Function at 0x1001c020
Capabilities:
Create process on windows
Get file attributes

Disassembly:
mov eax, 0x10075703
call fcn.10075180
sub esp, 0x90
push ebx
push edi
mov edi, edx
xor ebx, ebx
mov dword [ebp - 0x34], edi
test cl, cl
je 0x1001c5a2
mov dword [ebp - 0x18], 0x9fe387fb
mov dword [ebp - 0x14], ebx
jmp 0x1001c05b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c04d
mov eax, dword [ebp - 0x18]
push esi
push 2
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x1001c0c6
mov dword [ebp - 0x28], 0x54c97515
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x4c]
cmp eax, 0x67e6aa14
setle cl
mov dword [ebp - 0x28], ecx
mov ecx, 0x18d9
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x28]
sub ecx, eax
xor eax, eax
cmp edx, ecx
setne al
xor edx, edx
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4c]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
mov dword [ebp + eax*4 - 0x4c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001c070
mov dword [ebp - 0x2c], 0x1852
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x14], ebx
jmp 0x1001c0ef
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9c], 0x47dc4b4e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c0de
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x1001c118
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x9c]
mov dword [ebp - 0x94], eax
dec dword [ebp - 0x20]
jns 0x1001c103
push esi
lea ecx, [ebp - 0x80]
call fcn.1001737c
push 4
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], ebx
call fcn.1001737c
mov dword [ebp - 0x18], ebx
jmp 0x1001c143
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001c133
mov dword [ebp - 0x18], ebx
jmp 0x1001c15d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001c14d
mov esi, dword [ebp - 0x80]
mov dword [esi + 4], ebx
mov dword [ebp - 0x2c], 0xec79cf18
mov dword [ebp - 0x30], 0x6887e0
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x28], 0xc73f
mov dword [ebp - 0x14], ebx
jmp 0x1001c194
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001c18a
mov dword [ebp - 0x38], 3
jmp 0x1001c1ea
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x38], ebx
je 0x1001c1bb
mov dword [ebp - 0x30], 0xffffffff
dec dword [ebp - 0x1c]
jmp 0x1001c1d0
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001c1cb
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x2c], ebx
jne 0x1001c1e7
cmp dword [esi + 4], ebx
jne 0x1001c1de
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x74]
mov dword [eax + 4], ecx
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x1c
je 0x1001c1a3
inc dword [ebp - 0x28]
inc dword [esi + 4]
cmp dword [esi + 4], 0x11
jl 0x1001c169
lea ecx, [ebp - 0x74]
call fcn.10017c12
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.10017c12
push 2
pop esi
push esi
lea ecx, [ebp - 0x5c]
call fcn.1001737c
push esi
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 1
call fcn.1001737c
mov dword [ebp - 0x28], 0x2aa61fc2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1001c24b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001c23f
mov dword [ebp - 0x18], ebx
jmp 0x1001c265
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x68]
mov dword [eax + ecx*4], 0x25d16df2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001c255
mov esi, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x5c]
mov dword [esi + 4], ebx
mov eax, dword [esi + 4]
cmp dword [ecx + eax*4], ebx
jne 0x1001c284
inc eax
mov dword [esi + 4], eax
cmp eax, 1
jle 0x1001c273
xor ecx, ecx
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x5c]
setg cl
xor ebx, ebx
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
setne bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esi + 4], ecx
lea ecx, [ebp - 0x68]
call fcn.10017c12
lea ecx, [ebp - 0x5c]
call fcn.10017c12
xor ebx, ebx
mov dword [ebp - 0x30], 0xe0cf5720
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001c2e9
push ebx
push 0x19db
push ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001c305
push 0x1d75
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x24], 0x2e08
xor esi, esi
mov dword [ebp - 0x1c], 0xb0befcdf
inc esi
mov dword [ebp - 0x20], 0xc1dfe936
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], 0xc0de450b
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], ebx
jmp 0x1001c340
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], 0x80095520
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001c32f
cmp dword [ebp - 0x24], ebx
je 0x1001c34e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
cmp eax, 0xfc9b
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x24], 0x17
jmp 0x1001c502
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0x4499c77e
mov dword [ebp - 0x14], 0x5493a50e
mov dword [ebp - 0x2c], 0xff24264a
mov dword [ebp - 0x14], 0xdfef28ed
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
sub eax, 0xb
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xfffffff7
setg cl
cmp ecx, dword [ebp - 0x18]
jl 0x1001c3e8
mov ecx, esi
cmp dword [ebp - 0x18], ebx
jne 0x1001c3ea
mov ecx, ebx
mov eax, dword [ebp - 0x20]
neg ecx
xor edx, edx
cmp eax, ecx
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub edx, 0x456014ef
cmp edx, 0xc53a
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x20]
jne 0x1001c428
cmp dword [ebp - 0x24], ebx
jne 0x1001c42b
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, esi
sub ecx, eax
cmp ecx, dword [ebp - 0x24]
jge 0x1001c441
mov ecx, esi
cmp dword [ebp - 0x84], ebx
jne 0x1001c443
mov ecx, ebx
xor eax, eax
cmp ecx, 0x206cbc8c
setge al
xor edx, edx
cmp eax, 0x29ef
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x1001c48e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
jmp 0x1001c4f0
push 3
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x1001c4cf
mov dword [ebp - 0x18], ebx
jmp 0x1001c4b2
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x90]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x90], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1001c49b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001c4cc
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 3
pop edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1001c496
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1001c4f0
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001c4eb
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
dec dword [ebp - 0x14]
jns 0x1001c4dc
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001c4ff
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff5
jl 0x1001c3a0
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001c548
mov dword [ebp - 0x1c], ebx
jmp 0x1001c52b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x50], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001c51d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001c545
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff7
jge 0x1001c518
mov esi, dword [ebp + 0xc]
mov ecx, dword [edi]
mov edx, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax + ecx*4], ebx
jne 0x1001c58d
mov eax, dword [edx]
mov eax, dword [edi]
mov ecx, dword [edi]
mov eax, dword [esi]
cmp dword [eax + ecx*4], 0x586f
jl 0x1001c577
cmp dword [edx], ebx
je 0x1001c577
xor edi, edi
inc edi
jmp 0x1001c579
mov edi, ebx
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov eax, dword [esi]
cmp dword [eax + ecx*4], edi
jne 0x1001c587
mov eax, dword [edx]
mov eax, dword [esi]
cmp dword [eax], ebx
je 0x1001c590
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x34]
mov edx, dword [edx]
mov ecx, dword [eax]
mov eax, dword [esi]
imul ecx, ebx
pop esi
mov dword [eax + edx*4], ecx
jmp 0x1001c5b8
push 0x2277
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret