Function at 0x100caf4
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x5a10
call fcn.010171f0
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [0x102f234], esi
mov dword [ebp - 0x5a10], 0x643
call fcn.0101042e
test al, al
jne 0x100cb74
push 0x17e4
call fcn.010100f3
xor ebx, ebx
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x100cb6a
push 0x1001638
push ebx
push eax
call fcn.01015821
mov ecx, dword [0x102f248]
add esp, 0xc
cmp ecx, ebx
je 0x100cb64
push 1
call fcn.0100ca32
mov dword [0x102f248], ebx
mov eax, 0x643
jmp 0x100ce36
push 0xc
call fcn.010161d8
xor ebx, ebx
cmp eax, ebx
pop ecx
je 0x100cb8b
mov ecx, eax
call fcn.0101564a
jmp 0x100cb8d
xor eax, eax
cmp eax, ebx
mov dword [0x102f248], eax
jne 0x100cba2
push 0x17ec
call fcn.010100f3
jmp 0x100cb3b
push 1
push edi
mov ecx, eax
call fcn.010158f9
test eax, eax
je 0x100cbb7
push 0x17ee
jmp 0x100cb9b
push edi
call fcn.0100c669
cmp byte [0x102f224], bl
je 0x100cc31
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x2800
lea eax, [ebp - 0x5a0c]
push eax
push 0x17f6
push dword [0x102f234]
call esi
test eax, eax
jle 0x100cc26
push 0x400
lea eax, [ebp - 0xa0c]
push eax
push 0x17db
push dword [0x102f234]
call esi
test eax, eax
jle 0x100cc26
push 0x40
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x5a0c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x5a10], 0xf0f6
mov eax, dword [ebp - 0x5a10]
jmp 0x100ce36
call fcn.0100c768
call fcn.0101099b
test al, al
jne 0x100cc49
push 0x17e0
jmp 0x100cb9b
call fcn.01010693
test al, al
je 0x100cc3f
call fcn.0101095e
test al, al
jne 0x100cc65
push 0x17e2
jmp 0x100cb9b
call fcn.0101045b
test al, al
je 0x100cc3f
call fcn.01010872
test al, al
jne 0x100cc81
push 0x17e5
jmp 0x100cb9b
call fcn.01010a6c
test al, al
je 0x100cc94
push 0x17e3
jmp 0x100cb9b
call fcn.01010aa5
test al, al
je 0x100cca7
push 0x17ea
jmp 0x100cb9b
call fcn.0100c928
test al, al
jne 0x100ccba
push 0x17dc
jmp 0x100cb9b
call fcn.0101021f
test al, al
je 0x100cc3f
call fcn.0100e3ba
test al, al
je 0x100ccda
push 0x17dd
jmp 0x100cb9b
call fcn.010104ef
test al, al
jne 0x100ccd0
call fcn.01010520
test al, al
je 0x100ccf6
push 0x17e1
jmp 0x100cb9b
call fcn.010148a1
test al, al
jne 0x100cd06
call fcn.0100c9d1
jmp 0x100ccd0
cmp byte [0x102f225], bl
je 0x100cd39
push ebx
call fcn.0100f151
cmp byte [0x102f22a], bl
mov esi, eax
jne 0x100cd95
cmp esi, ebx
je 0x100cd95
cmp esi, 0xbc2
je 0x100cd95
cmp dword [0x102f238], ebx
je 0x100cd9d
mov esi, 0x643
jmp 0x100cd95
push 0x60
call fcn.010161d8
cmp eax, ebx
pop ecx
je 0x100cd59
movzx ecx, byte [0x102f226]
push ecx
push esi
mov ecx, eax
call fcn.010152e7
mov esi, eax
jmp 0x100cd5b
xor esi, esi
cmp esi, ebx
jne 0x100cd69
call fcn.0100c9d1
jmp 0x100cc3f
mov ecx, esi
call fcn.0100c63f
push 1
mov ecx, esi
mov edi, eax
call fcn.0100ca58
cmp edi, 1
je 0x100cd8f
call fcn.0100c9d1
push 0x17ed
jmp 0x100cb9b
mov esi, dword [ebp - 0x5a10]
cmp dword [0x102f238], ebx
jne 0x100cdec
cmp byte [0x102f228], bl
jne 0x100cdec
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100cdec
push 0x10015e0
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100ca7e
test eax, eax
jl 0x100cdec
push 5
push ebx
push 0x10015c8
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.0100c9d1
cmp byte [0x102f227], bl
jne 0x100ce06
cmp byte [0x102f228], bl
je 0x100ce06
call fcn.0100c8b4
mov eax, dword [0x102f22c]
cmp eax, ebx
je 0x100ce1c
push eax
call fcn.01016242
pop ecx
mov dword [0x102f22c], ebx
cmp dword [0x102f238], ebx
jne 0x100ce34
mov al, byte [0x102f228]
neg al
sbb eax, eax
and eax, 0xbc2
jmp 0x100ce36
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010171cf
leave
ret 0x10