Function at 0x5001200
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Get common file path
Get disk information
Get disk size
Get file attributes
Terminate process

Disassembly:
sub esp, 0xb4
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], 0x5c3a63
mov byte [esp + 0x13], 0x63
mov dword [esp + 0x28], ebx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x5016320], eax
call fcn.05002212
mov esi, 0x5016328
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, esi
cmp ecx, esi
jbe 0x5001263
lea eax, [ecx - 1]
cmp byte [eax], 0x5c
je 0x5001263
mov ecx, eax
jmp 0x5001253
push ecx
call fcn.05001d1e
mov esi, eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, eax
xor ecx, ecx
mov dword [esp + 0x34], ebp
mov al, byte [ebp]
cmp al, 0x20
je 0x500128c
cmp al, 9
je 0x500128c
cmp al, 0x22
jne 0x5001296
cmp al, 0x22
jne 0x5001293
xor ecx, ecx
inc ecx
inc ebp
jmp 0x500127d
cmp ecx, ebx
mov dword [esp + 0x34], ebp
je 0x50012b4
mov cl, byte [ebp]
mov eax, ebp
cmp cl, bl
je 0x50012b4
cmp cl, 0x22
je 0x50012b1
inc eax
mov cl, byte [eax]
jmp 0x50012a3
mov byte [eax], 0x20
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ebp - 1]
cmp eax, ebp
jb 0x50012d9
mov cl, byte [eax]
cmp cl, 0x20
je 0x50012d4
cmp cl, 9
jne 0x50012d9
mov byte [eax], bl
dec eax
jmp 0x50012c4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [section..zero], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], ebx
lea edx, [ecx + esi - 1]
cmp edx, esi
jbe 0x5001327
cmp byte [edx], 0x2e
je 0x50012ff
dec edx
jmp 0x50012f3
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov esi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, section..zero
mov dword [esp + 0x20], ecx
inc ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edx], bl
cmp byte [ebp], bl
mov dword [esp + 0x2c], 0x50010d4
mov dword [esp + 0x14], ebp
je 0x500142a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov al, byte [eax]
mov cl, byte [ecx]
or al, 0x20
or cl, 0x20
cmp cl, al
jne 0x5001414
mov eax, dword [esp + 0x14]
lea ebp, [eax + 1]
mov eax, dword [esp + 0x1c]
lea esi, [eax + 1]
mov al, byte [esi]
mov dl, byte [ebp]
mov cl, al
or dl, 0x20
or cl, 0x20
cmp cl, dl
jne 0x500137c
cmp al, bl
je 0x5001384
inc ebp
inc esi
jmp 0x5001363
cmp byte [esi], bl
jne 0x5001414
cmp byte [ebp], 0x2e
mov dword [esp + 0x24], ebx
jne 0x50013ab
mov ecx, dword [esp + 0x20]
mov edi, section..zero
mov esi, ebp
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x50013ab
add ebp, dword [esp + 0x20]
mov dword [esp + 0x24], 1
mov al, byte [ebp]
cmp al, 0x20
je 0x50013ba
cmp al, 9
je 0x50013ba
cmp al, bl
jne 0x5001414
mov esi, dword [esp + 0x34]
mov eax, ebp
sub eax, esi
mov edi, 0x5006104
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [esp + 0x24], ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + 0x5006104]
mov byte [edi], bl
jne 0x5001405
mov ecx, dword [esp + 0x20]
mov esi, section..zero
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov byte [eax + ecx + 0x5006104], bl
push 0x5006104
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x5001426
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp byte [eax], bl
jne 0x500133c
jmp 0x500142a
mov dword [esp + 0x2c], ebp
mov edx, dword [esp + 0x2c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x500147c
lea eax, [ecx - 2]
