Function at 0x100ddb98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ebfba
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
cmp dword [ebp + 8], 0x111
jne 0x100ddf23
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x3ed
ja 0x100ddc2f
cmp dword [ebp - 0x48], 0x3ed
je 0x100ddde2
cmp dword [ebp - 0x48], 0x3e8
je 0x100ddc68
cmp dword [ebp - 0x48], 0x3ea
je 0x100ddef2
cmp dword [ebp - 0x48], 0x3eb
je 0x100ddcb6
cmp dword [ebp - 0x48], 0x3ec
je 0x100ddd21
jmp 0x100ddf23
cmp dword [ebp - 0x48], 0x3f0
je 0x100ddee8
cmp dword [ebp - 0x48], 0x3f1
je 0x100dde94
cmp dword [ebp - 0x48], 0x3f2
je 0x100ddebe
cmp dword [ebp - 0x48], 0x401
je 0x100ddd83
jmp 0x100ddf23
lea ecx, [ebp - 0x28]
call fcn.100031b0
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x94]
call fcn.1004a140
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.100dcba5
push 0xa
mov ecx, dword [ebp - 0x44]
call fcn.10038b30
mov ecx, dword [ebp - 0x44]
mov dword [ecx + 0xb8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100032a0
jmp 0x100ddf23
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x8c]
call fcn.100dcfa3
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x100ddceb
mov eax, dword [ebp - 0x44]
and dword [eax + 0xb0], 0
push 1
push 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x88]
call fcn.10038930
jmp 0x100ddd1c
cmp dword [ebp - 0x50], 1
jne 0x100ddd1c
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xb0], 1
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xb4], 0
je 0x100ddd1c
push 1
push 1
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x88]
call fcn.10038930
jmp 0x100ddf23
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xac], 1
push 1
push str.dot_up.png
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.1003bdd0
push 0x401
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100408b0
push 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100382c0
push 0
push 0
push 0x7ea
mov ecx, dword [ebp - 0x44]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100ddf23
mov eax, dword [ebp - 0x44]
and dword [eax + 0xac], 0
push 1
push str.dot_down.png
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.1003bdd0
push 0x3ec
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100408b0
push 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100382c0
push 0
push 0
push 0x7ea
mov ecx, dword [ebp - 0x44]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100ddf23
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xac], 0
je 0x100dde32
mov eax, dword [ebp - 0x44]
and dword [eax + 0xac], 0
push 1
push str.dot_down.png
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.1003bdd0
push 0x3ec
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100408b0
push 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100382c0
jmp 0x100dde77
mov eax, dword [ebp - 0x44]
mov dword [eax + 0xac], 1
push 1
push str.dot_up.png
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.1003bdd0
push 0x401
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100408b0
push 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x90]
call fcn.100382c0
push 0
push 0
push 0x7ea
mov ecx, dword [ebp - 0x44]
call fcn.1003de90
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100ddf23
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0xa0]
call fcn.100dcfa3
cmp eax, 1
jne 0x100ddeb0
mov dword [ebp - 0x4c], 1
jmp 0x100ddeb4
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
mov dword [0x1026800c], eax
jmp 0x100ddf23
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0xa4]
call fcn.100dcfa3
cmp eax, 1
jne 0x100ddeda
mov dword [ebp - 0x54], 1
jmp 0x100ddede
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x54]
mov dword [0x10268010], eax
jmp 0x100ddf23
mov ecx, dword [ebp - 0x44]
call fcn.100dca71
jmp 0x100ddf23
push str.http:__light.win_13.com_light_license.html
lea ecx, [ebp - 0x40]
call fcn.100031d0
push 5
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.10003390
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x40]
call fcn.100032a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x44]
call fcn.10038ad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret 0xc