Function at 0x100014d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x1002e288]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x100016d5
dec eax
jne 0x10001760
push 0x200
lea eax, [ebp - 0x30c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x30c]
push ecx
push str.Hook_DLL_loaded_by:__s
call section..text
mov edx, dword [ebp + 8]
add esp, 8
mov dword [0x1002f1e8], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10006680
add esp, 4
test eax, eax
je 0x10001589
push str.Hook_DLL_:_BtITunesPlugIn.exe_launch_to_begin_work
call section..text
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.10001270
add esp, 0xc
test eax, eax
jne 0x1000157c
push eax
push 0x1002668d
push 0x1002668d
lea ecx, [ebp - 0x108]
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x10001589
push str.Hook_DLL_:_getPathFilename_ItunesPlugins_Could_not_find_path_to_plugin
call section..text
add esp, 4
push ebx
push esi
push edi
lea edx, [ebp - 0x30c]
push 0x5c
push edx
call fcn.10009990
mov esi, eax
add esp, 8
test esi, esi
je 0x100015a6
inc esi
jmp 0x100015ac
lea esi, [ebp - 0x30c]
mov ecx, str.communicator.exe
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100015d3
test dl, dl
je 0x100015cf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100015d3
add eax, 2
add ecx, 2
test dl, dl
jne 0x100015b3
xor eax, eax
jmp 0x100015d8
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x10001619
mov ecx, str.Communicator.exe
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001610
test dl, dl
je 0x1000160c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001610
add eax, 2
add ecx, 2
test dl, dl
jne 0x100015f0
xor eax, eax
jmp 0x10001615
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001657
call fcn.100013a0
test eax, eax
je 0x1000164a
push str.Hook_DLL_found_OC14
call section..text
add esp, 4
push str.BTTrayMainWindow
push 0
call edi
test eax, eax
je 0x10001657
push 0
push 0
push 0x46f
push eax
call ebx
jmp 0x10001657
push str.Hook_DLL_found_OC14_but_feature_not_enabled
call section..text
add esp, 4
mov ecx, str.Skype.exe
mov eax, esi
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001680
test dl, dl
je 0x1000167c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001680
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001660
xor eax, eax
jmp 0x10001685
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100016cd
call fcn.10001420
test eax, eax
jne 0x100016cd
push str.Hook_DLL_found_Skype.exe_active
call section..text
add esp, 4
push str.BTTrayMainWindow
push 0
call edi
test eax, eax
je 0x100016c0
push 0
push 0
push 0x424
push eax
call ebx
pop edi
pop esi
pop ebx
jmp 0x10001760
push str.Hook_DLL_ERROR__BTTray_not_running
call section..text
add esp, 4
pop edi
pop esi
pop ebx
jmp 0x10001760
push 0x200
lea eax, [ebp - 0x30c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x30c]
push ecx
push str.Hook_DLL_unloaded_by:__s
call section..text
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10006680
add esp, 4
test eax, eax
je 0x10001760
push str.Hook_DLL_:_BtITunesPlugIn.exe_launch_to_finish_work
call section..text
lea edx, [ebp - 0x108]
push 0x104
push edx
call fcn.10001270
add esp, 0xc
test eax, eax
jne 0x10001753
push eax
push 0x1002668d
push 0x10026520
lea eax, [ebp - 0x108]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x10001760
push str.Hook_DLL_:_getPathFilename_ItunesPlugins_Could_not_find_path_to_plugin
call section..text
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.10009972
mov esp, ebp
pop ebp
ret 0xc