cmp eax, ebx
jbe 0x500147c
mov ecx, dword [edx]
and ecx, 0xffdffdff
or ecx, 0x20000000
cmp ecx, 0x20582d20
jne 0x5001466
mov dword [0x501642c], 1
cmp ecx, 0x20552d20
jne 0x5001478
mov dword [0x5006208], 1
inc edx
dec eax
jne 0x5001446
mov eax, dword [0x50010c4]
and ax, 0
cmp eax, 0xcab00000
jne 0x5001496
push 0x20000001
call fcn.05001f1a
test byte [0x50010c7], 0x80
jne 0x50014a9
mov dword [0x501642c], 1
and byte [0x50010c7], 0x7f
cmp dword [0x5006208], ebx
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jne 0x5001542
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5016324], eax
lea eax, [esp + 0x54]
push eax
push ebx
push ebx
push 0x5002080
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x50014f0
push 8
call fcn.05001f1a
push 0xffffffffffffffff
push dword [0x5016324]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x1c]
push ebx
push 0xc
push 0x68
push dword [0x5016430]
call ebp
mov eax, dword [0x50010c0]
add eax, 0xffff
shr eax, 0x10
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5016430]
call ebp
push ebx
push 1
push 0x404
push 0x6a
push dword [0x5016430]
call ebp
push ebx
push ebx
push 0x5016328
call fcn.05001d84
mov esi, dword [0x50010c0]
or dword [esp + 0x28], 0xffffffff
add esp, 0xc
cmp esi, ebx
mov dword [esp + 0x14], eax
je 0x50015bd
mov eax, 0x10000
mov edi, esi
cmp esi, eax
jbe 0x5001571
mov edi, eax
push edi
push 0x5006210
push dword [esp + 0x1c]
call fcn.05001de2
add esp, 0xc
push edi
push 0x5006210
push dword [esp + 0x24]
call fcn.05002241
cmp dword [0x5006208], ebx
mov dword [esp + 0x1c], eax
jne 0x50015b3
mov eax, dword [0x5016430]
cmp eax, ebx
je 0x50015c7
push ebx
push ebx
push 0x405
push 0x6a
push eax
call ebp
sub esi, edi
jne 0x5001564
cmp dword [esp + 0x1c], ebx
je 0x50015d1
push 0x20000001
call fcn.05001f1a
push 0x4c7
call fcn.05001f1a
lea eax, [esp + 0x74]
push eax
push ebx
push fcn.05001e32
push 0x5001dc3
push 0x5001e0a
push fcn.05001de2
push fcn.05001d84
push 0x5001d71
push fcn.05001d53
call fcn.05002274
push ebx
push ebx
push dword [esp + 0x40]
mov dword [esp + 0x54], eax
call fcn.05001e32
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x48]
push dword [esp + 0x5c]
call fcn.05002307
add esp, 0x3c
test eax, eax
jne 0x5001634
push 0x20000001
call fcn.05001f1a
cmp dword [0x5006208], ebx
jne 0x5001663
push ebx
push dword [0x5016430]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x5006208], ebx
jne 0x5001663
cmp dword [0x501642c], ebx
je 0x5001663
mov esi, 0x5016214
jmp 0x5001720
mov byte [esp + 0x18], 0x61
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x500167d
cmp eax, 6
jne 0x50016c8
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x50016c8
mov eax, dword [esp + 0x40]
xor ecx, ecx
imul eax, dword [esp + 0x38]
mul dword [esp + 0x3c]
or ecx, edx
je 0x50016b6
or eax, 0xffffffff
cmp eax, dword [esp + 0x28]
jbe 0x50016c8
mov dword [esp + 0x28], eax
mov al, byte [esp + 0x18]
mov byte [esp + 0x13], al
inc byte [esp + 0x18]
cmp byte [esp + 0x18], 0x7a
jle 0x5001668
mov al, byte [esp + 0x13]
mov esi, 0x5016214
mov byte [esp + 0x18], al
push esi
lea eax, [esp + 0x1c]
push 0x50010c8
push eax
call fcn.05001be9
push eax
mov eax, dword [0x50010c0]
and eax, 0xffff
push eax
call fcn.05001e5d
push esi
call fcn.05001c83
test eax, eax
jne 0x500172c
push esi
