Function at 0x101a2e90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2080
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push str.2559a1f4_21d7_11d4_bdaf_00c04f60b9f0
push ebx
mov dword [ebp - 0x204c], ebx
mov dword [ebp - 0x2030], 0
mov dword [ebp - 0x202c], 0
mov dword [ebp - 0x2028], 0xffffffff
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x101a331b
cmp dword [0x1025b434], 0
jne 0x101a2f0c
lea ecx, [ebp - 0x2030]
call fcn.10008220
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
call fcn.100ddff0
test eax, eax
jne 0x101a3307
push esi
lea ecx, [ebp - 0x2030]
call fcn.10008220
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartPage
lea eax, [ebp - 0x2030]
push SysReAllocString
push eax
mov ecx, eax
call fcn.1000a260
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x2034], 0
push eax
push 0
lea eax, [ebp - 0x2034]
mov dword [ebp - 0x2008], 0
push eax
push str.Favorites
lea ecx, [ebp - 0x2030]
call fcn.100263b0
mov eax, dword [ebp - 0x2008]
test eax, eax
je 0x101a32e8
add eax, 8
push 0x1025c02a
push eax
call fcn.101c85a0
mov esi, eax
add esp, 8
mov dword [ebp - 0x2018], esi
test esi, esi
je 0x101a32e8
mov ecx, dword [ebp - 0x2008]
push edi
add ecx, 8
push 0x1025c02a
push ecx
call fcn.101c85a0
mov edi, eax
add esp, 8
mov dword [ebp - 0x2020], edi
test edi, edi
jne 0x101a2ff2
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
add esp, 4
lea ecx, [ebp - 0x2030]
call fcn.10008220
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2008]
push eax
push esi
lea eax, [ebp - 0x2034]
push eax
push str.Favorites
lea ecx, [ebp - 0x2030]
call fcn.100263b0
mov eax, dword [ebp - 0x2008]
inc esi
add eax, dword [ebp - 0x2018]
xor ebx, ebx
mov dword [ebp - 0x2014], edi
mov edi, dword [esi]
lea ecx, [edi + esi]
cmp ecx, eax
ja 0x101a32ae
xor eax, eax
lea edx, [ebp - 0x200c]
push edx
mov word [ebp - 0x2004], ax
add esi, 4
mov dword [ebp - 0x200c], eax
mov eax, dword [0x1025b434]
push 1
push 0
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
cmp dword [ebp - 0x200c], 0
je 0x101a31e0
push 0
lea ecx, [ebp - 0x2080]
call fcn.100e52b0
push dword [ebp - 0x200c]
lea ecx, [ebp - 0x2080]
call fcn.100e5a30
mov eax, dword [ebp - 0x200c]
lea edx, [ebp - 0x2040]
push edx
mov dword [ebp - 0x2038], 0
lea edx, [ebp - 0x2038]
mov dword [ebp - 0x2040], 0
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
lea ecx, [ebp - 0x2048]
mov dword [ebp - 0x2048], 0
mov dword [ebp - 0x2044], 0
call fcn.10027330
cmp dword [ebp - 0x2038], 0
mov dword [ebp - 0x2048], eax
jne 0x101a3117
mov eax, dword [ebp - 0x2074]
cmp dword [eax - 0xc], 0
je 0x101a3117
push 0xfff
push eax
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.101ef1c0
add esp, 0x10
xor eax, eax
mov word [ebp - 0x1dfe], ax
jmp 0x101a31be
mov eax, dword [ebp - 0x200c]
lea edx, [ebp - 0x2010]
mov dword [ebp - 0x2010], 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x2010]
mov dword [ebp - 0x203c], 0
test eax, eax
je 0x101a31be
mov ecx, dword [eax]
lea edx, [ebp - 0x203c]
push edx
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x203c], 0
jbe 0x101a31ae
mov eax, dword [ebp - 0x2010]
lea edx, [ebp - 0x201c]
push edx
mov dword [ebp - 0x201c], 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
push 0xfff
push dword [ebp - 0x201c]
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.101ef1c0
add esp, 0x10
xor eax, eax
mov word [ebp - 6], ax
push dword [ebp - 0x201c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x101a31be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x2048]
call fcn.1006b8b0
push dword [ebp - 0x2040]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x2080]
call fcn.100e54a0
push dword [ebp - 0x204c]
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x101a3222
lea eax, [edi + 5]
push eax
lea eax, [esi - 5]
push eax
push dword [ebp - 0x2014]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x2014]
add esp, 0xc
add eax, 5
add eax, edi
mov dword [ebp - 0x2014], eax
jmp 0x101a3227
mov ebx, 1
mov eax, dword [ebp - 0x2018]
add esi, edi
mov edx, dword [ebp - 0x2008]
add eax, edx
cmp esi, eax
jae 0x101a326f
cmp byte [esi], 0xff
je 0x101a326f
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x101a3256
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x2008]
mov edi, dword [esi + 1]
inc esi
mov eax, dword [ebp - 0x2018]
add eax, edx
lea ecx, [edi + esi]
cmp ecx, eax
jbe 0x101a3033
jmp 0x101a327f
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x101a327f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp - 0x2020]
test ebx, ebx
je 0x101a32b4
mov eax, dword [ebp - 0x2014]
lea ecx, [ebp - 0x2030]
sub eax, esi
push eax
push esi
push 3
push str.Favorites
call fcn.10058930
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jmp 0x101a32b4
mov esi, dword [ebp - 0x2020]
push dword [ebp - 0x2018]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
add esp, 8
lea ecx, [ebp - 0x2030]
call fcn.10008220
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x2030]
call fcn.10008220
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push ebx
push str.startunpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x2030]
call fcn.10008220
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4