Function at 0x100b3558
Capabilities:
Check if file exists
Create directory
Get common file path
Resume thread
Terminate process

Disassembly:
call fcn.1030d3c7
cmp ah, byte cs:[edx + 0x55]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ca4c5
mov eax, dword fs:[0]
push eax
sub esp, 0x860
mov eax, dword [0x100f93e0]
xor eax, ebp
mov dword [ebp - 0x34], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x30], 1
push 0x44
push 0
lea eax, [ebp - 0x6bc]
push eax
call fcn.100771d0
add esp, 0xc
mov dword [ebp - 0x6bc], 0x44
mov dword [ebp - 0x690], 0x81
and word [ebp - 0x68c], 0
push 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.100771d0
add esp, 0xc
lea ecx, [ebp - 0x674]
call fcn.100416dc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.100223dd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.100223dd
mov byte [ebp - 4], 2
and word [ebp - 0x454], 0
push 0x208
push 0
lea eax, [ebp - 0x452]
push eax
call fcn.100771d0
add esp, 0xc
lea eax, [ebp - 0x454]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.Q3Dll
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x454]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x10]
push eax
call fcn.100ba617
pop ecx
mov byte [ebp - 4], 3
push 0x100dcd94
lea ecx, [ebp - 0x10]
call fcn.1000e4d2
lea ecx, [ebp - 0x10]
call fcn.10005b69
push eax
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100b36ac
push 0
push 0x100dcda0
lea eax, [ebp - 0x454]
push eax
push 0xde
push dword [0x101157c4]
call fcn.100acba3
add esp, 0x14
cmp dword [ebp - 0x30], 0
je 0x100b36cf
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b36cf
mov dword [ebp - 0x82c], 1
jmp 0x100b36d6
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x30], eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6f0], esp
push str.DetourCreateProcess_begin
call fcn.10001465
push 0
push 0x3e8
push 0
push 0xfdf3
mov ecx, 0x101158b0
call fcn.100bbf7d
cmp dword [ebp - 0x30], 0
jne 0x100b3727
push 0x82
mov ecx, dword [ebp - 0x828]
call fcn.100a972d
jmp 0x100b3e94
mov ecx, dword [ebp - 0x828]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x830], eax
push 0
push 0x100dcdd0
push dword [ebp - 0x830]
mov eax, dword [ebp - 0x830]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x6c0], eax
mov ecx, dword [ebp - 0x828]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x834], eax
push 0x100d8a43
lea ecx, [ebp - 0x14]
call fcn.10017843
push eax
push str.DetourTargetProc
push dword [ebp - 0x834]
mov eax, dword [ebp - 0x834]
mov eax, dword [eax]
call dword [eax + 0x14]
and word [ebp - 0x244], 0
push 0x208
push 0
lea eax, [ebp - 0x242]
push eax
call fcn.100771d0
add esp, 0xc
and word [ebp - 0x664], 0
push 0x208
push 0
lea eax, [ebp - 0x662]
push eax
call fcn.100771d0
add esp, 0xc
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x14]
call fcn.10005b69
push eax
lea ecx, [ebp - 0x6f4]
call fcn.10003bfa
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x83c], eax
mov byte [ebp - 4], 4
push 0
push 0x2c
lea eax, [ebp - 0x674]
push eax
push dword [ebp - 0x83c]
call fcn.100ba253
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6f4]
call fcn.10014be9
and dword [ebp - 0x6c4], 0
jmp 0x100b3839
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
lea ecx, [ebp - 0x674]
call fcn.100062a4
cmp dword [ebp - 0x6c4], eax
jae 0x100b398a
and dword [ebp - 0x6cc], 0
push dword [ebp - 0x6c4]
lea ecx, [ebp - 0x674]
call fcn.100480b8
push eax
lea ecx, [ebp - 0x6c8]
call fcn.10003be1
mov byte [ebp - 4], 5
push 0
push 0x100dcdf0
lea ecx, [ebp - 0x6c8]
call fcn.10014cdc
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 0
jl 0x100b38fd
push 0x100dcdfc
call fcn.10077b0b
pop ecx
add eax, dword [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x6c8]