mov byte [0x501621c], 0x5f
call fcn.05001c83
test eax, eax
jne 0x500172c
mov dword [esp + 0x28], ebx
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [0x5006208], ebx
jne 0x500188c
cmp dword [0x501642c], ebx
jne 0x5001752
mov eax, dword [0x50010c0]
lea eax, [eax + eax*2]
cmp dword [esp + 0x28], eax
jae 0x500188c
push ebx
push 0x50020a8
push dword [0x5016430]
push 0x6b
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x500187b
cmp eax, ebx
je 0x5001882
cmp byte [eax], bl
je 0x5001882
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 0x5016214
mov edx, ecx
mov esi, edi
mov edi, eax
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.05001c83
test eax, eax
je 0x5001752
cmp dword [0x5006208], ebx
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov esi, section..zero
jne 0x500184f
push 0x104
push esi
push 0x20000004
push ebx
call edi
push 0x104
push 0x5006104
push 0x20000006
push ebx
call edi
push esi
push ebx
push 0xc
push 0x65
push dword [0x5016430]
call ebp
push 0x5006104
push ebx
push 0xc
push 0x66
push dword [0x5016430]
call ebp
push 0x5016214
push ebx
push 0xc
push 0x69
push dword [0x5016430]
call ebp
push ebx
push ebx
push 0x402
push 0x6a
push dword [0x5016430]
call ebp
movzx eax, word [esp + 0x62]
shl eax, 0x10
push eax
push ebx
push 0x401
push 0x6a
push dword [0x5016430]
call ebp
push 5
push dword [0x5016430]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
push 0x5001a2e
push ebx
push 0x50010d4
push 0x5016328
push dword [esp + 0x3c]
call fcn.05002396
add esp, 0x1c
test eax, eax
jne 0x50018a1
push 0x20000001
call fcn.05001f1a
push 0xffffffffffffffff
call fcn.05001f1a
push 0x4c7
call fcn.05001f1a
push esi
call fcn.05001c83
test eax, eax
jne 0x50017ae
push 0x52
call fcn.05001f1a
mov ecx, dword [0x5006208]
mov eax, dword [0x5016430]
cmp ecx, ebx
jne 0x50018be
cmp eax, ebx
jne 0x50018be
push 0x4c7
call fcn.05001f1a
cmp dword [0x5016434], ebx
je 0x50019ef
cmp dword [0x501642c], ebx
jne 0x50019ef
cmp ecx, ebx
jne 0x50018e8
push dword [0x501631c]
push ebx
push 0xc
push 0x68
push eax
call ebp
mov edi, dword [0x5016434]
or ecx, 0xffffffff
xor eax, eax
mov edx, section..zero
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x11
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
lea edi, [esp + 0x80]
rep stosd dword es:[edi], eax
inc eax
mov dword [esp + 0x80], 0x44
mov dword [esp + 0xac], eax
mov word [esp + 0xb0], ax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x84]
push eax
push dword [0x5016210]
push ebx
push 0x20
push ebx
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x500198c
push 0xffffffffffffffff
call fcn.05001f1a
cmp dword [0x5006208], ebx
jne 0x50019a1
push ebx
push dword [0x5016430]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x44]
push 0xffffffffffffffff
push eax
mov dword [0x5016318], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x30]
mov dword [0x5016318], ebx
push eax
mov dword [esp + 0x34], ebx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x48]
call esi
cmp dword [esp + 0x30], 0xcabf00d1
je 0x5001a1c
call fcn.05001f9b
jmp 0x5001a1c
cmp ecx, ebx
jne 0x5001a1c
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x104
push esi
push 0x20000002
push ebx
call edi
push 0x10030
push esi
push esi
push dword [0x5016430]
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]