Function at 0x100816a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fbf63
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x110], eax
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
je 0x10081cd8
mov dword [ebp - 0x118], 0
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
push eax
push 0x10115024
push 0x17
push 0
push 0x10103980
call esi
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x10081cc7
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
push 0x10115034
push 0x17
push 0
push 0x10103d90
call esi
cmp dword [ebp - 0x114], 0
je 0x10081cad
xor esi, esi
xor edi, edi
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x104], edi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x108], edi
jne 0x1008181d
cmp eax, 4
jne 0x100817c1
lea eax, [ebp - 0x100]
push eax
push str.System.StartMenu.Group
call dword [sym.imp.PROPSYS.dll_PSGetPropertyKeyFromName]
test eax, eax
js 0x10081999
lea edx, [ebp - 0x104]
push edx
push 0x10115044
push edi
push edi
push str.files
push 1
lea edx, [ebp - 0x100]
push edx
jmp 0x100817e3
and al, 0xf
cmp al, 4
jne 0x10081811
lea edx, [ebp - 0x104]
push edx
push 0x10115044
push 0
push 0
push str.file
push 1
push 0x10103f44
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
js 0x10081999
lea eax, [ebp - 0x104]
push eax
push 0
lea ecx, [ebp - 0x124]
call fcn.10082fe0
mov edi, dword [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x104]
call fcn.1001f8e0
mov esi, dword [0x1014e914]
cmp dword [esi], 0
je 0x1008184d
cmp dword [esi + 4], 1
jne 0x10081845
push str.SearchContents
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x1008193b
add esi, 0x60
cmp dword [esi], 0
jne 0x10081828
movups xmm0, xmmword [0x10103ef4]
mov eax, dword [0x10103f04]
mov dword [ebp - 0xdc], eax
movups xmmword [ebp - 0xec], xmm0
mov esi, dword [ebp - 0x110]
mov esi, dword [esi]
movzx eax, word [esi]
test ax, ax
je 0x10081a48
mov ecx, eax
nop dword [eax]
movzx edx, cx
cmp cx, 0x20
jne 0x1008189e
nop dword [eax]
movzx eax, word [esi + 2]
add esi, 2
cmp eax, 0x20
je 0x10081890
mov edx, eax
xor eax, eax
mov ecx, esi
cmp dx, 0x22
lea edx, [ebp - 0xd8]
push 0x10114e18
setne al
add eax, 0xc
push 0x64
mov dword [ebp - 0x110], eax
call fcn.100a49c0
add esp, 8
lea edx, [ebp - 0x104]
mov esi, eax
mov eax, dword [ebp - 0x118]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0xd8]
push 0x10115044
push 0
push 0
push edx
push dword [ebp - 0x110]
lea edx, [ebp - 0xec]
push edx
push eax
call dword [ecx + 0x2c]
test eax, eax
js 0x10081a3a
cmp dword [ebp - 0x11c], edi
je 0x100819ff
mov eax, dword [ebp - 0x104]
mov byte [ebp - 4], 0x15
mov dword [edi], eax
test eax, eax
je 0x10081929
mov eax, dword [ebp - 0x104]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
add edi, 4
mov byte [ebp - 4], 6
mov dword [ebp - 0x120], edi
jmp 0x10081a18
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
cmp word [esi + 0x38], 3
jne 0x1008195a
cmp dword [esi + 0x40], 1
mov byte [ebp - 0x109], 1
je 0x10081961
mov byte [ebp - 0x109], 0
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
cmp byte [ebp - 0x109], 0
je 0x1008184d
lea eax, [ebp - 0xec]
push eax
push str.System.Generic.String
call dword [sym.imp.PROPSYS.dll_PSGetPropertyKeyFromName]
test eax, eax
jns 0x10081866
mov esi, dword [ebp - 0x124]
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x104]
test eax, eax
je 0x100819ad
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 2
test esi, esi
je 0x10081cad
push edi
push esi
call fcn.1003ad40
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x124]
sub eax, ecx
sar eax, 2
lea edx, [eax*4]
mov eax, ecx
cmp edx, 0x1000
jb 0x10081ca3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10081cf5
jmp 0x10081ca3
lea eax, [ebp - 0x104]
push eax
push edi
lea ecx, [ebp - 0x124]
call fcn.10082fe0
mov edi, dword [ebp - 0x120]
mov eax, dword [ebp - 0x104]
test eax, eax
je 0x10081a3a
mov dword [ebp - 0x104], 0
mov byte [ebp - 4], 0x17
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x10081880
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x10081aaf
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], 0
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x108]
push eax
push 1
call dword [sym.imp.SHELL32.dll_SHCreateShellItemArrayFromIDLists]
test eax, eax
js 0x10081a92
mov eax, dword [ebp - 0x114]
push dword [ebp - 0x110]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x10081aa6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
jmp 0x10081b4a
cmp dword [ebp + 0xc], 4
jne 0x10081b4a
mov dword [ebp - 0x108], 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
push str.::DAF95313_E44D_46AF_BE1B_CBACEA2C3065
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x110], 0
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0x130]
push eax
push 1
call dword [sym.imp.SHELL32.dll_SHCreateShellItemArrayFromIDLists]
test eax, eax
js 0x10081b21
mov eax, dword [ebp - 0x114]
push dword [ebp - 0x110]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x10081b35
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x10081b4a
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov esi, dword [ebp - 0x124]
mov edx, edi
sub edx, esi
sar edx, 2
cmp edx, 1
jne 0x10081b6c
mov eax, dword [ebp - 0x114]
push dword [esi]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x10081bc8
mov dword [ebp - 0x108], 0
lea esi, [ebp - 0x108]
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x118]
push esi
mov esi, dword [ebp - 0x124]
push 0x10115044
mov ecx, dword [eax]
push 0
push edx
push esi
push 0
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x10081bb4
mov eax, dword [ebp - 0x114]
push dword [ebp - 0x108]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x10081bc8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x12c], 0
mov byte [ebp - 4], 0x1f
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0x114]
push edx
push 0x10103e10
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
js 0x10081c86
push 0x38
lea eax, [ebp - 0x168]
mov dword [ebp - 0x16c], 0x3c
push 0
push eax
call fcn.100d6eb0
add esp, 0xc
mov dword [ebp - 0x160], 0x1010be30
lea eax, [ebp - 0x128]
mov dword [ebp - 0x150], 1
mov dword [ebp - 0x168], 4
mov dword [ebp - 0x128], 0
push eax
push dword [ebp - 0x12c]
call dword [sym.imp.SHELL32.dll_SHGetIDListFromObject]
test eax, eax
js 0x10081c6b
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x10081c7c
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov dword [ebp - 0x128], 0
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x10081999
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10081999
push edx
push ecx
call fcn.100d4917
add esp, 8
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x10081cc1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], 0x27
test eax, eax
je 0x10081cd8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret 0xc
call fcn.100dca69
int3