Function at 0x1002fc3
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.01003ba0
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push dword [ebp + 8]
mov ecx, 0x10050f8
push ebx
call fcn.01002ee9
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1003005
mov al, byte [edi]
cmp al, bl
je 0x1003005
cmp al, 0x2d
je 0x100300e
inc edi
jne 0x1002ff8
cmp byte [edi], 0x2d
jne 0x1003096
mov esi, dword [sym.imp.msvcrt.dll__stricmp]
inc edi
push 0x1001894
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1003026
push ebx
jmp 0x1003036
push 0x1001888
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1003040
push 1
call fcn.01002da6
jmp 0x1003212
push 0x100187c
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1003212
push 0x800
lea eax, [ebp - 0x2008]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 0x1008]
push 0x10016d8
push eax
mov dword [ebp - 0x68], 0x44
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x10031eb
lea eax, [ebp - 4]
push eax
push 0x1001148
push 1
push ebx
push 0x10011c8
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x10030c6
push eax
call fcn.01003238
push eax
push 0x100169c
call fcn.01003984
pop ecx
pop ecx
jmp 0x10030c8
xor eax, eax
cmp eax, ebx
jne 0x1003212
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x38]
cmp eax, ebx
jge 0x10030fb
push eax
call fcn.01003238
push eax
push 0x100165c
call fcn.01003984
pop ecx
pop ecx
jmp 0x10030fd
xor eax, eax
cmp eax, ebx
jne 0x1003212
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x48]
cmp eax, ebx
jge 0x100312b
push eax
call fcn.01003238
push eax
push 0x1001620
call fcn.01003984
pop ecx
pop ecx
jmp 0x100312d
xor eax, eax
cmp eax, ebx
jne 0x1003212
cmp dword [ebp - 8], ebx
je 0x100319a
push ebx
push dword [ebp + 8]
call fcn.01002f2b
push dword [0x100517c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x3c]
test eax, eax
jl 0x1003212
push ebx
push 0x493e0
push 2
push dword [0x100517c]
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100318b
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
call esi
test eax, eax
jne 0x1003177
jmp 0x1003212
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x800
lea eax, [ebp - 0x2008]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x11
pop ecx
xor eax, eax
push esi
lea edi, [ebp - 0x68]
rep stosd dword es:[edi], eax
push 0x10014f8
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 0x1008]
push 0x1001470
push eax
mov dword [ebp - 0x68], 0x44
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x2008]
push eax
push ebx
push 0x200
push 1
push ebx
push ebx
lea eax, [ebp - 0x1008]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 4]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x1003222
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x10050f8
call fcn.01002cfa
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
leave
ret 0x10