Function at 0x10002349
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10031085
mov eax, dword fs:[0]
push eax
sub esp, 0x3a8
mov eax, dword [0x1003c030]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
push esi
push edi
mov eax, dword [0x1003c030]
xor eax, esp
push eax
lea eax, [esp + 0x3b8]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [esp + 0x74]
call fcn.1000399e
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x15c]
xor edi, edi
push eax
mov dword [esp + 0x3c8], edi
call fcn.100167aa
pop ecx
pop ecx
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [esp + 0x78]
mov byte [esp + 0x3c8], 2
call fcn.10003e16
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x140]
call fcn.100011c6
pop ecx
mov byte [esp + 0x3c0], 3
cmp dword [eax + 0x18], 8
jb 0x100023f1
mov eax, dword [eax + 4]
jmp 0x100023f4
add eax, 4
push eax
push str.RunAsUser:_ls
call fcn.10017419
pop ecx
pop ecx
push edi
push ebx
lea esi, [esp + 0x144]
call fcn.10003f0e
push edi
push edi
lea eax, [esp + 0x24]
call fcn.1000e9d9
lea eax, [esp + 0x8c]
push eax
mov byte [esp + 0x3c4], 6
call fcn.1000a9f7
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x15c]
push ecx
push eax
mov byte [esp + 0x3cc], 7
call fcn.1000aa5b
lea eax, [esp + 0x8c]
mov byte [esp + 0x3c0], 6
call fcn.1000281c
lea eax, [esp + 0x1c]
push eax
mov edx, str.filePath
call fcn.1000ec75
push eax
lea ecx, [esp + 0x58]
call fcn.1000df2b
push eax
lea ecx, [esp + 0x124]
mov byte [esp + 0x3c4], 8
call fcn.100011c6
pop ecx
push edi
push ebx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x3c8], 0xa
call fcn.10003e16
cmp dword [esp + 0x138], 8
mov eax, dword [esp + 0x124]
jae 0x100024b8
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100024ee
cmp dword [esp + 0x138], 8
mov eax, dword [esp + 0x124]
jae 0x100024dc
lea eax, [esp + 0x124]
push eax
push str.invalid_file:_ls
call fcn.10017419
pop ecx
pop ecx
jmp 0x100027c9
lea eax, [esp + 0x1c]
push eax
mov edx, str.exec
call fcn.1000ec75
mov esi, eax
call fcn.1000e022
dec eax
neg eax
sbb al, al
inc al
je 0x1000259f
lea eax, [esp + 0x1c]
push eax
mov edx, str.argv
call fcn.1000ec75
push eax
lea ecx, [esp + 0x140]
call fcn.1000df2b
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x3c4], 0xb
call fcn.100011c6
cmp dword [eax + 0x18], 8
pop ecx
jb 0x10002552
mov eax, dword [eax + 4]
jmp 0x10002555
add eax, 4
cmp dword [esp + 0x138], 8
mov ecx, dword [esp + 0x124]
jae 0x1000256d
lea ecx, [esp + 0x124]
push 5
push edi
push eax
push ecx
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push ebx
lea esi, [esp + 0x40]
call fcn.10003f0e
push edi
push ebx
lea ecx, [esp + 0x144]
mov byte [esp + 0x3c8], 0xa
call fcn.10003e16
lea eax, [esp + 0x1c]
push eax
mov edx, str.alert
call fcn.1000ec75
mov esi, eax
call fcn.1000e022
dec eax
neg eax
sbb al, al
inc al
jne 0x100025cd
push str.no_need_alert
call fcn.10017419
jmp 0x100024e8
lea eax, [esp + 0x1c]
push eax
mov edx, str.message
call fcn.1000ec75
push eax
lea ecx, [esp + 0x3c]
call fcn.1000df2b
push eax
lea ecx, [esp + 0x178]
mov byte [esp + 0x3c4], 0xc
call fcn.100011c6
pop ecx
push edi
push ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x3c8], 0xe
call fcn.10003e16
cmp dword [esp + 0x138], 8
mov eax, dword [esp + 0x124]
jae 0x10002627
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov dword [esp + 0x18], 0x10034aec
test eax, eax
jne 0x10002642
mov dword [esp + 0x18], 0x10034af4
cmp dword [esp + 0x138], 8
mov esi, dword [esp + 0x124]
mov eax, esi
jae 0x1000265e
lea eax, [esp + 0x124]
mov esi, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push dword [esp + 0x1c]
lea ecx, [esp + 0x198]
push esi
push str._ls_
call fcn.100063d6
add esp, 0x10
mov byte [esp + 0x3c0], 0xf
cmp dword [esp + 0x188], edi
je 0x100026e3
cmp dword [esp + 0x18c], 8
mov eax, dword [esp + 0x178]
jae 0x100026a8
lea eax, [esp + 0x178]
push eax
push 0x10034b28
lea ecx, [esp + 0x40]
call fcn.100063d6
pop ecx
pop ecx
push 0xffffffffffffffff
push edi
lea esi, [esp + 0x198]
mov byte [esp + 0x3c8], 0x10
call fcn.1000442a
push edi
push ebx
lea esi, [esp + 0x40]
mov byte [esp + 0x3c8], 0xf
call fcn.10003f0e
mov ecx, dword [0x1003f000]
xor eax, eax
mov word [esp + 0x1ac], ax
push 0x100
lea eax, [esp + 0x1b0]
push eax
mov ebx, str.wfchost.exe
call fcn.100059be
lea eax, [esp + 0x190]
push eax
lea eax, [esp + 0x140]
push eax
call fcn.10001206
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x3d0], 0x11
call fcn.10016756
add esp, 0x10
mov byte [esp + 0x3c0], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x10002748
mov eax, dword [eax + 4]
jmp 0x1000274b
add eax, 4
push eax
lea eax, [esp + 0x1b0]
push eax
push str._ls__filedp__hs
lea ecx, [esp + 0x44]
call fcn.100063d6
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x10002770
mov eax, dword [eax + 4]
jmp 0x10002773
add eax, 4
push eax
call fcn.10005ecc
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
call fcn.100011b0
xor ebx, ebx
push edi
inc ebx
push ebx
lea esi, [esp + 0x40]
call fcn.10003f0e
push edi
push ebx
lea ecx, [esp + 0x5c]
call fcn.10003e16
push edi
push ebx
lea ecx, [esp + 0x144]
call fcn.10003e16
push edi
push ebx
lea esi, [esp + 0x198]
call fcn.10003f0e
push edi
push ebx
lea esi, [esp + 0x17c]
call fcn.10003f0e
push edi
push ebx
lea esi, [esp + 0x128]
call fcn.10003f0e
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c0], 2
call fcn.1000dd5c
push edi
push ebx
lea ecx, [esp + 0x160]
call fcn.10003e16
mov ecx, dword [esp + 0x3b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a0]
xor ecx, esp
call fcn.1001997f
mov esp, ebp
pop ebp
ret 0x10