Function at 0x101b9f60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2084
call fcn.10212f90
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push str.2559a1f4_21d7_11d4_bdaf_00c04f60b9f0
push ebx
mov dword [ebp - 0x2050], ebx
mov dword [ebp - 0x2018], 0
mov dword [ebp - 0x2014], 0
call fcn.102134f3
add esp, 8
test eax, eax
jne 0x101b9fbd
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
cmp dword [0x1025a35c], 0
push esi
push edi
je 0x101ba1d5
call fcn.100e9430
test eax, eax
jne 0x101ba7c3
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartPage
lea eax, [ebp - 0x2018]
mov dword [ebp - 0x2010], 0xffffffff
push SysReAllocString
push eax
mov ecx, eax
call fcn.10004230
cmp dword [ebp - 0x2014], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x2008], 0
je 0x101ba09c
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba06e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba047
mov eax, dword [eax + 0x110]
jmp 0x101ba049
xor eax, eax
test eax, eax
je 0x101ba06e
lea ecx, [ebp - 0x2008]
push ecx
push 0
lea ecx, [ebp - 0x201c]
push ecx
push 0
push str.Favorites
push dword [ebp - 0x2014]
call eax
jmp 0x101ba08d
lea eax, [ebp - 0x2008]
push eax
push 0
lea eax, [ebp - 0x201c]
push eax
push 0
push str.Favorites
push dword [ebp - 0x2014]
call esi
test eax, eax
jne 0x101ba09c
mov edi, dword [ebp - 0x2018]
jmp 0x101ba11c
mov edi, dword [ebp - 0x2018]
test edi, edi
je 0x101ba11c
mov dword [ebp - 0x2008], 0
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba0fc
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba0d4
mov eax, dword [eax + 0x110]
jmp 0x101ba0d6
xor eax, eax
test eax, eax
je 0x101ba0fc
mov edi, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2008]
push ecx
push 0
lea ecx, [ebp - 0x201c]
push ecx
push 0
push str.Favorites
push edi
call eax
jmp 0x101ba11c
mov edi, dword [ebp - 0x2018]
lea eax, [ebp - 0x2008]
push eax
push 0
lea eax, [ebp - 0x201c]
push eax
push 0
push str.Favorites
push edi
call esi
cmp dword [ebp - 0x2008], 0
je 0x101ba218
mov eax, dword [ebp - 0x2008]
add eax, 8
push 0x1025abd4
push eax
call fcn.101e2340
mov ebx, eax
add esp, 8
mov dword [ebp - 0x2030], ebx
test ebx, ebx
jne 0x101ba1ea
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x101ba196
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba18e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba17e
mov eax, dword [eax + 0x11c]
jmp 0x101ba180
xor eax, eax
test eax, eax
je 0x101ba18e
push dword [ebp - 0x2018]
call eax
jmp 0x101ba196
push dword [ebp - 0x2018]
call esi
cmp dword [ebp - 0x2014], 0
je 0x101ba1d5
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba1cd
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba1c3
mov eax, dword [eax + 0x11c]
jmp 0x101ba1c5
xor eax, eax
test eax, eax
jne 0x101ba29d
push dword [ebp - 0x2014]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x2008]
add eax, 8
push 0x1025abd4
push eax
call fcn.101e2340
add esp, 8
mov dword [ebp - 0x202c], eax
test eax, eax
jne 0x101ba2aa
push ebx
call fcn.10213517
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x101ba25e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba256
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba246
mov eax, dword [eax + 0x11c]
jmp 0x101ba248
xor eax, eax
test eax, eax
je 0x101ba256
push dword [ebp - 0x2018]
call eax
jmp 0x101ba25e
push dword [ebp - 0x2018]
call esi
cmp dword [ebp - 0x2014], 0
je 0x101ba1d5
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba1cd
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba293
mov eax, dword [eax + 0x11c]
jmp 0x101ba295
xor eax, eax
test eax, eax
je 0x101ba1cd
push dword [ebp - 0x2014]
call eax
jmp 0x101ba1d5
cmp dword [ebp - 0x2014], 0
mov eax, dword [ebp - 0x2008]
mov dword [ebp - 0x2034], eax
je 0x101ba337
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba309
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba2e3
mov eax, dword [eax + 0x110]
jmp 0x101ba2e5
xor eax, eax
test eax, eax
je 0x101ba309
lea ecx, [ebp - 0x2008]
push ecx
push ebx
lea ecx, [ebp - 0x201c]
push ecx
push 0
push str.Favorites
push dword [ebp - 0x2014]
call eax
jmp 0x101ba327
lea eax, [ebp - 0x2008]
push eax
push ebx
lea eax, [ebp - 0x201c]
push eax
push 0
push str.Favorites
push dword [ebp - 0x2014]
call esi
mov edi, dword [ebp - 0x2018]
test eax, eax
je 0x101ba3ab
mov eax, dword [ebp - 0x2034]
test edi, edi
je 0x101ba3ab
mov dword [ebp - 0x2008], eax
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba38c
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba365
mov eax, dword [eax + 0x110]
jmp 0x101ba367
xor eax, eax
test eax, eax
je 0x101ba38c
mov edi, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2008]
push ecx
push ebx
lea ecx, [ebp - 0x201c]
push ecx
push 0
push str.Favorites
push edi
call eax
jmp 0x101ba3ab
mov edi, dword [ebp - 0x2018]
lea eax, [ebp - 0x2008]
push eax
push ebx
lea eax, [ebp - 0x201c]
push eax
