Function at 0x10009912
Capabilities:
Check if file exists
Create process on windows
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
sub eax, ebx
push esi
je 0x10009b46
dec eax
jne 0x10009b8f
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_DisableThreadLibraryCalls]
push 0x37
push 0x100225ac
call fcn.10001a47
add eax, 4
push eax
push 0x1002b004
call fcn.10011dd0
add esp, 0xc
push 8
mov eax, 0x7d4
mov word [0x100310c0], ax
pop eax
push 0xd
mov word [0x100310c2], ax
pop eax
push 0xc
mov word [0x100310c6], ax
pop eax
mov word [0x100310c8], ax
xor eax, eax
push 0x1002f41c
push 0x100310c0
mov word [0x100310ca], ax
mov word [0x100310cc], ax
mov word [0x100310c4], ax
mov word [0x100310ce], ax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
mov esi, 0x104
push esi
push ebx
mov edi, 0x1002c550
push edi
call fcn.10011d50
push esi
push ebx
push 0x1002c0a0
call fcn.10011d50
add esp, 0x18
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push edi
call fcn.10021bb5
push esi
push ebx
mov ebx, 0x10030110
push ebx
call fcn.10011d50
push esi
push 0
push 0x10031618
call fcn.10011d50
push esi
push 0
push 0x100311c0
call fcn.10011d50
push esi
push 0
mov esi, 0x10030000
push esi
call fcn.10011d50
push 0x5c
push edi
mov dword [ebp + 0xc], edi
call fcn.100136a0
add esp, 0x3c
jmp 0x10009a30
push 0x5c
push dword [ebp + 0xc]
call fcn.100136a0
inc eax
push 0x5c
push eax
mov dword [ebp + 0xc], eax
call fcn.100136a0
add esp, 0x10
test eax, eax
jne 0x10009a17
mov eax, dword [ebp + 0xc]
sub eax, edi
push eax
push edi
push ebx
call fcn.10013960
push ebx
mov edi, ebx
call fcn.10013b90
add esp, 0x10
cmp byte [eax + edi - 1], 0x5c
jne 0x10009a5f
push ebx
call fcn.10013b90
pop ecx
mov byte [eax + edi - 1], 0
push ebx
push str._sThumbs.db
push 0x10031618
call fcn.100137e6
push ebx
push str._sUsp10.dll
mov edi, 0x100311c0
push edi
call fcn.100137e6
push ebx
push str._sLpk.dll
push esi
call fcn.100137e6
add esp, 0x24
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ebx
test al, 1
jne 0x10009aac
push str._sLpk.dll
mov ebx, 0x1002c0a0
push ebx
call fcn.100137e6
jmp 0x10009ac0
push str._sUsp10.dll
push 0x1002c0a0
call fcn.100137e6
mov ebx, 0x1002c0a0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10009ad2
push ebx
jmp 0x10009b22
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10009ae2
push ebx
push edi
jmp 0x10009b23
push 0x10031618
call fcn.10014935
mov dword [esp], str.Lpk.dll
push ebx
call fcn.10013760
pop ecx
pop ecx
test eax, eax
je 0x10009b0c
push 0x10031618
push edi
call fcn.10014cc9
pop ecx
pop ecx
push 0x100229e4
push ebx
call fcn.10013760
pop ecx
pop ecx
test eax, eax
je 0x10009b2a
push 0x10031618
push esi
call fcn.10014cc9
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push eax
push 0x10009569
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
jmp 0x10009b8f
push str.winhlp32.exe
push 0x1002c550
call fcn.10013760
pop ecx
pop ecx
test eax, eax
je 0x10009b71
cmp dword [0x1003175c], 0xb
je 0x10009b71
push 1
push str.winhlp32.exe_211
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, dword [0x1003171c]
mov esi, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp eax, ebx
je 0x10009b83
push eax
call esi
mov eax, dword [0x10031720]
cmp eax, ebx
je 0x10009b8f
push eax
call esi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 0xc