Function at 0x100120b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x8d0]
push ebx
push esi
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x828], 0
mov edx, str._r_aTACData
lea eax, [ebp - 0x880]
call fcn.1000c740
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 0x8cc], 0
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c0], 0
mov dword [ebp - 0x8bc], 0
mov dword [ebp - 0x8b8], 0
mov eax, 1
lea edx, [ebp - 0x8a4]
lea ecx, [ebp - 0x88c]
call fcn.1000bb20
call fcn.1000d620
push eax
test eax, eax
jne 0x100124d2
mov word [ebp - 0x824], 0xf
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x818], 0xffffffff
mov dword [ebp - 0x814], 1
push 0xffff
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x824]
push eax
push dword [ebx + 0x28]
mov eax, dword [ebx + 0x28]
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
jne 0x100124bb
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x80c]
call sub.shell32.dll_DragQueryFileA
mov ebx, eax
test ebx, ebx
jbe 0x100122d2
test esi, esi
jne 0x100121d7
mov edx, 0x10044964
lea eax, [ebp - 0x828]
call fcn.100073b0
cmp esi, 1
jne 0x100121ec
mov edx, 0x10044974
lea eax, [ebp - 0x828]
call fcn.100073b0
cmp esi, 2
jne 0x10012201
mov edx, 0x10044984
lea eax, [ebp - 0x828]
call fcn.100073b0
lea eax, [ebx - 1]
mov ebx, eax
mov esi, 0
cmp ebx, esi
jb 0x100122d2
sub esi, 1
mov esi, esi
add esi, 1
push 0x802
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x80c]
call sub.shell32.dll_DragQueryFileW
push 0
lea ecx, [ebp - 0x8bc]
mov eax, dword [ebp - 0x828]
mov dx, 0xfde9
call fcn.10007aa0
mov eax, dword [ebp - 0x8bc]
lea ecx, [ebp - 0x8b8]
mov dx, 0
call fcn.10007aa0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x8b4], eax
push 1
lea eax, [ebp - 0x8c0]
push eax
lea eax, [ebp - 0x804]
mov cx, 0xfde9
mov edx, 0x400
call fcn.10009a40
mov eax, dword [ebp - 0x8c0]
lea ecx, [ebp - 0x8bc]
mov dx, 0
call fcn.10007aa0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x8b0], eax
mov eax, 0x10044994
mov dword [ebp - 0x8ac], eax
lea edx, [ebp - 0x8b4]
lea eax, [ebp - 0x828]
mov ecx, 2
call fcn.10007720
cmp ebx, esi
ja 0x10012218
mov edx, dword [ebp - 0x828]
lea eax, [ebp - 0x880]
call fcn.100073b0
mov eax, 0x100449a4
push eax
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov ebx, eax
test ebx, ebx
je 0x100124bb
mov eax, str.LocalACDATA_Map
push eax
mov eax, dword [ebp - 0x880]
test eax, eax
je 0x10012311
mov eax, dword [eax - 4]
lea ecx, [eax + 4]
mov eax, 0x1004e9f0
mov edx, 1
call fcn.100402b0
mov esi, eax
test dword [esi + 0x14], 1
je 0x100124ae
mov eax, esi
mov edx, dword [esi]
call dword [edx + 0x70]
test edx, edx
jg 0x1001234c
jl 0x100124ae
cmp eax, 4
jb 0x100124ae
mov edx, dword [ebp - 0x880]
mov eax, esi
call fcn.100131b0
lea eax, [ebp - 0x86c]
mov cl, 0
mov edx, 0x44
call fcn.100028d0
lea eax, [ebp - 0x87c]
mov cl, 0
mov edx, 0x10
call fcn.100028d0
mov dword [ebp - 0x86c], 0x44
mov dword [ebp - 0x840], 1
mov word [ebp - 0x83c], 1
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x86c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8c0]
call fcn.10002820
push 0xffff
lea eax, [ebp - 0x8b8]
call fcn.10012780
mov eax, dword [ebp - 0x8b8]
lea edx, [ebp - 0x8bc]
call fcn.1001f410
mov edx, dword [ebp - 0x8bc]
mov ecx, str.acmain.exe
lea eax, [ebp - 0x8c0]
call fcn.100074b0
mov eax, dword [ebp - 0x8c0]
lea edx, [ebp - 0x8c4]
call fcn.10009650
mov eax, dword [ebp - 0x8c4]
test eax, eax
jne 0x10012418
mov eax, 0x10050300
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x1001242c
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
jmp 0x10012498
push 0x40
mov eax, 0x10044a14
push eax
lea eax, [ebp - 0x8c8]
call fcn.100094d0
lea eax, [ebp - 0x8d0]
push eax
mov ecx, str.Unable_to_execute_Attribute_Changer__acmain.exe_
mov edx, str.MSG_GLNoMain
mov eax, str.Misc
call fcn.10012930
mov eax, dword [ebp - 0x8d0]
lea edx, [ebp - 0x8cc]
call fcn.10009650
mov ecx, dword [ebp - 0x8cc]
mov edx, str.CreateProcessW__
lea eax, [ebp - 0x8c8]
call fcn.10009770
mov eax, dword [ebp - 0x8c8]
test eax, eax
jne 0x10012490
mov eax, 0x10050300
push eax
push 0
call sub.user32.dll_MessageBoxW
push dword [ebp - 0x87c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x878]
call sub.kernel32.dll_CloseHandle
mov eax, esi
call fcn.1000b110
push ebx
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x80c]
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0x810]
push eax
call sub.ole32.dll_ReleaseStgMedium
call fcn.1000bda0
lea eax, [ebp - 0x8d0]
call fcn.10002820
lea eax, [ebp - 0x8cc]
call fcn.100094d0
lea eax, [ebp - 0x8c8]
call fcn.100094d0
lea eax, [ebp - 0x8c4]
call fcn.100094d0
lea eax, [ebp - 0x8c0]
call fcn.10002820
lea eax, [ebp - 0x8bc]
call fcn.10002820
lea eax, [ebp - 0x8b8]
call fcn.10002820
lea eax, [ebp - 0x828]
call fcn.10002820
mov edx, str._r_aTACData
lea eax, [ebp - 0x880]
call fcn.1000c7a0
pop eax
test eax, eax
je 0x10012549
call fcn.1000bed0
pop esi
pop ebx
leave
ret