Function at 0x1000cbf0
Capabilities:
Get common file path
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1001860b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x66c
mov eax, dword [esp + 0x67c]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push eax
mov dword [esp + 0x30], ebp
call fcn.10008b50
xor ebx, ebx
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x34]
mov dword [esp + 0x30], ebx
mov byte [esp + 0x74], bl
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edi, [esp + 0x75]
mov dword [esp + 0x14], ecx
mov byte [esp + 0x178], bl
mov dword [esp + 0x18], ecx
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x179]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x10], edx
mov ecx, 0x11
stosb byte es:[edi], al
mov dword [esp + 0x14], edx
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x18], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x684], ebx
mov dword [ebp], 0x100192e8
mov word [esp + 0x20], 0x50
mov word [esp + 0x22], 0xc8
mov word [esp + 0x24], bx
mov word [esp + 0x26], bx
mov word [esp + 0x28], 0x4f
mov word [esp + 0x2a], 0x18
mov dword [esp + 0x1c], edx
call fcn.10007ef0
mov dword [ebp + 0x24], ebx
mov byte [ebp + 0x140], bl
cmp dword [0x10022c94], ebx
jne 0x1000ccf7
push ebx
push ebx
push ebx
push ebx
push 0x1000d6e0
push ebx
push ebx
call fcn.1000f8c0
mov dword [ebp + 0x24], eax
add esp, 0x1c
mov dword [0x10022c94], eax
lea eax, [esp + 0x74]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x74]
lea edx, [esp + 0x178]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, str.cmd.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x74]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x10022c98]
mov ecx, edx
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
jne 0x1000cd68
push str.mPsVC.eXE
call fcn.1000f940
add esp, 4
test eax, eax
jne 0x1000cdba
lea esi, [ebp + 0x3c]
mov byte [0x10022c98], bl
push esi
push 0x104
call fcn.10004150
add esp, 8
push str._setup.exe
push esi
call edi
push esi
call fcn.10004500
add esp, 4
test al, al
jne 0x1000cda1
push ebx
lea eax, [esp + 0x78]
push esi
push eax
call dword [0x100226f0]
push esi
call fcn.10004500
add esp, 4
test al, al
je 0x1000cdba
lea ecx, [esp + 0x74]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [0x1002262c]
test eax, eax
setne dl
push 0xfffffffffffffff5
mov byte [ebp + 0x140], dl
call dword [0x100225bc]
push 0xfffffffffffffff6
mov dword [ebp + 0x10], eax
call dword [0x100225bc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
mov dword [esp + 0x68], eax
lea eax, [esp + 0x30]
push eax
mov dword [ebp + 0x20], ecx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x70], ecx
call dword [0x10022628]
lea ecx, [esp + 0x74]
mov esi, 1
push 0x100211a4
push ecx
mov dword [esp + 0x38], 0x44
mov word [esp + 0x68], bx
mov dword [esp + 0x64], esi
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x17c]
push eax
push ecx
push ebx
push 0x20
push esi
push ebx
lea edx, [esp + 0x90]
push ebx
push edx
push ebx
call dword [0x1002276c]
test eax, eax
jne 0x1000ce64
mov ecx, dword [esp + 0x68c]
push esi
mov byte [0x10022c98], 1
call fcn.10002c10
jmp 0x1000cf1a
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x20]
push eax
push ecx
call dword [0x100225d8]
mov eax, dword [ebp + 0x20]
lea edx, [esp + 0x24]
push edx
push esi
push eax
call dword [0x100225d4]
mov ecx, dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push ecx
call dword [0x10022750]
push esi
push 0x1000cbe0
call dword [0x10022750]
push ebx
push ebx
call dword [0x10022750]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push ecx
mov dword [ebp + 0x28], edx
mov dword [ebp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [0x10022544]
lea edx, [esp + 0x27c]
push 0x400
push edx
mov ecx, ebp
mov dword [ebp + 0x30], eax
mov word [ebp + 0x34], 0xc8
mov byte [esp + 0x284], 0x80
mov byte [esp + 0x285], 3
call fcn.10008bd0
mov ecx, ebp
call fcn.10008c40
mov dword [ebp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ebx
push ebx
push ebp
push 0x1000d710
push ebx
push ebx
mov dword [ebp + 0x38], eax
call fcn.1000f8c0
add esp, 0x1c
mov dword [ebp + 0x1c], eax
mov ecx, dword [esp + 0x67c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x678
ret 4