Function at 0x101c63e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x101fb5d8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xb4]
mov dword [esp + 0x74], 1
xor ebx, ebx
cmp dword [esp + 0x90], ebx
jne 0x101c6473
lea eax, [esp + 0x50]
push eax
call fcn.101a0e90
add esp, 4
mov byte [esp + 0x74], 2
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x84]
call fcn.10007880
mov byte [esp + 0x74], 1
mov esi, 8
cmp dword [esp + 0x68], esi
jb 0x101c645f
mov ecx, dword [esp + 0x54]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edi, 7
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], bx
jmp 0x101c647b
mov esi, 8
lea edi, [esi - 1]
cmp dword [esp + 0xac], ebx
jne 0x101c649c
lea esi, [esp + 0x98]
lea edi, [esp + 0x7c]
call fcn.1019fb00
mov esi, 8
lea edi, [esi - 1]
push 0x3c
lea edx, [esp + 0x18]
push ebx
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0x540
call fcn.101a75c0
test al, al
mov dword [esp + 0x20], str.runas
jne 0x101c64d9
mov dword [esp + 0x20], str.open
cmp dword [esp + 0x94], esi
jb 0x101c64ef
mov eax, dword [esp + 0x80]
mov dword [esp + 0x24], eax
jmp 0x101c64fa
lea ecx, [esp + 0x80]
mov dword [esp + 0x24], ecx
cmp dword [esp + 0xb0], esi
jb 0x101c6510
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x2c], edx
jmp 0x101c651b
lea eax, [esp + 0x9c]
mov dword [esp + 0x2c], eax
cmp dword [ebp + 0x18], esi
jb 0x101c6529
mov ecx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
jmp 0x101c6530
add ebp, 4
mov dword [esp + 0x28], ebp
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x34], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x101c65a2
mov byte [esp + 0x74], bl
cmp dword [esp + 0x94], esi
jb 0x101c6564
mov eax, dword [esp + 0x80]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], bx
mov dword [esp + 0x74], 0xffffffff
cmp dword [esp + 0xb0], esi
jb 0x101c659b
mov ecx, dword [esp + 0x9c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x101c662c
mov edx, dword [esp + 0x4c]
cmp edx, ebx
je 0x101c65d6
cmp byte [esp + 0xb8], bl
je 0x101c65cf
mov ecx, dword [esp + 0xbc]
or eax, 0xffffffff
cmp ecx, ebx
jl 0x101c65c3
mov eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x74], bl
cmp dword [esp + 0x94], esi
jb 0x101c65f3
mov edx, dword [esp + 0x80]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
mov word [esp + 0x80], bx
mov dword [esp + 0x74], 0xffffffff
cmp dword [esp + 0xb0], esi
jb 0x101c662a
mov eax, dword [esp + 0x9c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
mov word [esp + 0x9c], bx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], edi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret