Function at 0x100336a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x10045998
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x10054020]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10054020]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
call fcn.1003a7f0
test al, al
je 0x10033962
xor ebx, ebx
cmp byte [esp + 0xa4], bl
je 0x100338b8
lea esi, [esp + 0x54]
call fcn.1002c210
mov dword [esp + 0x98], ebx
mov ebp, 7
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
xor eax, eax
mov byte [esp + 0x98], 1
call fcn.10031f70
push eax
lea ecx, [esp + 0x3c]
call fcn.1002bb50
add esp, 4
test al, al
jne 0x10033772
mov esi, 8
cmp dword [esp + 0x50], esi
jb 0x1003374b
mov eax, dword [esp + 0x3c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0x6c], esi
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
jb 0x1003376b
mov ecx, dword [esp + 0x58]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x10033964
push 0x10
lea ecx, [esp + 0x3c]
call fcn.10024150
mov al, byte [esp + 0xa4]
add esp, 4
lea esi, [esp + 0x1c]
call fcn.10032080
push eax
lea edx, [esp + 0x3c]
push edx
lea edi, [esp + 0x78]
mov byte [esp + 0xa0], 2
call fcn.1001dd20
add esp, 8
mov esi, 8
mov byte [esp + 0x98], 4
cmp dword [esp + 0x34], esi
jb 0x100337ca
mov eax, dword [esp + 0x20]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x70]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
call fcn.10025440
test al, al
jne 0x100337f1
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.100320f0
lea ecx, [esp + 0x70]
call fcn.10025440
test al, al
jne 0x10033820
lea ecx, [esp + 0x70]
call fcn.10001f30
lea ecx, [esp + 0x38]
call fcn.10001f30
lea ecx, [esp + 0x54]
call fcn.10001f30
xor al, al
jmp 0x10033964
cmp dword [esp + 0x88], esi
mov eax, dword [esp + 0x74]
jae 0x10033831
lea eax, [esp + 0x74]
push ebx
push ebx
push ebx
push eax
push str.taskbarpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push str.CoralExplorer
lea edx, [esp + 0x58]
push str.2345Explorer
push edx
call fcn.10022760
add esp, 0xc
push str.Coral.exe
lea eax, [esp + 0x58]
push str.2345Explorer.exe
push eax
call fcn.10022760
lea ecx, [esp + 0x60]
add esp, 0xc
push ecx
call fcn.100247f0
add esp, 4
test al, al
je 0x10033898
sub esp, 0x1c
lea edx, [esp + 0x70]
mov esi, esp
mov dword [esp + 0x34], esp
push edx
call fcn.10001f00
call fcn.10033e00
lea ecx, [esp + 0x70]
call fcn.10001f30
lea ecx, [esp + 0x38]
call fcn.10001f30
lea ecx, [esp + 0x54]
call fcn.10001f30
jmp 0x10033962
lea esi, [esp + 0x1c]
call fcn.1002c210
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
mov dword [esp + 0xb4], 5
push 0xffffffffffffffff
mov ebp, 7
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push ebx
mov eax, esi
mov word [ecx + 4], bx
call fcn.100020a0
call fcn.10033e00
push str.CoralExplorer
mov eax, esi
push str.2345Explorer
push eax
call fcn.10022760
add esp, 0xc
push str.Coral.exe
mov ecx, esi
push str.2345Explorer.exe
push ecx
call fcn.10022760
mov edx, esi
add esp, 0xc
push edx
call fcn.100247f0
add esp, 4
test al, al
je 0x1003394e
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push ebx
mov eax, esi
mov word [ecx + 4], bx
call fcn.100020a0
call fcn.10033e00
cmp dword [esp + 0x34], 8
jb 0x10033962
mov eax, dword [esp + 0x20]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1003ec9d
add esp, 0x88
ret 8