Function at 0x100cb4f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push edi
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
lea esi, [ebp - 0x168]
mov ebx, str.notepad__p
call fcn.0100ab9a
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x100cbb9
push 1
call fcn.0100b7bd
push 0x10
push 0x10019a0
push 0x2d8
call fcn.0100e675
push eax
push dword [0x10149c4]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0100b7bd
or eax, 0xffffffff
jmp 0x100cd6c
push dword [ebp - 8]
push eax
call fcn.01003756
xor ecx, ecx
mov dword [ebp - 0x14], eax
cmp eax, ecx
jne 0x100cbe3
push 1
call fcn.0100b7bd
push 0x10
push 0x10019a0
push 0x2bb
jmp 0x100ccf5
cmp edi, ecx
jg 0x100cbfe
push ecx
push ecx
push 0x405
push dword [0x1014af4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
xor ecx, ecx
mov eax, dword [ebp - 8]
dec eax
je 0x100cc2b
dec eax
je 0x100cc10
mov dword [ebp - 4], 1
jmp 0x100cc46
push edi
push dword [ebp - 0x10]
call fcn.0100aa16
test edi, edi
mov dword [ebp - 4], eax
jle 0x100cc21
dec edi
test eax, eax
jg 0x100cc44
test edi, edi
jg 0x100cc10
jmp 0x100cc44
push edi
push dword [ebp - 0x10]
call fcn.0100a9bb
test edi, edi
mov dword [ebp - 4], eax
jle 0x100cc3c
dec edi
test eax, eax
jg 0x100cc44
test edi, edi
jg 0x100cc2b
xor ecx, ecx
cmp dword [ebp - 4], ecx
jg 0x100cc52
mov dword [ebp - 4], 1
cmp byte [str.notepad__p], 0
je 0x100cc9f
mov edi, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
mov al, byte [ebx]
cmp al, 0x25
jne 0x100cc7b
mov al, byte [ebx + 1]
inc ebx
cmp al, 0x6c
je 0x100cd89
cmp al, 0x70
je 0x100cd73
push eax
call edi
test eax, eax
je 0x100cc92
cmp byte [ebx + 1], 0
lea eax, [ebx + 1]
je 0x100cc92
mov cl, byte [ebx]
mov ebx, eax
mov byte [esi], cl
inc esi
mov al, byte [ebx]
mov byte [esi], al
inc esi
inc ebx
cmp byte [ebx], 0
jne 0x100cc61
xor ecx, ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x5c], 0x1001d3c
push eax
lea eax, [ebp - 0x68]
push eax
push ecx
push ecx
push 0x20
push ecx
push ecx
lea eax, [ebp - 0x168]
push ecx
push eax
push ecx
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x34], ecx
mov word [ebp - 0x36], cx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x3c], 0x40
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x100cd10
push 1
call fcn.0100b7bd
push 0x10
push 0x10019a0
push 0x2bc
call fcn.0100e675
push eax
push dword [0x10149c4]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0100b7bd
jmp 0x100cd5a
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.01003910
push dword [ebp - 0xc]
call fcn.010035a9
push dword [ebp - 0xc]
push 0xc2
push 0x111
push dword [0x10149c4]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0xc
push dword [ebp + 8]
push dword [0x10149c8]
call sub.GUtils.dll_gmem_free
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi], 0
je 0x100cc97
inc esi
jmp 0x100cd7d
push 0xa
push esi
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll__ltoa]
add esp, 0xc
cmp byte [esi], 0
je 0x100cc97
inc esi
jmp 0x100cd98