Function at 0x2e018210
Capabilities:
Create process on windows

Disassembly:
push 0x288
mov eax, 0x2e0367d6
call fcn.2e03495f
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], edi
xor ebx, ebx
mov esi, 0x102
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x290]
push eax
mov byte [ebp - 0x23d], bl
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x280], 0x79
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x244], eax
cmp eax, ebx
je 0x2e018579
mov dword [ebp - 0x248], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x258], 0x2e045064
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
push ebx
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 1
call fcn.2e0288b3
push 0x105
mov byte [ebp - 4], 3
call fcn.2e00b7f1
cmp eax, dword [ebp - 0x250]
jle 0x2e0182f2
mov ecx, dword [ebp - 0x258]
mov edx, dword [ecx]
push ebx
push eax
lea eax, [ebp - 0x258]
push eax
push ecx
call dword [edx]
push dword [ebp - 0x254]
push dword [ebp - 0x244]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x2e018310
push ebx
push 3
call fcn.2e015219
mov dword [ebp - 0x25c], ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x254]
mov byte [ebp - 4], 4
call sub.Csi.dll_void___stdcall_Csi::GetFolderProxyFromPath_class_MsoCF::String_struct_MsoCF::WzTraits___struct_Csi::IFolderProxy____bool__bool___bool_
mov dword [ebp - 0x24c], ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24c]
push eax
push ecx
mov eax, esp
mov byte [ebp - 4], 5
mov dword [ebp - 0x244], esp
mov dword [eax], edi
call sub.Csi.dll_void___stdcall_Csi::GetFolderProxyFromPath_class_MsoCF::String_struct_MsoCF::WzTraits___struct_Csi::IFolderProxy____bool__bool___bool_
mov dword [ebp - 0x244], ebx
push 0x18
mov byte [ebp - 4], 6
call fcn.2e01ba8a
pop ecx
cmp eax, ebx
je 0x2e018373
mov ecx, eax
call fcn.2e015727
jmp 0x2e018375
xor eax, eax
push eax
lea ecx, [ebp - 0x244]
call fcn.2e01db2e
mov ecx, dword [ebp - 0x244]
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x25c]
push dword [ebp - 0x24c]
call fcn.2e0159cc
mov eax, dword [ebp - 0x244]
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x2e0183b6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x24c]
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x2e0183ca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x25c]
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x2e0183de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 2
jmp 0x2e01841b
cmp dword [ebp - 0x248], ebx
je 0x2e018538
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x23c], 0x2e045068
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], esi
push ebx
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 8
call fcn.2e0288b3
push ebx
push 0x400009f
push dword [0x2e045c98]
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 9
call fcn.2e028878
lea eax, [ebp - 0x118]
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x128], 0x2e045068
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], esi
push ebx
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0xa
call fcn.2e0288b3
mov eax, dword [ebp - 0x254]
push ebx
mov dword [ebp - 0x26c], eax
push 2
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x128]
push eax
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x270], edi
call fcn.2e028ecd
mov eax, dword [ebp - 0x268]
mov eax, dword [eax + 4]
push 2
push 0x400009b
push 0x4000058
push dword [ebp - 0x124]
push eax
call fcn.2e016b7b
cmp eax, 0x66
lea eax, [ebp - 0x118]
sete byte [ebp - 0x23d]
cmp dword [ebp - 0x124], eax
je 0x2e01851d
push dword [ebp - 0x124]
call fcn.2e01b807
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x238], eax
je 0x2e01854e
push dword [ebp - 0x238]
call fcn.2e01b807
jmp 0x2e01854e
push 5
push ebx
push ebx
push dword [ebp - 0x254]
push 0x2e0029c0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x254]
call fcn.2e01b807
mov eax, dword [ebp - 0x248]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x2e01856d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 0x23d], bl
jne 0x2e01823e
call fcn.2e0349b8
ret 0xc