Function at 0x10016960
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x10030b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1004415c]
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 0
cmp eax, 0x11
ja case.default.0x10016824
jmp dword [eax*4 + 0x10016a1c]
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push str.rundll32.exe_shell32.dll_Control_RunDLL_sysdm.cpl__
lea ecx, [esp + 4]
call fcn.10026ed9
mov ecx, dword [esp + 0x18]
mov edx, dword [esp]
push ecx
push edx
lea eax, [esp + 8]
push str._s_d
push eax
call fcn.10025f9e
mov ecx, dword [esp + 0x10]
add esp, 0x10
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push str.rundll32.exe_shell32.dll_Control_RunDLL_desk.cpl__
jmp 0x100169b0
push str.rundll32.exe_shell32.dll_Control_RunDLL_access.cpl__
lea ecx, [esp + 4]
call fcn.10026ed9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp]
push eax
push ecx
lea edx, [esp + 8]
push str._s_d
push edx
call fcn.10025f9e
mov eax, dword [esp + 0x10]
add esp, 0x10
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push 5
push str.rundll32.exe_shell32.dll_SHHelpShortcuts_RunDLL_AddPrinter
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push str.rundll32.exe_shell32.dll_Control_RunDLL_appwiz.cpl__
jmp 0x10016842
push str.rundll32.exe_shell32.dll_Control_RunDLL_timedate.cpl__
jmp 0x100169b0
push 5
push str.rundll32.exe_shell32.dll_SHHelpShortcuts_RunDLL_FontsFolder
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push str.rundll32.exe_shell32.dll_Control_RunDLL_joy.cpl__
jmp 0x10016888
push str.rundll32.exe_shell32.dll_Control_RunDLL_main.cpl__0_
jmp 0x10016842
push str.rundll32.exe_shell32.dll_Control_RunDLL_main.cpl__1_
jmp 0x100169b0
push str.rundll32.exe_shell32.dll_Control_RunDLL_mmsys.cpl__
lea ecx, [esp + 4]
call fcn.10026ed9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp]
push eax
push ecx
lea edx, [esp + 8]
push str._s_d
push edx
call fcn.10025f9e
mov eax, dword [esp + 0x10]
add esp, 0x10
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL_odbccp32.cpl
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push 5
push str.rundll32.exe_shell32.dll_Control_RunDLL_powercfg.cpl
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push str.rundll32.exe_shell32.dll_Control_RunDLL_intl.cpl__
lea ecx, [esp + 4]
call fcn.10026ed9
mov ecx, dword [esp + 0x18]
mov edx, dword [esp]
push ecx
push edx
lea eax, [esp + 8]
push str._s_d
push eax
call fcn.10025f9e
mov ecx, dword [esp + 0x10]
add esp, 0x10
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push str.rundll32.exe_shell32.dll_Control_RunDLL_Inetcpl.cpl__
lea ecx, [esp + 4]
call fcn.10026ed9
mov edx, dword [esp + 0x18]
mov eax, dword [esp]
push edx
push eax
lea ecx, [esp + 8]
push str._s_d
push ecx
call fcn.10025f9e
mov edx, dword [esp + 0x10]
add esp, 0x10
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
push 5
push str.Rundll32_netplwiz.dll_UsersRunDll
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x10016824
call fcn.10017100
lea ecx, [esp]
mov dword [esp + 0xc], 0xffffffff
call fcn.10026d9c
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8