call fcn.10028a99
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x844], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x844]
lea ecx, [ebp - 0x6c8]
call fcn.10003c65
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6f8]
call fcn.10014be9
mov dword [ebp - 0x6cc], 1
call fcn.100b9843
test eax, eax
je 0x100b3923
cmp dword [ebp - 0x6cc], 0
je 0x100b3923
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6c8]
call fcn.10014be9
jmp 0x100b382c
push 0x104
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x6c0]
lea ecx, [ebp - 0x6c8]
call fcn.10005b69
push eax
call fcn.100bb16e
add esp, 0x10
test eax, eax
je 0x100b3976
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b3976
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6c8]
call fcn.10014be9
jmp 0x100b398a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6c8]
call fcn.10014be9
jmp 0x100b382c
mov ecx, dword [ebp - 0x828]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x848], eax
push 0x100d8a5b
lea ecx, [ebp - 0x18]
call fcn.10017843
push eax
push str.DetourTarget_inter
push dword [ebp - 0x848]
mov eax, dword [ebp - 0x848]
mov eax, dword [eax]
call dword [eax + 0x14]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
call fcn.10005b69
push eax
lea ecx, [ebp - 0x700]
call fcn.10003bfa
mov dword [ebp - 0x84c], eax
mov ecx, dword [ebp - 0x84c]
call fcn.10003bcb
movzx eax, al
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x6f9], al
lea ecx, [ebp - 0x700]
call fcn.10014be9
movzx eax, byte [ebp - 0x6f9]
test eax, eax
je 0x100b3bd7
lea ecx, [ebp - 0x674]
call fcn.10029396
lea ecx, [ebp - 0x18]
call fcn.10005b69
push eax
lea ecx, [ebp - 0x704]
call fcn.10003bfa
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x854], eax
mov byte [ebp - 4], 7
push 0
push 0x2c
lea eax, [ebp - 0x674]
push eax
push dword [ebp - 0x854]
call fcn.100ba253
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x704]
call fcn.10014be9
and dword [ebp - 0x6d4], 0
jmp 0x100b3a86
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
lea ecx, [ebp - 0x674]
call fcn.100062a4
cmp dword [ebp - 0x6d4], eax
jae 0x100b3bd7
and dword [ebp - 0x6dc], 0
push dword [ebp - 0x6d4]
lea ecx, [ebp - 0x674]
call fcn.100480b8
push eax
lea ecx, [ebp - 0x6d8]
call fcn.10003be1
mov byte [ebp - 4], 8
push 0
push 0x100dce1c
lea ecx, [ebp - 0x6d8]
call fcn.10014cdc
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0
jl 0x100b3b4a
push str.x64:
call fcn.10077b0b
pop ecx
add eax, dword [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x708]
push eax
lea ecx, [ebp - 0x6d8]
call fcn.10028a99
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0x85c], eax
mov byte [ebp - 4], 9
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x6d8]
call fcn.10003c65
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x708]
call fcn.10014be9
mov dword [ebp - 0x6dc], 1
call fcn.100b9843
test eax, eax
je 0x100b3b70
cmp dword [ebp - 0x6dc], 0
je 0x100b3b70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6d8]
call fcn.10014be9
jmp 0x100b3a79
push 0x104
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x6c0]
lea ecx, [ebp - 0x6d8]
call fcn.10005b69
push eax
call fcn.100bb16e
add esp, 0x10
test eax, eax
je 0x100b3bc3
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b3bc3
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6d8]
call fcn.10014be9
jmp 0x100b3bd7
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6d8]
call fcn.10014be9
jmp 0x100b3a79
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x70c], esp
push str.DetourCreateProcess_begin2
call fcn.10001465
push 0
push 0x3e8
push 0
push 0xfdf4
mov ecx, 0x101158b0
call fcn.100bbf7d
cmp dword [ebp - 0x30], 0
je 0x100b3cca
cmp dword [ebp - 0x1c], 0
