Function at 0x100011b3
Capabilities:
Create process on windows
Create process suspended
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000d8ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x20198
call fcn.1000d350
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
push 0x1010001c
lea ecx, [ebp - 0x10118]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 1
push 0x10100020
lea ecx, [ebp - 0x2011c]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 2
mov byte [ebp - 0x20118], 0
mov ecx, 0x3fff
xor eax, eax
lea edi, [ebp - 0x20117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x10114], 0
mov ecx, 0x3fff
xor eax, eax
lea edi, [ebp - 0x10113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x114]
push ecx
push str._sSamFileMap.dat
lea edx, [ebp - 0x10118]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov eax, dword [ebp - 0x10118]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.cmd.exe__c__s_s
lea edx, [ebp - 0x2011c]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov byte [ebp - 4], 3
mov dword [ebp - 0x20184], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x20180]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20158], 1
mov word [ebp - 0x20154], 1
mov word [ebp - 0x20154], 0
push 0
lea ecx, [ebp - 0x2011c]
call sub.MFC42.DLL_CString::GetBuffer
mov dword [ebp - 0x20194], eax
lea eax, [ebp - 0x2012c]
push eax
lea ecx, [ebp - 0x20184]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
mov edx, dword [ebp - 0x20194]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1000135d
mov dword [ebp - 0x20188], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2011c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10118]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x20188]
jmp 0x10001507
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2012c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
mov ecx, dword [ebp - 0x2012c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x20128]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2012c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x10118]
call fcn.10003420
mov dword [ebp - 0x20198], eax
push 2
mov ecx, dword [ebp - 0x20198]
push ecx
lea ecx, [ebp - 0x20140]
call sub.MFC42.DLL_CFile::CFile_1
mov dword [ebp - 0x2019c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20140]
call sub.MFC42.DLL_CFile::GetLength
mov dword [ebp - 0x201a0], eax
mov edx, dword [ebp - 0x201a0]
mov dword [ebp - 0x20130], edx
push 0x10000
lea eax, [ebp - 0x20118]
push eax
lea ecx, [ebp - 0x20140]
call sub.MFC42.DLL_CFile::Read
lea ecx, [ebp - 0x20140]
call sub.MFC42.DLL_CFile::Close
lea ecx, [ebp - 0x10118]
call fcn.10003420
mov dword [ebp - 0x201a4], eax
push 1
push 1
mov ecx, dword [ebp - 0x201a4]
push ecx
call fcn.1000c3ab
push str.secedit
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::Find_1
mov dword [ebp - 0x201a8], eax
cmp dword [ebp - 0x201a8], 0xffffffff
je 0x10001467
lea edx, [ebp - 0x10114]
push edx
lea eax, [ebp - 0x20118]
push eax
call fcn.10006b70
add esp, 8
lea ecx, [ebp - 0x10114]
push ecx
mov ecx, dword [ebp + 0xc]
call sub.MFC42.DLL_CString::operator_2
jmp 0x10001476
lea edx, [ebp - 0x20118]
push edx
mov ecx, dword [ebp + 0xc]
call sub.MFC42.DLL_CString::operator_2
mov dword [ebp - 0x2018c], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20140]
call sub.MFC42.DLL_CFile::CFile
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2011c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10118]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x2018c]
jmp 0x10001507
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret