Function at 0x100b8902
Capabilities:
Create process on windows

Disassembly:
push 0x68
mov eax, 0x100e562b
call fcn.100c745c
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi], ebx
je 0x100b8ab1
mov eax, 0x101706a0
push eax
mov dword [ebp - 0x74], eax
call sub.MSVCP140.dll__Mtx_lock
push eax
call fcn.100b5c25
pop ecx
pop ecx
mov al, byte [0x10170741]
mov dword [ebp - 4], ebx
test al, al
je 0x100b8a98
mov ecx, dword [esi]
lea eax, [ebp - 0x6c]
push edi
push eax
mov ecx, dword [ecx + 0xc]
call fcn.1001678b
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
add eax, 4
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.100b5c25
mov byte [ebp - 4], 3
cmp dword [ebp - 0x5c], ebx
jne 0x100b89a8
mov ecx, dword [esi]
push 0x1f
add ecx, 0xd0
push str.abort::__post_spinner_empty_wf_
call fcn.100b5c25
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100b8a84
push ebx
push ebx
push 0x10
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100b8a84
lea eax, [ebp - 0x19]
mov byte [ebp - 0x19], bl
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1009c67a
add esp, 0xc
cmp byte [ebp - 0x19], 0
mov byte [ebp - 4], 5
je 0x100b8be5
mov ecx, dword [ebp - 0x18]
push str.LOCALLY_STORED_WORKFLOW
call fcn.10021680
mov ecx, eax
call fcn.100b5c25
test eax, eax
jne 0x100b8ab9
mov eax, dword [esi]
add eax, 0xe8
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.100c2610
add esp, 0x10
cmp dword [ebp - 0x14], 0
mov ecx, dword [esi]
mov byte [ebp - 4], 6
je 0x100b8a3c
lea eax, [ebp - 0x14]
add ecx, 0x14
push eax
call fcn.100b5c25
cmp dword [ebp - 0x14], 0
je 0x100b8be5
push dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call fcn.100b5c25
jmp 0x100b8be5
push 0x18
add ecx, 0xd0
push str.abort::__resource_error_
call fcn.100b5c25
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100b8a62
push ebx
push ebx
push 0x10
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 0x14], 0
je 0x100b8a73
push dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call fcn.100b5c25
cmp dword [ebp - 0x18], 0
je 0x100b8a84
push dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
call fcn.100b5c25
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x100b8a90
call fcn.10020a90
lea ecx, [ebp - 0x6c]
call fcn.100090b6
mov dword [ebp - 4], 7
push 0x101706a0
call sub.MSVCP140.dll__Mtx_unlock
push eax
call fcn.100b5c25
pop ecx
pop ecx
call fcn.100c7406
ret 4
push dword [ebp - 0x18]
call fcn.100b5c25
pop ecx
test al, al
je 0x100b8b0f
mov eax, dword [esi]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], ebx
add eax, 0xc
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
call fcn.100b5c25
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.100c3953
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x100b8b0f
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.100b5c25
cmp dword [ebp - 0x14], 0
je 0x100b8b0f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call fcn.100b5c25
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
add ecx, 0x14
call fcn.100b5c25
mov ecx, dword [esi]
push str.SYSTEM_BROWSER_WORKFLOW
mov ecx, dword [ecx + 0x14]
call fcn.10021680
mov ecx, eax
call fcn.100b5c25
test eax, eax
jne 0x100b8be5
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x14]
call fcn.1002bfe3
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
call fcn.100b5c25
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.100b5c25
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
pop ecx
cmovae eax, dword [ebp - 0x3c]
pop ecx
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
mov ecx, esp
push 0x100eadb0
call fcn.100b5c25
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x14]
call fcn.1009e65c
mov eax, dword [ebp - 0x28]
cmp eax, 8
jb 0x100b8bc5
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x3c]
call fcn.100b5c25
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], edi
cmp eax, 0x10
jb 0x100b8be5
inc eax
push eax
push dword [ebp - 0x54]
call fcn.100b5c25
pop ecx
pop ecx
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
je 0x100b8bfa
push dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
call fcn.100b5c25
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x14]
call fcn.1002bfe3
mov ecx, dword [esi]
cmp dword [eax + 0x10], ebx
jne 0x100b8c2e
push 0x20
add ecx, 0xd0
push str.abort::__post_spinner_empty_url_
call fcn.100b5c25
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100b8cc9
push ebx
push ebx
push 0x10
jmp 0x100b8caa
mov ecx, dword [ecx + 0x14]
call fcn.1009dce4
mov ecx, dword [esi]
test eax, eax
je 0x100b8c67
mov ecx, dword [ecx + 0x14]
call fcn.1009dce4
mov ecx, eax
call fcn.10008dd0
mov ecx, dword [esi]
push eax
mov ecx, dword [ecx + 0x14]
call fcn.1009dce4
mov ecx, eax
call fcn.1000a4af
mov ecx, dword [esi]
push eax
call fcn.100b8ea0
jmp 0x100b8c6c
call fcn.100b8df9
cmp dword [ebp - 0x24], 0
je 0x100b8cb5
push 0x18
call fcn.100b5c25
mov edi, eax
pop ecx
mov dword [ebp - 0x70], edi
mov byte [ebp - 4], 0xa
test edi, edi
je 0x100b8c9b
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x14]
call fcn.1002bfe3
push eax
mov ecx, edi
call fcn.100b5c25
mov ebx, eax
mov eax, dword [ebp - 0x24]
push ebx
push 1
mov byte [ebp - 4], 3
push 0x401
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100b8cc9
mov ecx, dword [esi]
push 0x1b
add ecx, 0xd0
push str.abort::__postspinner_error_
call fcn.100b5c25
mov ecx, dword [esi]
xor al, al
add ecx, 0x100
xchg byte [ecx], al
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x100b8ce1
call fcn.10020a90
lea ecx, [ebp - 0x6c]
call fcn.100090b6
mov dword [ebp - 4], 0xb
jmp 0x100b8a9f