je 0x100b3c6f
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x790]
call fcn.1003d042
mov dword [ebp - 0x860], eax
push 0
mov ecx, dword [ebp - 0x860]
call fcn.10005b69
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x6bc]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x664]
push eax
push 0
call fcn.10075500
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x790]
call fcn.10015104
jmp 0x100b3cc8
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x814]
call fcn.1003d042
mov dword [ebp - 0x864], eax
push 0
mov ecx, dword [ebp - 0x864]
call fcn.10005b69
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x6bc]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x244]
push eax
push 0
call fcn.10075500
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x814]
call fcn.10015104
jmp 0x100b3d0c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x818], esp
push str.DetourCreateProcess_begin3
call fcn.10001465
push 0
push 0x3e8
push 0
push 0xfdf5
mov ecx, 0x101158b0
call fcn.100bbf7d
push 0x83
mov ecx, dword [ebp - 0x828]
call fcn.100a972d
jmp 0x100b3e94
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x81c], esp
push 0x100dce6c
call fcn.10001465
push 0
push 0x3e8
push 0
push 0xfdeb
mov ecx, 0x101158b0
call fcn.100bbf7d
cmp dword [ebp - 0x30], 0
je 0x100b3e6c
push dword [ebp + 8]
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x828]
call fcn.100ab6ef
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x30], 0
je 0x100b3d75
cmp dword [ebp - 0x6e4], 0
je 0x100b3d75
mov dword [ebp - 0x868], 1
jmp 0x100b3d7c
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x100b3dc1
cmp dword [ebp - 0x1c], 0
je 0x100b3dc1
mov eax, dword [ebp - 0x6e4]
mov dword [eax + 0x1408], 1
push 0x3ff
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x6e4]
add eax, 0x140c
push eax
call fcn.1007b1b2
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x30], 0
je 0x100b3ddb
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x828]
add ecx, 0x44
call fcn.10005b69
mov dword [ebp - 0x86c], eax
push 0
push str.ModuleType
push dword [ebp - 0x86c]
mov eax, dword [ebp - 0x86c]
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 0x11
jne 0x100b3e6a
mov ecx, 0x10115fb0
call fcn.10028afe
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 0
jne 0x100b3e40
and dword [ebp - 0x30], 0
jmp 0x100b3e52
mov eax, dword [ebp - 0x6ec]
cmp dword [eax], 1
jne 0x100b3e52
mov dword [ebp - 0x30], 1
cmp dword [ebp - 0x30], 0
jne 0x100b3e6a
push 0x86
mov ecx, dword [ebp - 0x828]
call fcn.100a972d
jmp 0x100b3e94
jmp 0x100b3e7e
push 0x84
mov ecx, dword [ebp - 0x828]
call fcn.100a972d
jmp 0x100b3e94
cmp dword [ebp - 0x30], 0
jne 0x100b3e94
push 0x85
mov ecx, dword [ebp - 0x828]
call fcn.100a972d
cmp dword [ebp - 0x30], 0
jne 0x100b3eab
cmp dword [ebp - 0x2c], 0
je 0x100b3eab
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 0x2c], 0
je 0x100b3ecc
push 0xbb8
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x28], 0
je 0x100b3edf
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x28], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x820], esp
push str.DetourCreateProcess_success
call fcn.10001465
xor eax, eax
cmp dword [ebp - 0x30], 0
sete al
push eax
push 0x3e8
push 0
push 0xfdec
mov ecx, 0x101158b0
call fcn.100bbf7d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x824], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.10014be9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.1000ef49
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1000ef49
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.10041703
mov eax, dword [ebp - 0x824]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x34]
xor ecx, ebp
call fcn.100771ba
leave
ret 4