push 0
push str.Favorites
push edi
call esi
push 0x2000
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2034], 0
push 0
push eax
call fcn.102134e7
mov eax, dword [ebp - 0x202c]
lea esi, [ebx + 1]
mov ebx, dword [esi]
add esp, 0xc
mov dword [ebp - 0x2028], eax
mov eax, dword [ebp - 0x2008]
add eax, dword [ebp - 0x2030]
lea ecx, [ebx + esi]
cmp ecx, eax
ja 0x101ba6f4
xor eax, eax
lea edx, [ebp - 0x2020]
push edx
mov word [ebp - 0x2004], ax
add esi, 4
mov dword [ebp - 0x2020], eax
mov eax, dword [0x1025a35c]
push 1
push 0
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x2020], 0
je 0x101ba5c9
push 0
lea ecx, [ebp - 0x2084]
call fcn.100f3000
push dword [ebp - 0x2020]
lea ecx, [ebp - 0x2084]
call fcn.100f3790
mov eax, dword [ebp - 0x2020]
lea edx, [ebp - 0x204c]
push edx
mov dword [ebp - 0x2044], 0
lea edx, [ebp - 0x2044]
mov dword [ebp - 0x204c], 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
push 0x14
mov dword [ebp - 0x2040], 0
mov dword [ebp - 0x203c], 0
call fcn.10213511
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
cmp dword [ebp - 0x2044], 0
mov dword [ebp - 0x2040], eax
jne 0x101ba4e4
mov eax, dword [ebp - 0x2078]
cmp dword [eax - 0xc], 0
je 0x101ba4e4
push 0xfff
push eax
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.1020ed30
add esp, 0x10
xor eax, eax
mov word [ebp - 0x1dfe], ax
jmp 0x101ba58b
mov eax, dword [ebp - 0x2020]
lea edx, [ebp - 0x2024]
mov dword [ebp - 0x2024], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x2024]
mov dword [ebp - 0x2048], 0
test eax, eax
je 0x101ba58b
mov ecx, dword [eax]
lea edx, [ebp - 0x2048]
push edx
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x2048], 0
jbe 0x101ba57b
mov eax, dword [ebp - 0x2024]
lea edx, [ebp - 0x2038]
push edx
mov dword [ebp - 0x2038], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
push 0xfff
push dword [ebp - 0x2038]
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.1020ed30
add esp, 0x10
xor eax, eax
mov word [ebp - 6], ax
push dword [ebp - 0x2038]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x2024]
test eax, eax
je 0x101ba58b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2040]
push dword [eax + 4]
lea eax, [ebp - 0x2040]
push eax
mov ecx, eax
call fcn.10020c80
push 0x14
push dword [ebp - 0x2040]
call fcn.102134ff
add esp, 8
push dword [ebp - 0x204c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x2084]
call fcn.100f3200
push dword [ebp - 0x2050]
lea eax, [ebp - 0x2004]
push eax
call fcn.102134f3
add esp, 8
test eax, eax
je 0x101ba60b
lea eax, [ebx + 5]
push eax
lea eax, [esi - 5]
push eax
push dword [ebp - 0x2028]
call fcn.102134e1
mov eax, dword [ebp - 0x2028]
add esp, 0xc
add eax, 5
add eax, ebx
mov dword [ebp - 0x2028], eax
jmp 0x101ba615
mov dword [ebp - 0x2034], 1
mov eax, dword [ebp - 0x2030]
add esi, ebx
mov edx, dword [ebp - 0x2008]
add eax, edx
cmp esi, eax
jae 0x101ba65d
cmp byte [esi], 0xff
je 0x101ba65d
mov eax, dword [ebp - 0x2020]
test eax, eax
je 0x101ba644
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2008]
mov ebx, dword [esi + 1]
inc esi
mov eax, dword [ebp - 0x2030]
add eax, edx
lea ecx, [ebx + esi]
cmp ecx, eax
jbe 0x101ba3f3
jmp 0x101ba66d
mov eax, dword [ebp - 0x2020]
test eax, eax
je 0x101ba66d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp - 0x2034]
mov esi, dword [ebp - 0x202c]
test ebx, ebx
je 0x101ba6fc
mov ebx, dword [ebp - 0x2028]
or eax, 0xffffffff
sub ebx, esi
test edi, edi
je 0x101ba6eb
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba6d3
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba6b0
mov eax, dword [eax + 0x118]
jmp 0x101ba6b2
xor eax, eax
test eax, eax
je 0x101ba6d3
mov edi, dword [ebp - 0x2018]
push ebx
push esi
push 3
push 0
push str.Favorites
push edi
call eax
xor ebx, ebx
test eax, eax
sete bl
jmp 0x101ba6fc
mov edi, dword [ebp - 0x2018]
push ebx
push esi
push 3
push 0
push str.Favorites
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
jmp 0x101ba6fc
mov esi, dword [ebp - 0x202c]
xor ebx, ebx
push dword [ebp - 0x2030]
call fcn.10213517
push esi
call fcn.10213517
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
test edi, edi
je 0x101ba756
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba74e
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba73e
mov eax, dword [eax + 0x11c]
jmp 0x101ba740
xor eax, eax
test eax, eax
je 0x101ba74e
push dword [ebp - 0x2018]
call eax
jmp 0x101ba756
push dword [ebp - 0x2018]
call esi
cmp dword [ebp - 0x2014], 0
je 0x101ba7ae
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba7a6
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x101ba783
mov eax, dword [eax + 0x11c]
jmp 0x101ba785
xor eax, eax
test eax, eax
je 0x101ba7a6
push dword [ebp - 0x2014]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x2014]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push ebx
push str.startunpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4