Function at 0x102b7df
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa5c
mov eax, dword [0x105b088]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
mov esi, 0x1fe
push esi
mov word [ebp - 0xa48], ax
xor edi, edi
lea eax, [ebp - 0xa46]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x436]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x236]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, 0x100
push eax
lea ecx, [ebp - 0x238]
push ecx
push eax
lea ecx, [ebp - 0x438]
push ecx
push eax
lea eax, [ebp - 0xa48]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.msvcrt.dll__wsplitpath_s
add esp, 0x48
test eax, eax
jne 0x102ba20
mov esi, 0x102ba54
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x238]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x102ba20
cmp word [ebp - 0xc], ax
jne 0x102ba20
cmp word [ebp - 0xa48], ax
jne 0x102ba20
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x102ba20
push 7
pop ecx
mov esi, 0x102ba34
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
movsw word es:[edi], word [esi]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102b8f0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x640]
push ebx
push eax
call sub.msvcrt.dll_wcsncat_s
add esp, 0x10
test eax, eax
jne 0x102ba20
lea eax, [ebp - 0x438]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102b924
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x640]
push ebx
push eax
call sub.msvcrt.dll_wcsncat_s
add esp, 0x10
test eax, eax
jne 0x102ba20
lea eax, [ebp - 0x238]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102b95b
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x640]
push ebx
push eax
call sub.msvcrt.dll_wcsncat_s
add esp, 0x10
test eax, eax
jne 0x102ba20
xor esi, esi
push 0x206
mov word [ebp - 0x848], ax
lea eax, [ebp - 0x846]
push esi
push eax
mov dword [ebp - 0xa58], esi
mov dword [ebp - 0xa54], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa58]
push eax
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0xa4c]
push eax
push esi
lea eax, [ebp - 0x640]
push eax
push esi
mov dword [ebp - 0xa50], ebx
mov dword [ebp - 0xa4c], esi
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
test eax, eax
je 0x102ba20
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
jne 0x102ba20
push 5
push esi
push esi
lea eax, [ebp - 0x848]
push eax
mov eax, dword [0x105b0ac]
push esi
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001945
leave
ret 8