Function at 0x100692f
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x284
mov eax, 0x100c580
call fcn.01008aa8
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24c], ebx
lea edi, [ebp - 0x248]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x28c]
push ebx
push eax
mov dword [ebp - 0x290], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1006a09
cmp dword [0x100e144], ebx
je 0x1006bae
mov al, byte [0x100e148]
cmp al, 4
jae 0x10069b7
cmp al, bl
jne 0x1006bae
mov ecx, dword [0x100e134]
mov esi, 0x40000000
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006bae
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006bae
cmp eax, ecx
jne 0x1006bae
push 0x10012e8
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005dcc
jmp 0x1006bae
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.01006903
push 0x10014b0
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], ebx
call fcn.010068a9
call dword [sym.imp.ntdll.dll_NtIsUILanguageComitted]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
je 0x1006aae
cmp dword [0x100e144], ebx
je 0x1006b7a
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006a5c
cmp al, bl
jne 0x1006b7a
mov ecx, dword [0x100e134]
mov esi, 0x40000000
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006b7a
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006b7a
cmp eax, ecx
jne 0x1006b7a
push 0x10012a8
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005dcc
jmp 0x1006b7a
push 0x10014a8
call dword [sym.imp.msvcrt.dll__wcsdup]
pop ecx
mov dword [ebp - 0x23c], eax
cmp eax, ebx
je 0x1006b60
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x1006add
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x290]
push ecx
push ebx
push ebx
push 0x4000
push ebx
push ebx
push ebx
push dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1006bb4
cmp dword [0x100e144], ebx
je 0x1006b60
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006b1f
cmp al, bl
jne 0x1006b60
mov ecx, dword [0x100e134]
mov esi, 0x40000000
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006b60
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006b60
cmp eax, ecx
jne 0x1006b60
push 0x10012b8
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005dcc
call fcn.01005efb
cmp dword [ebp - 0x23c], ebx
je 0x1006b7a
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24c], ebx
je 0x1006b90
push dword [ebp - 0x24c]
call esi
cmp dword [ebp - 0x248], ebx
je 0x1006ba0
push dword [ebp - 0x248]
call esi
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.0100642f
call fcn.01008afc
ret
mov esi, 0x40000000
mov edi, 0x10012c8
cmp dword [0x100e144], ebx
je 0x1006c0b
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006bd3
cmp al, bl
jne 0x1006c0b
mov ecx, dword [0x100e134]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006c0b
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006c0b
cmp eax, ecx
jne 0x1006c0b
push edi
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005dcc
push dword [ebp - 0x24c]
call fcn.01005f58
test eax, eax
jne 0x1006b60
cmp dword [0x100e144], ebx
je 0x1006b65
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006c3b
cmp al, bl
jne 0x1006b65
mov ecx, dword [0x100e134]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006b65
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006b65
cmp eax, ecx
jne 0x1006b65
push edi
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005dcc
jmp 0x1006b65