Function at 0x1006a0f
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x284
mov eax, 0x100c65e
call fcn.01008b88
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24c], ebx
lea edi, [ebp - 0x248]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x28c]
push ebx
push eax
mov dword [ebp - 0x290], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1006ae9
cmp dword [0x100e144], ebx
je 0x1006c8e
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006a97
cmp al, bl
jne 0x1006c8e
mov ecx, dword [0x100e134]
mov esi, 0x40000000
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006c8e
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006c8e
cmp eax, ecx
jne 0x1006c8e
push 0x10012e8
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005eac
jmp 0x1006c8e
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x238]
call fcn.010069e3
push 0x10014b0
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], ebx
call fcn.01006989
call dword [sym.imp.ntdll.dll_NtIsUILanguageComitted]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
je 0x1006b8e
cmp dword [0x100e144], ebx
je 0x1006c5a
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006b3c
cmp al, bl
jne 0x1006c5a
mov ecx, dword [0x100e134]
mov esi, 0x40000000
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006c5a
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006c5a
cmp eax, ecx
jne 0x1006c5a
push 0x10012a8
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005eac
jmp 0x1006c5a
push 0x10014a8
call dword [sym.imp.msvcrt.dll__wcsdup]
pop ecx
mov dword [ebp - 0x23c], eax
cmp eax, ebx
je 0x1006c40
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x1006bbd
lea eax, [ebp - 0x234]
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x290]
push ecx
push ebx
push ebx
push 0x4000
push ebx
push ebx
push ebx
push dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1006c94
cmp dword [0x100e144], ebx
je 0x1006c40
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006bff
cmp al, bl
jne 0x1006c40
mov ecx, dword [0x100e134]
mov esi, 0x40000000
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006c40
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006c40
cmp eax, ecx
jne 0x1006c40
push 0x10012b8
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005eac
call fcn.01005fdb
cmp dword [ebp - 0x23c], ebx
je 0x1006c5a
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24c], ebx
je 0x1006c70
push dword [ebp - 0x24c]
call esi
cmp dword [ebp - 0x248], ebx
je 0x1006c80
push dword [ebp - 0x248]
call esi
push ebx
push 1
lea ecx, [ebp - 0x238]
call fcn.0100650f
call fcn.01008bdc
ret
mov esi, 0x40000000
mov edi, 0x10012c8
cmp dword [0x100e144], ebx
je 0x1006ceb
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006cb3
cmp al, bl
jne 0x1006ceb
mov ecx, dword [0x100e134]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006ceb
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006ceb
cmp eax, ecx
jne 0x1006ceb
push edi
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005eac
push dword [ebp - 0x24c]
call fcn.01006038
test eax, eax
jne 0x1006c40
cmp dword [0x100e144], ebx
je 0x1006c45
mov al, byte [0x100e148]
cmp al, 4
jae 0x1006d1b
cmp al, bl
jne 0x1006c45
mov ecx, dword [0x100e134]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x1006c45
mov ecx, dword [0x100e13c]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x100e138]
jne 0x1006c45
cmp eax, ecx
jne 0x1006c45
push edi
push dword [0x100e11c]
push dword [0x100e118]
call fcn.01005eac
jmp 0x1006c45