Function at 0x101f80cd
Capabilities:
Check if file exists
Create thread

Disassembly:
push 0x294
mov eax, 0x10274b4e
call fcn.10237635
mov esi, ecx
mov dword [ebp - 0x244], esi
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x230]
mov edi, dword [0x102ba1fc]
mov ebx, 0x80004005
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x248], eax
call fcn.100b5a8d
xor eax, eax
mov dword [ebp - 4], eax
mov byte [ebp - 0x231], al
cmp dword [ebp - 0x23c], eax
je 0x101f8156
cmp dword [ebp - 0x238], eax
jne 0x101f8156
cmp dword [ebp - 0x240], eax
jne 0x101f8156
push 0x100a4d48
call fcn.100d3aab
pop ecx
mov ebx, 0x80070057
jmp 0x101f8437
push eax
push eax
push 1
push eax
call dword [0x102a9c58]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x101f8178
push 0x100a4da4
call fcn.100d3aab
pop ecx
jmp 0x101f8430
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jne 0x101f81ab
push dword [ebp - 0x248]
mov ecx, esi
push dword [ebp - 0x23c]
push dword [ebp - 0x238]
push dword [ebp - 0x240]
call fcn.101f7ed6
mov ebx, eax
test ebx, ebx
jne 0x101f8430
mov ebx, dword [ebp + 0xc]
xor eax, eax
lea ecx, [ebp - 0x230]
push eax
push 0x100a4de0
call fcn.10149cf4
test eax, eax
jne 0x101f81cb
mov byte [ebp - 0x231], 1
jmp 0x101f81f7
xor eax, eax
lea ecx, [ebp - 0x230]
push eax
push 0x100a4e08
call fcn.10149cf4
test eax, eax
je 0x101f81f7
push 0x100a4e14
push 0x100a4e24
lea ecx, [ebp - 0x230]
call fcn.10149cf4
test edi, edi
jne 0x101f82bb
xor eax, eax
push 0x44
pop edi
push edi
push eax
lea eax, [ebp - 0x2a0]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x2a0], edi
test ebx, ebx
jne 0x101f8244
mov eax, dword [esi + 8]
mov dword [ebp - 0x268], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x264], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x274], pe_nt_image_headers32
mov dword [ebp - 0x260], eax
push 5
pop eax
mov word [ebp - 0x270], ax
lea edi, [ebp - 0x258]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
test ebx, ebx
je 0x101f826e
or eax, 8
lea ecx, [ebp - 0x258]
xor edi, edi
push ecx
lea ecx, [ebp - 0x2a0]
push ecx
push edi
push edi
push eax
xor eax, eax
test ebx, ebx
sete al
push eax
push edi
push edi
push dword [ebp - 0x230]
push edi
call dword [0x102a9c68]
test eax, eax
jne 0x101f83bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x101f8345
mov ebx, 0x80004005
jmp 0x101f835a
add edi, 2
movzx eax, word [edi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
jne 0x101f82b8
xor eax, eax
cmp word [edi], ax
je 0x101f8201
cmp byte [ebp - 0x231], al
jne 0x101f82f3
push 0xffffffffffffffff
push 0x100a4e34
lea ecx, [ebp - 0x230]
call fcn.100b594f
test eax, eax
jne 0x101f8330
push 0xffffffffffffffff
push 0x100986c4
lea ecx, [ebp - 0x230]
call fcn.100b594f
test eax, eax
jne 0x101f8330
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x230]
call fcn.100b594f
test eax, eax
jne 0x101f8330
push 0x22
lea ecx, [ebp - 0x230]
call fcn.100b59b1
test eax, eax
je 0x101f81ff
push 0x100a4e40
call fcn.100d3aab
pop ecx
mov ebx, 0x80070057
jmp 0x101f8430
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x101f835a
movzx ebx, bx
or ebx, 0x80070000
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x101f837b
push dword [ebp - 0x230]
push 0x100a4e94
call fcn.100d3aab
pop ecx
jmp 0x101f8172
push ecx
push ecx
xor edx, edx
mov ecx, ebx
call fcn.102107ba
push eax
mov ecx, ebx
call fcn.10210755
push eax
sub esp, 0x21c
lea esi, [ebp - 0x230]
mov edi, esp
mov ecx, 0x87
rep movsd dword es:[edi], dword [esi]
push 0x100a4ed0
call fcn.100d3aab
mov esi, dword [ebp - 0x244]
add esp, 0x228
jmp 0x101f8430
mov eax, dword [ebp - 0x258]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x254]
mov dword [esi + 0x18], eax
cmp dword [esi + 4], edi
je 0x101f8423
lea eax, [ebp - 0x244]
push eax
push edi
push esi
push 0x101f7dc0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x101f8423
push 0x100a4f20
call fcn.100d3aab
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x101f840c
mov ebx, 0x80004005
jmp 0x101f8430
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x101f8430
movzx ebx, bx
or ebx, 0x80070000
jmp 0x101f8430
test ebx, ebx
jne 0x101f842e
mov ecx, esi
call fcn.101f8455
mov ebx, edi
mov ecx, esi
call fcn.101f867c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.100b5ef7
mov eax, ebx
call fcn.102375e9
ret 0x18