Function at 0x101da17
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x498
mov eax, 0x103080c
call fcn.01026060
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp + 0x24]
xor ebx, ebx
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov byte [ebp - 4], 1
push dword [ebp - 0x440]
lea ecx, [ebp - 0x448]
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp - 0x438]
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
mov byte [ebp - 4], 3
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x448]
call dword [sym.imp.MFC80U.DLL_Ordinal_3990]
mov byte [ebp - 4], 4
push eax
push 0x1002a88
call fcn.0100e46c
pop ecx
pop ecx
mov byte [ebp - 0x431], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x43c]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
cmp byte [ebp - 0x431], bl
push dword [ebp - 0x440]
je 0x101daf8
lea eax, [ebp - 0x430]
push 0x1002820
push eax
call dword [sym.imp.MFC80U.DLL_Ordinal_2311]
add esp, 0xc
jmp 0x101db04
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
push 0x1002144
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
push edi
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_899]
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_2895]
test eax, eax
jne 0x101db3a
mov dword [ebp - 0x43c], ebx
jmp 0x101db59
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_2895]
push eax
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_2460]
mov dword [ebp - 0x43c], eax
lea ecx, [ebp - 0x438]
call dword [sym.imp.MFC80U.DLL_Ordinal_2895]
test eax, eax
jne 0x101db71
mov dword [ebp - 0x444], ebx
jmp 0x101db90
lea ecx, [ebp - 0x438]
call dword [sym.imp.MFC80U.DLL_Ordinal_2895]
push eax
lea ecx, [ebp - 0x438]
call dword [sym.imp.MFC80U.DLL_Ordinal_2460]
mov dword [ebp - 0x444], eax
push 0x44
pop edi
push edi
lea eax, [ebp - 0x4a4]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [ebp + 0x18]
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x4a4], edi
mov dword [ebp - 0x478], ebx
je 0x101dbc4
mov dword [ebp - 0x478], esi
mov word [ebp - 0x474], ax
mov esi, 0x10384f4
push esi
call fcn.0101d1bd
cmp dword [0x103839c], 0xffffffff
pop ecx
jne 0x101dc83
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x101dbff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x428]
push eax
push ebx
push 0x1002a90
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x101dc29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x42c], eax
xor eax, eax
lea edi, [ebp - 0x460]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push 0x100080
stosd dword es:[edi], eax
push 2
xor eax, eax
inc eax
lea ecx, [ebp - 0x460]
push ecx
push eax
mov dword [ebp - 0x458], eax
push SysReAllocString
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x460], 0xc
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [0x103839c], eax
je 0x101dc77
cmp eax, ebx
jne 0x101dc83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x42c], eax
push esi
call fcn.0101d1e5
mov esi, dword [ebp - 0x42c]
cmp esi, ebx
pop ecx
je 0x101dcdb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x438]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x448]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, esi
call fcn.010260f2
ret
mov eax, dword [ebp - 0x44c]
cmp eax, 0xffffffff
je 0x101dd0b
cmp eax, ebx
je 0x101dd0b
or dword [ebp - 0x478], 0x100
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
mov eax, dword [0x103839c]
mov dword [ebp - 0x46c], eax
mov edi, dword [ebp - 0x454]
push edi
lea eax, [ebp - 0x4a4]
push eax
push dword [ebp - 0x444]
mov eax, dword [ebp + 0x20]
push ebx
or eax, 0x200
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x43c]
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setg al
xor ecx, ecx
cmp al, bl
sete cl
cmp dword [ebp - 0x444], ebx
mov dword [ebp - 0x42c], ecx
je 0x101dd67
push 0xffffffffffffffff
lea ecx, [ebp - 0x438]
call dword [sym.imp.MFC80U.DLL_Ordinal_5398]
cmp dword [ebp - 0x43c], ebx
je 0x101dd7d
push 0xffffffffffffffff
lea ecx, [ebp - 0x430]
call dword [sym.imp.MFC80U.DLL_Ordinal_5398]
cmp dword [ebp - 0x42c], ebx
je 0x101dd97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
je 0x101dddc
mov dword [ebp - 0x42c], eax
jmp 0x101dddc
cmp byte [ebp + 0x14], bl
je 0x101dddc
push 1
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
cmp eax, 0xc0
sete cl
cmp ecx, ebx
mov dword [ebp - 0x42c], ecx
jne 0x101ddcb
lea eax, [ebp - 0x42c]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [edi + 4]
push eax
call fcn.0101ccf6
push edi
call fcn.0101ccf6
pop ecx
pop ecx
mov esi, dword [ebp - 0x42c]
jmp 0x101dc94