Function at 0x1003c16
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push 0x50c
push 0x1001260
call fcn.01004600
mov eax, dword [0x100e048]
mov dword [ebp - 0x1c], eax
xor edi, edi
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x478], edi
mov dword [ebp - 0x48c], edi
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x49c], edi
xor esi, esi
inc esi
mov dword [ebp - 0x4ac], esi
mov dword [ebp - 0x498], edi
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x4a0], edi
mov dword [ebp - 0x4a4], edi
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x4c4], 8
mov dword [ebp - 0x4c0], edi
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ebx, dword [ebp + 8]
mov dword [0x100fccc], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x100fcc8], eax
push edi
push esi
push ebx
call fcn.0100ab3e
push 0x104
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1003d23
push 0x1001244
lea eax, [ebp - 0x474]
push eax
push edi
call fcn.0100a997
mov dword [0x100f3e8], eax
push edi
push eax
call fcn.0100a631
test eax, eax
je 0x1003d05
push 0x80000000
push dword [0x100f3e8]
call fcn.010036ed
test eax, eax
mov dword [0x100f3d8], esi
jne 0x1003d0b
mov dword [0x100f3d8], edi
push 0x100122c
lea eax, [ebp - 0x474]
push eax
push edi
call fcn.0100a997
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x4ef], 8
je 0x1003d75
push edi
push dword [ebp - 0x510]
call fcn.0100a758
mov dword [0x100f3ec], eax
push edi
push eax
call fcn.0100a631
test eax, eax
je 0x1003d6f
push 0xc0000000
push dword [0x100f3ec]
call fcn.010036ed
test eax, eax
mov dword [0x100f3e0], esi
jne 0x1003d75
mov dword [0x100f3e0], edi
cmp dword [ebp - 0x498], edi
je 0x10040d0
mov dword [ebp - 4], edi
push esi
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0x498]
call fcn.0100a50f
mov dword [ebp - 0x490], eax
cmp eax, edi
je 0x1004051
push dword [ebp + 0x10]
call fcn.0100484d
pop ecx
dec eax
mov dword [ebp - 0x4d8], eax
js 0x1004051
mov ecx, dword [ebp - 0x490]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x4d0], eax
mov ebx, dword [eax]
add ebx, ecx
mov dword [ebp - 0x494], ebx
push edi
push ebx
call fcn.0100479b
push 2
pop esi
add eax, esi
mov dword [ebp - 0x478], eax
push edi
push eax
call fcn.0100479b
add eax, esi
mov dword [ebp - 0x48c], eax
push edi
push eax
call fcn.0100479b
add eax, esi
mov dword [ebp - 0x488], eax
push edi
push eax
call fcn.0100479b
add eax, esi
mov dword [ebp - 0x484], eax
push edi
push eax
call fcn.0100479b
add esp, 0x28
mov esi, eax
inc esi
inc esi
mov dword [ebp - 0x480], esi
mov eax, dword [esi]
mov dword [ebp - 0x49c], eax
push 4
pop eax
add esi, eax
mov dword [ebp - 0x480], esi
mov ecx, dword [esi]
mov dword [ebp - 0x4ac], ecx
add esi, eax
mov dword [ebp - 0x480], esi
mov ecx, dword [esi]
mov dword [0x100e040], ecx
add esi, eax
mov dword [ebp - 0x480], esi
mov ecx, dword [esi]
mov dword [0x100e044], ecx
add esi, eax
mov dword [ebp - 0x480], esi
mov ecx, dword [esi]
mov dword [ebp - 0x4b4], ecx
add esi, eax
mov dword [ebp - 0x480], esi
mov ecx, dword [esi]
mov dword [ebp - 0x4b0], ecx
add esi, eax
mov dword [ebp - 0x480], esi
mov dword [ebp - 0x4bc], esi
mov dword [ebp - 0x47c], edi
cmp word [esi], di
je 0x1003f7f
cmp dword [ebp - 0x47c], edi
jne 0x1003f15
push edi
push dword [ebp - 0x478]
call fcn.0100a758
mov dword [ebp - 0x4a8], eax
push eax
call fcn.0100a911
mov dword [ebp - 0x4d4], eax
cmp eax, edi
je 0x1003ed3
mov word [eax], di
push esi
push dword [ebp - 0x4a8]
push edi
call fcn.0100a997
mov dword [ebp - 0x4b8], eax
lea ecx, [ebp - 0x26c]
push ecx
push eax
call fcn.0100a631
test eax, eax
jne 0x1003efd
mov dword [ebp - 0x47c], edi
push dword [ebp - 0x4b8]
push edi
call fcn.0100a78d
push dword [ebp - 0x4a8]
push edi
call fcn.0100a78d
push edi
push esi
call fcn.0100479b
pop ecx
pop ecx
inc eax
inc eax
mov esi, eax
mov dword [ebp - 0x480], esi
mov eax, dword [esi]
mov dword [ebp - 0x4cc], eax
add esi, 4
mov dword [ebp - 0x480], esi
mov ecx, dword [esi]
mov dword [ebp - 0x4c8], ecx
add esi, 4
mov dword [ebp - 0x480], esi
mov dword [ebp - 0x4bc], esi
cmp dword [ebp - 0x47c], edi
jne 0x1003e9d
cmp dword [ebp - 0x258], eax
jne 0x1003f70
cmp dword [ebp - 0x254], ecx
je 0x1003e9d
mov dword [ebp - 0x47c], 1
jmp 0x1003e9d
push edi
push ebx
call fcn.0100a758
mov dword [ebp - 0x494], eax
push edi
push dword [ebp - 0x478]
call fcn.0100a758
mov dword [ebp - 0x478], eax
push edi
push dword [ebp - 0x48c]
call fcn.0100a758
mov dword [ebp - 0x48c], eax
push edi
push dword [ebp - 0x488]
call fcn.0100a758
mov dword [ebp - 0x488], eax
push edi
push dword [ebp - 0x484]
call fcn.0100a758
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x478]
call fcn.0100a631
mov dword [0x100f3dc], eax
cmp dword [0x100f3e0], edi
je 0x1003ffc
cmp eax, edi
je 0x1003ffc
xor ecx, ecx
inc ecx
jmp 0x1003ffe
xor ecx, ecx
mov dword [0x100f3e4], ecx
cmp dword [ebp - 0x47c], edi
jne 0x100403a
mov ecx, dword [ebp - 0x4b4]
cmp dword [ebp - 0x258], ecx
jne 0x1004028
mov ecx, dword [ebp - 0x4b0]
cmp dword [ebp - 0x254], ecx
je 0x1004032
mov dword [ebp - 0x47c], 1
cmp dword [ebp - 0x47c], edi
je 0x1004043
cmp eax, edi
je 0x1004043
xor eax, eax
inc eax
jmp 0x1004045
xor eax, eax
mov dword [ebp - 0x47c], eax
xor esi, esi
inc esi
mov ebx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
jmp 0x10040b1
cmp dword [ebp - 0x490], edi
je 0x10040d0
push dword [ebp - 0x4a4]
push dword [ebp - 0x4a0]
push dword [ebp - 0x490]
call fcn.0100a592
mov eax, dword [ebp - 0x484]
cmp eax, edi
je 0x10040e8
cmp word [eax], di
je 0x10040e8
push dword [ebp - 0x49c]
push eax
jmp 0x10040f4
push dword [ebp - 0x49c]
push dword [ebp - 0x478]
call fcn.010036a0
cmp dword [ebp - 0x47c], edi
je 0x100410f
mov dword [0x100f3cc], esi
mov dword [0x100f3d0], esi
jmp 0x100414c
mov eax, dword [0x100e040]
dec eax
je 0x100413c
sub eax, 5
je 0x100413c
push edi
push 0x10038bb
push edi
dec eax
je 0x1004138
dec eax
je 0x1004134
dec eax
je 0x1004130
push 0x67
jmp 0x1004145
push 0x6b
jmp 0x1004145
push 0x6a
jmp 0x1004145
push 0x69
jmp 0x1004145
push edi
push 0x10038bb
push edi
push 0x68
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [0x100f3cc], edi
je 0x1004185
push dword [ebp - 0x4ac]
mov eax, dword [ebp - 0x49c]
dec eax
push eax
push dword [ebp - 0x484]
push dword [ebp - 0x488]
push dword [ebp - 0x48c]
push dword [ebp - 0x478]
push dword [0x100f3ec]
call fcn.0100371e
cmp dword [0x100f3d0], edi
je 0x10041a9
push 0xa
push dword [ebp - 0x488]
push dword [ebp - 0x48c]
push dword [ebp - 0x478]
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x100f3c8], edi
je 0x10041bd
push dword [0x100f3ec]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x484], edi
je 0x10041d1
push dword [ebp - 0x484]
push edi
call fcn.0100a78d
cmp dword [ebp - 0x488], edi
je 0x10041e5
push dword [ebp - 0x488]
push edi
call fcn.0100a78d
cmp dword [ebp - 0x48c], edi
je 0x10041f9
push dword [ebp - 0x48c]
push edi
call fcn.0100a78d
cmp dword [ebp - 0x478], edi
je 0x100420d
push dword [ebp - 0x478]
push edi
call fcn.0100a78d
cmp dword [ebp - 0x494], edi
je 0x1004221
push dword [ebp - 0x494]
push edi
call fcn.0100a78d
mov eax, dword [0x100f3ec]
cmp eax, edi
je 0x1004237
push eax
push edi
call fcn.0100a78d
mov dword [0x100f3ec], edi
cmp dword [ebp - 0x498], edi
je 0x100424b
push dword [ebp - 0x498]
push edi
call fcn.0100a78d
mov eax, dword [0x100f3e8]
cmp eax, edi
je 0x100425b
push eax
push edi
call fcn.0100a78d
push edi
push edi
push ebx
call fcn.0100ab3e
xor eax, eax
mov ecx, dword [ebp - 0x1c]
call fcn.010042fb
call fcn.0100463b
ret 0x10