Function at 0x2100881f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21047e84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x16c
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [0x2105b094], ecx
mov ecx, dword [ebp + 8]
add ecx, 0x44
call fcn.21004da0
test eax, eax
jne 0x21008872
mov ecx, dword [ebp + 8]
add ecx, 0x44
call fcn.21002430
push eax
call fcn.2100a53d
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x34]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
je 0x2100888c
jmp 0x21008aa2
mov ecx, dword [ebp - 0x170]
cmp dword [ecx + 0x160], 0
je 0x210088b9
mov edx, dword [ebp - 0x170]
cmp dword [edx + 0x154], 0
je 0x210088b9
mov eax, dword [ebp - 0x170]
cmp dword [eax + 0x158], 0
jne 0x210088d0
push 0x2105acd0
push 0x284a
call fcn.2100a398
add esp, 8
jmp 0x21008a9b
mov ecx, dword [ebp - 0x170]
mov edx, dword [ecx + 0x154]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 0x158]
mov dword [ebp - 0x118], ecx
push 0
push 1
lea edx, [ebp - 0x11c]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jb 0x2100895c
cmp dword [ebp - 0x120], 2
jae 0x2100895c
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 0x170]
mov eax, dword [edx + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x2105acd0
push 0x2848
call fcn.2100a4f9
add esp, 8
jmp 0x21008a9b
mov dword [ebp - 0x124], 0
mov ecx, dword [ebp - 0x170]
mov edx, dword [ecx + 0x160]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x21008a6c
lea ecx, [ebp - 0x128]
call fcn.21002410
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x16c]
call fcn.21002410
mov byte [ebp - 4], 1
push 0x40
lea eax, [ebp - 0x168]
push eax
push str.DispWaitLocalKillWndClass
call fcn.2100263f
push 0x2105b4b0
push 0x28e5
lea ecx, [ebp - 0x128]
push ecx
call fcn.2103ce13
add esp, 0xc
push 0x2799
lea ecx, [ebp - 0x16c]
call fcn.2103f11b
lea ecx, [ebp - 0x16c]
call fcn.21002430
push eax
lea ecx, [ebp - 0x128]
call fcn.21002430
push eax
push 0x2105b4b0
lea edx, [ebp - 0x168]
push edx
push 0x7530
push 1
push 2
lea eax, [ebp - 0x11c]
push eax
call fcn.2102bc83
test eax, eax
je 0x21008a4b
mov ecx, dword [ebp - 0x170]
mov edx, dword [ecx + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [ebp - 0x124], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x16c]
call fcn.2103dbe4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x128]
call fcn.2103dbe4
cmp dword [ebp - 0x124], 0
je 0x21008a89
push 0x2105acd0
push 0x2849
call fcn.2100a4f9
add esp, 8
jmp 0x21008a9b
push 0x2105acd0
push 0x284a
call fcn.2100a398
add esp, 8
xor eax, eax
jmp 0x21008b66
mov edx, dword [ebp + 8]
cmp dword [edx + 0x3c], 0
je 0x21008ad9
push 0x2710
call fcn.210105e6
push 0
call fcn.21007ff3
test eax, eax
je 0x21008ad9
push 0x2105acd0
push 0x284a
call fcn.2100a398
add esp, 8
xor eax, eax
jmp 0x21008b66
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x178], ecx
cmp dword [ebp - 0x178], 1
je 0x21008af0
jmp 0x21008b1a
lea edx, [ebp - 0x114]
push edx
call fcn.2101404a
push 1
push 0
push 0
lea eax, [ebp - 0x114]
push eax
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x21008b66
push 0
call fcn.21007c3a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x21008b61
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x48
push edx
mov ecx, dword [ebp - 0x170]
call fcn.2100920a
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
je 0x21008b5d
push 0x2105acd0
push 0x2768
call fcn.2100a4f9
add esp, 8
xor eax, eax
jmp 0x21008b66
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4