Function at 0x10019700
Capabilities:
Create directory
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10037818
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
call fcn.10019240
test al, al
je 0x10019f47
mov ecx, dword [0x100457d0]
cmp byte [ecx + 0x20c], bl
je 0x10019f47
mov eax, dword [0x100457d4]
cmp byte [eax + 0x64], bl
je 0x10019f47
mov byte [0x100457d8], bl
cmp byte [ecx + 0x20d], 1
jne 0x10019774
mov ecx, 0x10045374
call fcn.1001f850
jmp 0x100197da
push 0x10045374
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, 0x10045374
add ecx, 0xfffffffe
lea esp, [esp]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10019790
mov eax, dword [str.bSyaeDump_]
mov dword [ecx], eax
mov eax, dword [0x1003ed84]
mov dword [ecx + 4], eax
mov eax, dword [0x1003ed88]
mov dword [ecx + 8], eax
mov eax, dword [0x1003ed8c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x1003ed90]
mov dword [ecx + 0x10], eax
mov ax, word [0x1003ed94]
push 0
push 0x10045374
mov word [ecx + 0x14], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x100452ec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x100452c1], 1
call fcn.1001b370
mov byte [0x100452c1], 0
call fcn.1001b4a0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.acecore.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 0
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x1001984e
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.acees.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 1
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x1001989f
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.acewstr.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 2
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x100198f0
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.imetip.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 3
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019941
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.imjkapi.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 4
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019992
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.imkrapi.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 5
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x100199e3
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.imkrtip.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 6
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019a34
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
push 7
push str.mso.dll
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
call fcn.10001b20
mov byte [ebp - 0x20], 1
mov dword [ebp - 4], 7
movzx eax, byte [0x10045bfa]
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019a93
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.msointl.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 8
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019ae4
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.msonsext.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 9
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019b35
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.msores.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 0xa
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019b86
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
push 0xd
push str.sqlcese40.dll
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
call fcn.10001b20
mov byte [ebp - 0x20], 1
mov dword [ebp - 4], 0xb
movzx eax, byte [0x10045bfa]
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019be5
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.winmm.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 0xc
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019c36
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
push 0xf
push str.msmpeg2adec.dll
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
call fcn.10001b20
mov byte [ebp - 0x20], 1
mov dword [ebp - 4], 0xd
movzx eax, byte [0x10045bfa]
push eax
lea eax, [ebp - 0x38]
push eax
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019c95
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.mfc80u.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 0xe
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019ce6
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.mfc80kor.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 0xf
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019d37
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.mfc90u.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 0x10
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019d88
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.gdi32.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov edx, eax
mov dword [ebp - 4], 0x11
movzx eax, byte [0x10045bfa]
push eax
push edx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100452dc
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019dd9
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push str.nt0_dll.dll
lea ecx, [ebp - 0x38]
call fcn.1001e8f0
mov ecx, eax
mov dword [ebp - 4], 0x12
movzx eax, byte [0x10045bfa]
push eax
push ecx
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x10045304
push eax
call fcn.1001eac0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x24], 0x10
jb 0x10019e2a
push dword [ebp - 0x38]
call fcn.10025d08
add esp, 4
call fcn.10019f80
call fcn.1001ae50
mov eax, dword [0x100457d4]
cmp byte [eax + 0x6a], 1
jne 0x10019ed7
mov eax, dword [0x100457d0]
cmp byte [eax + 0x20d], 1
jne 0x10019e7f
push 0x800
call fcn.10025b14
add esp, 4
mov esi, eax
mov dword [0x10044488], esi
push 0x800
push 0
push esi
call fcn.10028990
add esp, 0xc
test esi, esi
je 0x10019ed7
lea eax, [ebp - 0x14]
jmp 0x10019e98
push 0x10045370
call fcn.1001fdf0
add esp, 4
mov dword [0x10044488], eax
test eax, eax
je 0x10019eb5
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x1001b5c0
push 0
push 0
call fcn.1002629b
add esp, 0x18
mov dword [0x10044490], eax
jmp 0x10019ed7
push 0x1003ed30
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10019ece
mov eax, dword [eax + 0x32]
mov dword [0x10044488], eax
jmp 0x10019ed3
mov eax, dword [0x10044488]
test eax, eax
je 0x10019f47
mov eax, dword [0x100457d4]
test byte [eax + 0x6b], 1
je 0x10019efa
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
test eax, eax
je 0x10019efa
mov esi, dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
push 0
call esi
push 1
call esi
mov eax, dword [0x100457d4]
test byte [eax + 0x6c], 1
je 0x10019f0a
call fcn.10024470
mov eax, dword [0x100457d4]
cmp byte [eax + 0x65], 1
jne 0x10019f30
push dword [0x100452bc]
push dword [0x100452b8]
push ecx
mov ecx, 0x1004531c
call fcn.100214c0
test eax, eax
je 0x10019f47
mov byte [0x100452c1], 1
mov bl, 1
mov byte [0x100457d8], 1
push str._bSyae_____Protect__n
jmp 0x10019f4c
push str._bSyae______Protect__n
call fcn.10001e40
mov al, bl
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret