Function at 0x500124a
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Get common file path
Get disk information
Get disk size
Get file attributes
Terminate process

Disassembly:
sub esp, 0xbc
mov eax, dword [0x5001110]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x1c], eax
mov byte [esp + 0x13], 0x63
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x5016320], eax
call fcn.05002431
mov esi, 0x501632c
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, esi
cmp ecx, esi
jbe 0x50012b3
cmp byte [ecx - 1], 0x5c
lea eax, [ecx - 1]
je 0x50012b3
mov ecx, eax
jmp 0x50012a2
push ecx
call fcn.05001eed
push esi
mov dword [esp + 0x1c], eax
call fcn.0500248f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, eax
xor ecx, ecx
mov dword [esp + 0x20], ebp
mov al, byte [ebp]
cmp al, 0x20
je 0x50012e0
cmp al, 9
je 0x50012e0
cmp al, 0x22
jne 0x50012ea
cmp al, 0x22
jne 0x50012e7
push 1
pop ecx
inc ebp
jmp 0x50012d1
cmp ecx, ebx
mov dword [esp + 0x20], ebp
je 0x5001309
mov cl, byte [ebp]
mov eax, ebp
cmp cl, bl
je 0x5001309
cmp cl, 0x22
je 0x5001306
mov cl, byte [eax + 1]
inc eax
jmp 0x50012f7
mov byte [eax], 0x20
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebp - 1]
cmp eax, ebp
jb 0x500132e
mov cl, byte [eax]
cmp cl, 0x20
je 0x5001329
cmp cl, 9
jne 0x500132e
mov byte [eax], bl
dec eax
jmp 0x5001319
mov esi, dword [esp + 0x18]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
mov byte [section..zero], bl
mov dword [esp + 0x24], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx + esi - 1]
cmp edx, esi
jbe 0x5001380
cmp byte [edx], 0x2e
je 0x5001358
dec edx
jmp 0x500134c
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov esi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, section..zero
mov dword [esp + 0x24], ecx
inc ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edx], bl
cmp byte [ebp], bl
mov dword [esp + 0x38], 0x500110c
mov dword [esp + 0x14], ebp
je 0x50014b8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov al, byte [eax]
mov cl, byte [ecx]
or al, 0x20
or cl, 0x20
cmp cl, al
jne 0x5001499
mov eax, dword [esp + 0x14]
lea ebp, [eax + 1]
mov eax, dword [esp + 0x18]
lea esi, [eax + 1]
mov al, byte [esi]
mov dl, byte [ebp]
mov cl, al
or dl, 0x20
or cl, 0x20
cmp cl, dl
jne 0x50013d5
cmp al, bl
je 0x50013d5
inc ebp
inc esi
jmp 0x50013bc
cmp byte [esi], bl
jne 0x5001499
cmp byte [ebp], 0x2e
mov dword [esp + 0x28], ebx
jne 0x5001430
cmp dword [esp + 0x24], ebx
jbe 0x5001430
xor edi, edi
cmp dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
jbe 0x500142c
mov eax, ebp
sub eax, section..zero
mov cl, byte [eax + edi + section..zero]
mov dl, byte [edi + section..zero]
lea esi, [edi + section..zero]
or cl, 0x20
or dl, 0x20
cmp cl, dl
jne 0x50014ab
inc edi
cmp edi, dword [esp + 0x24]
jb 0x5001404
add ebp, dword [esp + 0x24]
mov al, byte [ebp]
cmp al, 0x20
je 0x500143f
cmp al, 9
je 0x500143f
cmp al, bl
jne 0x5001499
mov esi, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
mov edi, 0x5006104
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [esp + 0x28], ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x5006104]
mov byte [edi], bl
jne 0x500148a
mov ecx, dword [esp + 0x24]
mov esi, section..zero
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [eax + ecx + 0x5006104], bl
push 0x5006104
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x50014b4
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp byte [eax], bl
jne 0x5001395
jmp 0x50014b8
mov dword [esp + 0x28], ebx
jmp 0x5001430
mov dword [esp + 0x38], ebp
mov edi, dword [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x500153b
mov edi, dword [esp + 0x38]
lea eax, [ecx - 2]
cmp eax, ebx
jbe 0x500153b
push 1
mov dword [esp + 0x24], eax
pop ebp
mov esi, dword [edi]
and esi, 0xffdffdff
or esi, 0x20000000
cmp esi, 0x20582d20
jne 0x50014f9
mov dword [0x5016430], ebp
cmp esi, 0x3a582d20
jne 0x5001510
lea eax, [edi + 4]
mov dword [0x5016430], ebp
push eax
call fcn.050023e3
cmp esi, 0x20552d20
jne 0x500151e
mov dword [0x5006208], ebp
cmp esi, 0x20512d20
jne 0x5001532
mov dword [0x5016324], ebp
mov dword [0x5006208], ebp
inc edi
dec dword [esp + 0x20]
jne 0x50014dd
jmp 0x500153e
push 1
pop ebp
mov eax, dword [0x50010e4]
and ax, 0
cmp eax, 0xcab00000
jne 0x5001558
push 0x20000001
call fcn.050020e9
test byte [fcn.050010e7], 0x80
jne 0x5001567
mov dword [0x5016430], ebp
and byte [fcn.050010e7], 0x7f
cmp dword [0x5016324], ebx
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jne 0x5001600
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5016328], eax
lea eax, [esp + 0x60]
push eax
push ebx
push ebx
push 0x5002251
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x50015ae
push 8
call fcn.050020e9
push 0xffffffffffffffff
push dword [0x5016328]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x18]
push ebx
push 0xc
push 0x68
push dword [0x5016434]
call ebp
mov eax, dword [0x50010e0]
add eax, 0xffff
shr eax, 0x10
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5016434]
call ebp
push ebx
push 1
push 0x404
push 0x6a
push dword [0x5016434]
call ebp
push ebx
push ebx
push 0x501632c
call fcn.05001f53
mov esi, dword [0x50010e0]
or dword [esp + 0x34], 0xffffffff
add esp, 0xc
cmp esi, ebx
mov dword [esp + 0x14], eax
je 0x5001684
mov edi, 0x500631c
mov eax, 0x10000
mov dword [esp + 0x18], esi
cmp esi, eax
jbe 0x5001638
mov dword [esp + 0x18], eax
push dword [esp + 0x18]
push edi
push dword [esp + 0x1c]
call fcn.05001fb1
add esp, 0xc
push dword [esp + 0x18]
push edi
push dword [esp + 0x30]
call fcn.05002460
cmp dword [0x5016324], ebx
mov dword [esp + 0x28], eax
jne 0x5001678
mov eax, dword [0x5016434]
cmp eax, ebx
je 0x500168e
push ebx
push ebx
push 0x405
push 0x6a
push eax
call ebp
sub esi, dword [esp + 0x18]
jne 0x5001627
cmp dword [esp + 0x28], ebx
je 0x5001698
push 0x20000001
call fcn.050020e9
push 0x4c7
call fcn.050020e9
lea eax, [esp + 0x64]
push eax
push ebx
push fcn.05002001
push 0x5001f92
push 0x5001fd9
push fcn.05001fb1
push fcn.05001f53
push 0x5001f40
push fcn.05001f22
call fcn.050027af
push ebx
push ebx
push dword [esp + 0x40]
mov dword [esp + 0x50], eax
call fcn.05002001
lea eax, [esp + 0xa0]
push eax
push dword [esp + 0x48]
push dword [esp + 0x58]
call fcn.0500283f
add esp, 0x3c
test eax, eax
jne 0x50016fb
push 0x20000001
call fcn.050020e9
cmp dword [0x5016324], ebx
jne 0x5001710
push ebx
push dword [0x5016434]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x5006214], bl
je 0x5001734
push 0x5006214
call fcn.05001e52
test eax, eax
jne 0x500172c
mov byte [0x5006214], bl
cmp byte [0x5006214], bl
jne 0x500175c
cmp dword [0x5006208], ebx
jne 0x50017f9
cmp dword [0x5016430], ebx
je 0x50017f9
push 0x5006214
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [esp + 0x34]
cmp dword [0x5006208], ebx
jne 0x5001952
cmp dword [0x5016430], ebx
jne 0x5001797
push ebx
push 3
push ebx
push dword [0x50010e0]
call sub.ntdll.dll__allmul
cmp esi, edx
ja 0x5001952
jb 0x5001797
cmp dword [esp + 0x30], eax
jae 0x5001952
push ebx
push 0x5002279
push dword [0x5016434]
push 0x6b
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x5001941
cmp eax, ebx
je 0x5001948
cmp byte [eax], bl
je 0x5001948
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x5006214
mov edx, ecx
mov esi, edi
mov edi, eax
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.05001e52
test eax, eax
jne 0x5001967
jmp 0x5001797
push pe_overlay
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [0x500631c]
mov esi, dword [esp + 0x34]
or al, 0x20
mov dword [esp + 0x28], ebx
mov byte [esp + 0x12], al
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], 0x61
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x5001836
cmp eax, 6
jne 0x5001892
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x5001892
mov eax, dword [esp + 0x40]
mov cl, byte [esp + 0x1c]
imul eax, dword [esp + 0x44]
mul dword [esp + 0x48]
cmp cl, byte [esp + 0x12]
mov edi, edx
jne 0x500187c
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
jmp 0x5001892
cmp edi, esi
jb 0x5001892
ja 0x5001888
cmp eax, dword [esp + 0x30]
jbe 0x5001892
mov dword [esp + 0x30], eax
mov esi, edi
mov byte [esp + 0x13], cl
inc byte [esp + 0x1c]
cmp byte [esp + 0x1c], 0x7a
jle 0x5001821
mov eax, dword [0x50010e8]
cmp eax, 0xcab00eee
je 0x50018b5
cmp esi, ebx
ja 0x50018d9
jb 0x50018b5
cmp dword [esp + 0x30], eax
jae 0x50018d9
cmp esi, dword [esp + 0x2c]
ja 0x50018d9
jb 0x50018c7
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x28]
jae 0x50018d9
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
mov al, byte [esp + 0x12]
jmp 0x50018dd
mov al, byte [esp + 0x13]
mov edi, 0x5006214
mov byte [esp + 0x1c], al
push edi
lea eax, [esp + 0x20]
push 0x5001100
push eax
call fcn.05001db8
push eax
mov eax, dword [0x50010e0]
and eax, 0xffff
push eax
call fcn.0500202c
push edi
call fcn.05001e52
test eax, eax
jne 0x5001760
push edi
mov byte [0x500621c], 0x5f
call fcn.05001e52
test eax, eax
jne 0x5001760
push edi
push 0x104
mov dword [esp + 0x38], ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x5001760
push 0xffffffffffffffff
call fcn.050020e9
push 0x4c7
call fcn.050020e9
push 0x5006214
call fcn.05001e52
test eax, eax
jne 0x5001967
push 0x52
call fcn.050020e9
cmp dword [0x5016324], ebx
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
jne 0x5001a0a
mov esi, section..zero
push 0x104
push esi
push 0x20000004
push ebx
call edi
push 0x104
push 0x5006104
push 0x20000006
push ebx
call edi
push esi
push ebx
push 0xc
push 0x65
push dword [0x5016434]
call ebp
push 0x5006104
push ebx
push 0xc
push 0x66
push dword [0x5016434]
call ebp
push 0x5006214
push ebx
push 0xc
push 0x69
push dword [0x5016434]
call ebp
push ebx
push ebx
push 0x402
push 0x6a
push dword [0x5016434]
call ebp
movzx eax, word [esp + 0x76]
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5016434]
call ebp
push 5
push dword [0x5016434]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5001a0f
mov esi, section..zero
push ebx
push ebx
push 0x5001bce
push ebx
push 0x500110c
push 0x501632c
push dword [esp + 0x38]
call fcn.050028cb
add esp, 0x1c
test eax, eax
jne 0x5001a3b
push 0x20000001
call fcn.050020e9
mov ecx, dword [0x5006208]
mov eax, dword [0x5016434]
cmp ecx, ebx
jne 0x5001a58
cmp eax, ebx
jne 0x5001a58
push 0x4c7
call fcn.050020e9
cmp dword [0x5016438], ebx
je 0x5001b8f
cmp dword [0x5016430], ebx
jne 0x5001b8f
cmp dword [0x5016324], ebx
jne 0x5001a86
push dword [0x501631c]
push ebx
push 0xc
push 0x68
push eax
call ebp
mov edi, dword [0x5016438]
or ecx, 0xffffffff
xor eax, eax
mov edx, section..zero
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x11
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
lea edi, [esp + 0x88]
push 1
rep stosd dword es:[edi], eax
pop eax
mov dword [esp + 0x88], 0x44
mov dword [esp + 0xb4], eax
mov word [esp + 0xb8], ax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x8c]
push eax
push dword [0x5006210]
push ebx
push 0x20
push ebx
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x5001b2c
push 0xffffffffffffffff
call fcn.050020e9
cmp dword [0x5016324], ebx
jne 0x5001b41
push ebx
push dword [0x5016434]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x4c]
push 0xffffffffffffffff
push eax
mov dword [0x5006318], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x3c]
mov dword [0x5006318], ebx
push eax
mov dword [esp + 0x40], ebx
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x50]
call esi
cmp dword [esp + 0x3c], 0xcabf00d1
je 0x5001bbc
call fcn.0500216c
jmp 0x5001bbc
cmp ecx, ebx
jne 0x5001bbc
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
push esi
push 0x20000002
push ebx
call edi
push 0x10030
push esi
push esi
push dword [0x5016434]
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]