Function at 0x10180470
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push edi
mov dword [ebp - 0x248], eax
mov edi, dword [eax + 0x10]
mov dword [ebp - 0x238], edi
cmp edi, dword [eax + 0xc]
je 0x10180a32
push ebx
lea ebx, [edi - 0x44]
push esi
mov dword [ebp - 0x23c], ebx
lea esp, [esp]
mov eax, dword [0x1025b450]
mov esi, dword [ebx + 0x3c]
cmp eax, 0xffffffff
je 0x10180554
cmp dword [0x1025b454], 0xffffffff
je 0x10180554
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov dword [ebp - 0x234], ecx
test esi, esi
je 0x10180520
mov dword [ebp - 0x230], 0
test ecx, ecx
jne 0x1018055e
mov eax, dword [0x1025b458]
test eax, eax
je 0x1018055e
lea ecx, [ebp - 0x230]
push ecx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push dword [0x1025b450]
call esi
push dword [ebp - 0x230]
push dword [0x1025b454]
call esi
jmp 0x1018055e
test ecx, ecx
je 0x1018055e
cmp dword [0x1025b45c], 0
je 0x1018055e
push dword [0x1025b454]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call dword [0x1025b45c]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x1025b450]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1018055e
mov dword [ebp - 0x234], 0
mov eax, dword [ebx + 0x30]
cmp eax, 0x90000
ja 0x10180682
je 0x1018066a
cmp eax, 0x20000
je 0x10180653
cmp eax, 0x40000
je 0x101805a7
cmp eax, 0x70000
jne 0x10180979
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x10180599
mov eax, dword [ebx]
push dword [ebx + 0x38]
push eax
call fcn.100de920
jmp 0x10180976
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x101805b1
mov eax, dword [ebx]
push 4
push 0x10205260
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x1018063b
push 4
xor eax, eax
mov dword [ebp - 0x214], 0
push 0x10205260
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x210], 7
mov word [ebp - 0x224], ax
call fcn.100070c0
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x101805fe
mov eax, dword [ebx]
push dword [ebx + 0x10]
lea ecx, [ebp - 0x224]
push eax
call fcn.10006d70
cmp dword [ebp - 0x210], 8
lea eax, [ebp - 0x224]
jb 0x10180622
mov eax, dword [ebp - 0x224]
push eax
call fcn.100d9870
add esp, 4
lea ecx, [ebp - 0x224]
call fcn.10005250
jmp 0x10180979
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x10180645
mov eax, dword [ebx]
push eax
call fcn.100d9870
add esp, 4
jmp 0x10180979
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x1018065d
mov eax, dword [ebx]
push 0
push eax
call fcn.100d9c10
jmp 0x10180976
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x10180674
mov eax, dword [ebx]
push dword [ebx + 0x3c]
push eax
call fcn.100deb00
jmp 0x10180976
cmp eax, 0xa0000
je 0x10180963
cmp eax, 0xb0000
je 0x1018075e
cmp eax, 0xc0000
jne 0x10180979
lea ecx, [ebp - 0x22c]
call fcn.1006b640
lea ecx, [ebp - 0x294]
call fcn.10032d00
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x101806c3
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x294]
call fcn.1015b720
call fcn.10036820
mov ecx, eax
call fcn.101b31a0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [ebp - 0x278]
call fcn.10036820
mov ecx, eax
call fcn.101b2f50
test eax, eax
je 0x10180731
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x278]
call fcn.10036820
mov ecx, eax
call fcn.101b3310
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x22c]
call fcn.100738e0
lea ecx, [ebp - 0x294]
call fcn.1006bc60
lea ecx, [ebp - 0x22c]
call fcn.1006b9f0
jmp 0x10180979
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10180979
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x10180782
mov eax, dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
lea ecx, [ebp - 0x224]
call fcn.10005170
cmp dword [ebp - 0x210], 8
lea edx, [ebp - 0x224]
mov ecx, dword [ebp - 0x224]
jb 0x101807ba
mov edx, ecx
lea esi, [ebp - 0x224]
jb 0x101807c4
mov esi, ecx
mov eax, dword [ebp - 0x214]
lea eax, [esi + eax*2]
lea esi, [ebp - 0x224]
jb 0x101807d7
mov esi, ecx
mov ecx, eax
mov dword [ebp - 0x230], 0
sub ecx, esi
inc ecx
shr ecx, 1
cmp eax, esi
sbb eax, eax
not eax
and eax, ecx
mov dword [ebp - 0x240], eax
je 0x1018083b
mov edi, dword [ebp - 0x230]
sub edx, esi
mov dword [ebp - 0x244], edx
mov ebx, eax
jmp 0x10180810
movzx eax, word [esi]
push eax
call sub.msvcrt.dll_towlower
mov ecx, dword [ebp - 0x244]
lea esi, [esi + 2]
inc edi
add esp, 4
mov word [ecx + esi - 2], ax
cmp edi, ebx
jne 0x10180810
mov edi, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x23c]
push 0
push str.startmenu
lea ecx, [ebp - 0x224]
call fcn.1004e700
push 0
cmp eax, 0xffffffff
je 0x10180866
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push str.startpin
jmp 0x1018088d
push str.taskbar
lea ecx, [ebp - 0x224]
call fcn.1004e700
cmp eax, 0xffffffff
je 0x10180895
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push str.taskbarpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x1018089f
mov eax, dword [ebx]
push eax
call fcn.1000aa00
add esp, 4
test eax, eax
jne 0x1018090f
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x230], ebx
jb 0x101808c0
mov eax, dword [ebx]
mov dword [ebp - 0x230], eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101808d6
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x28
call fcn.10003680
add esp, 4
push 0
push dword [ebp - 0x230]
test eax, eax
je 0x101808f7
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x10180904
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test esi, esi
je 0x1018090f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10180925
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x13
call fcn.10003680
add esp, 4
test eax, eax
je 0x1018093e
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x1018094b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x10180956
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x224]
call fcn.10005250
jmp 0x10180979
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x1018096d
mov eax, dword [ebx]
push dword [ebx + 0x3c]
push eax
call fcn.100de5a0
add esp, 8
mov eax, dword [0x1025b450]
cmp eax, 0xffffffff
je 0x10180a0f
cmp dword [0x1025b454], 0xffffffff
je 0x10180a0f
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
cmp dword [ebp - 0x234], 0
je 0x101809e1
mov dword [ebp - 0x234], 0
test eax, eax
jne 0x10180a0f
mov eax, dword [0x1025b458]
test eax, eax
je 0x10180a0f
lea ecx, [ebp - 0x234]
push ecx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push dword [0x1025b450]
call esi
push dword [ebp - 0x234]
push dword [0x1025b454]
call esi
jmp 0x10180a0f
test eax, eax
je 0x10180a0f
cmp dword [0x1025b45c], 0
je 0x10180a0f
push dword [0x1025b454]
call esi
push eax
call dword [0x1025b45c]
neg eax
sbb eax, eax
inc eax
push eax
push dword [0x1025b450]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x248]
sub edi, 0x44
sub ebx, 0x44
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x23c], ebx
cmp edi, dword [eax + 0xc]
jne 0x101804b0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.101f99c6
mov esp, ebp
pop ebp
ret