Function at 0x100a4e24
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x100bde18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x10106c69]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 0
cmp eax, 0x11
ja case.default.0x100a4c64
jmp dword [eax*4 + 0x100a4e5c]
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push str.rundll32.exe_shell32.dll_Control_RunDLL_sysdm.cpl__
lea ecx, [esp + 4]
call fcn.100b58b9
mov ecx, dword [esp + 0x18]
mov edx, dword [esp]
push ecx
push edx
lea eax, [esp + 8]
push str._s_d
push eax
call fcn.100b497e
mov ecx, dword [esp + 0x10]
add esp, 0x10
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push str.rundll32.exe_shell32.dll_Control_RunDLL_desk.cpl__
jmp 0x100a4df0
push str.rundll32.exe_shell32.dll_Control_RunDLL_access.cpl__
lea ecx, [esp + 4]
call fcn.100b58b9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp]
push eax
push ecx
lea edx, [esp + 8]
push str._s_d
push edx
call fcn.100b497e
mov eax, dword [esp + 0x10]
add esp, 0x10
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push 5
push str.rundll32.exe_shell32.dll_SHHelpShortcuts_RunDLL_AddPrinter
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push str.rundll32.exe_shell32.dll_Control_RunDLL_appwiz.cpl__
jmp 0x100a4c82
push str.rundll32.exe_shell32.dll_Control_RunDLL_timedate.cpl__
jmp 0x100a4df0
push 5
push str.rundll32.exe_shell32.dll_SHHelpShortcuts_RunDLL_FontsFolder
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push str.rundll32.exe_shell32.dll_Control_RunDLL_joy.cpl__
jmp 0x100a4cc8
push str.rundll32.exe_shell32.dll_Control_RunDLL_main.cpl__0_
jmp 0x100a4c82
push str.rundll32.exe_shell32.dll_Control_RunDLL_main.cpl__1_
jmp 0x100a4df0
push str.rundll32.exe_shell32.dll_Control_RunDLL_mmsys.cpl__
lea ecx, [esp + 4]
call fcn.100b58b9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp]
push eax
push ecx
lea edx, [esp + 8]
push str._s_d
push edx
call fcn.100b497e
mov eax, dword [esp + 0x10]
add esp, 0x10
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL_odbccp32.cpl
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL_powercfg.cpl
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push str.rundll32.exe_shell32.dll_Control_RunDLL_intl.cpl__
lea ecx, [esp + 4]
call fcn.100b58b9
mov ecx, dword [esp + 0x18]
mov edx, dword [esp]
push ecx
push edx
lea eax, [esp + 8]
push str._s_d
push eax
call fcn.100b497e
mov ecx, dword [esp + 0x10]
add esp, 0x10
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push str.rundll32.exe_shell32.dll_Control_RunDLL_Inetcpl.cpl__
lea ecx, [esp + 4]
call fcn.100b58b9
mov edx, dword [esp + 0x18]
mov eax, dword [esp]
push edx
push eax
lea ecx, [esp + 8]
push str._s_d
push ecx
call fcn.100b497e
mov edx, dword [esp + 0x10]
add esp, 0x10
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
push 5
push str.Rundll32_netplwiz.dll_UsersRunDll
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x100a4c64
call fcn.100a5540
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.100b577c
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8