ecx
mov edx, dword [ebp - 0x298]
push edx
mov eax, dword [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x268]
call fcn.100194bd
lea ecx, [ebp - 0x268]
call fcn.100197c4
push 1
push 0
push 0
mov ecx, dword [ebp - 0x26c]
push ecx
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0x7c
lea ecx, [ebp - 0x274]
call fcn.100025d0
mov dword [ebp - 0x2d0], eax
mov edx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2d4], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x26c]
push ecx
lea edx, [ebp - 0x278]
push edx
call fcn.10002aa0
add esp, 0xc
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x248]
push ecx
mov edx, dword [ebp - 0x2dc]
push edx
lea eax, [ebp - 0x258]
push eax
call fcn.10002b80
add esp, 0xc
mov dword [ebp - 0x2e0], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x278]
call fcn.10003660
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x274]
call fcn.10003660
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
push eax
call fcn.10010b5a
add esp, 4
mov dword [ebp - 0x2e4], eax
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
mov dword [ebp - 0x270], edx
mov eax, dword [ebp - 0x250]
push eax
push 0
mov ecx, dword [ebp - 0x270]
push ecx
call fcn.10037bd0
add esp, 0xc
mov edx, dword [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x270]
push ecx
call fcn.100377d0
add esp, 0xc
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x270]
push edx
push 0x100024b0
call fcn.1001afe0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x258]
call fcn.10003660
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x268]
call fcn.10019b28
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x26c]
call fcn.10003660
jmp 0x10002441
mov dword [ebp - 4], 1
jmp 0x1000246a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.10003660
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000bc70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.10037761
mov esp, ebp
pop ebp
ret