Function at 0x100026ba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1444
call fcn.10003b50
mov eax, dword [ebp + 8]
push ebx
mov dword [0x100053d4], eax
mov eax, dword [ebp + 0xc]
mov dword [0x100053e4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x100053e0], eax
mov eax, dword [ebp + 0x10]
push esi
mov edx, 0x100
push edi
mov dword [0x100053dc], eax
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xc1f]
mov byte [ebp - 0xc20], bl
mov byte [ebp - 0x418], bl
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x417]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x81b]
mov byte [ebp - 0x81c], bl
mov byte [ebp - 0x14], bl
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
mov edi, 0x400
push eax
lea eax, [ebp - 0xc20]
push eax
push 0x1000525c
push 1
mov dword [ebp + 0xc], edi
call fcn.1000233e
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
call fcn.1000340d
add esp, 0x14
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
lea eax, [ebp - 0x418]
push eax
push str.grpid
push 1
call fcn.1000233e
push eax
push esi
call fcn.1000340d
add esp, 0x14
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
lea eax, [ebp - 0x81c]
push eax
push str.bnrid
push 1
call fcn.1000233e
push eax
push esi
call fcn.1000340d
add esp, 0x14
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push 0x100051e8
push 1
call fcn.1000233e
push eax
push esi
call fcn.1000340d
push 0x824
lea eax, [ebp - 0x1444]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x20
push ebx
call fcn.1000233e
push eax
lea eax, [ebp - 0x1444]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x1444]
push 0x10005248
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x14]
push eax
call sub.MSVCRT.dll_strlen
mov esi, eax
lea eax, [ebp - 0x81c]
push eax
call sub.MSVCRT.dll_strlen
add esi, eax
lea eax, [ebp - 0x418]
push eax
call sub.MSVCRT.dll_strlen
add esi, eax
lea eax, [ebp - 0xc20]
push eax
call sub.MSVCRT.dll_strlen
lea eax, [esi + eax + 0x28]
lea edi, [eax + eax]
inc eax
push eax
mov dword [ebp + 0x10], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
lea eax, [edi + 1]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
push ebx
push esi
call sub.MSVCRT.dll_memset
lea eax, [edi + 1]
push eax
push ebx
push dword [ebp + 0x14]
call sub.MSVCRT.dll_memset
add esp, 0x40
push str.installdt
push esi
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x14]
push eax
push esi
call sub.MSVCRT.dll_strcat
push 0x10005234
push esi
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xc20]
push eax
push esi
call sub.MSVCRT.dll_strcat
push 0x1000522c
push esi
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x418]
push eax
push esi
call sub.MSVCRT.dll_strcat
push str.login
push esi
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x81c]
push eax
push esi
call sub.MSVCRT.dll_strcat
add esp, 0x40
push str.bp
push esi
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
call fcn.100036fe
test al, al
mov eax, 0x10005210
jne 0x100028ea
mov eax, 0x100050f8
push eax
push esi
call sub.MSVCRT.dll_strcat
push edi
push dword [ebp + 0x14]
push esi
call fcn.1000195f
push dword [ebp + 0x14]
lea eax, [ebp - 0x1444]
push eax
call sub.MSVCRT.dll_strcat
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 0x14]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x24
lea eax, [ebp - 0x1444]
push 1
push ebx
push ebx
push eax
push str.open
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
leave
ret