Function at 0x103d5c5
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x1077400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x220], eax
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x210], esi
call sub.msvcrt.dll_memset
push 0x40
lea eax, [ebp - 0x270]
push esi
push eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x274], esi
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x230], esi
xor eax, eax
lea edi, [ebp - 0x22c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x1077004]
mov esi, 0x1077004
mov ebx, 0x100ad2c
cmp eax, esi
je 0x103d671
test dword [eax + 0x1c], 0x100
je 0x103d671
cmp byte [eax + 0x19], 5
jb 0x103d671
push ebx
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01015bb9
push 0x20019
xor edi, edi
push edi
push 0x100b038
push 0x80000000
call fcn.0101fb88
mov dword [ebp - 0x218], eax
cmp eax, edi
jne 0x103d6d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x103d8c6
test dword [eax + 0x1c], 0x100
je 0x103d8c6
cmp byte [eax + 0x19], 2
jb 0x103d8c6
push dword [ebp - 0x210]
push ebx
push 0x32
jmp 0x103d8a3
push edi
push edi
push eax
call fcn.01020624
cmp eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
jne 0x103d773
call edi
mov dword [ebp - 0x210], eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x103d720
test dword [eax + 0x1c], 0x100
je 0x103d720
cmp byte [eax + 0x19], 2
jb 0x103d720
push dword [ebp - 0x210]
push ebx
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
push 0
push 0
push dword [ebp - 0x218]
call fcn.01020644
mov dword [ebp - 0x214], eax
test eax, eax
jne 0x103d773
call edi
mov dword [ebp - 0x210], eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x103d8c6
test dword [eax + 0x1c], 0x100
je 0x103d8c6
cmp byte [eax + 0x19], 2
jb 0x103d8c6
push dword [ebp - 0x210]
push ebx
push 0x34
jmp 0x103d8a3
push 0x100b02c
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x103d7c2
mov ecx, 0x65b
mov dword [ebp - 0x210], ecx
mov eax, dword [0x1077004]
cmp eax, esi
je 0x103d8c6
test dword [eax + 0x1c], 0x100
je 0x103d8c6
cmp byte [eax + 0x19], 2
jb 0x103d8c6
push ecx
push ebx
push 0x35
jmp 0x103d8a3
push dword [ebp - 0x21c]
xor ecx, ecx
push dword [ebp - 0x220]
mov word [eax], cx
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push 0x100b014
push 0x104
push eax
call fcn.010166de
xor ecx, ecx
add esp, 0x18
cmp eax, ecx
jge 0x103d840
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x103d80b
movzx eax, ax
mov dword [ebp - 0x210], eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x103d8c6
test dword [eax + 0x1c], 0x100
je 0x103d8c6
cmp byte [eax + 0x19], 2
jb 0x103d8c6
push dword [ebp - 0x210]
push ebx
push 0x36
jmp 0x103d8a3
push 9
pop eax
mov word [ebp - 0x244], ax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x274]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
push ecx
mov dword [ebp - 0x274], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x103d8b0
call edi
mov dword [ebp - 0x210], eax
mov eax, dword [0x1077004]
cmp eax, esi
je 0x103d8c6
test dword [eax + 0x1c], 0x100
je 0x103d8c6
cmp byte [eax + 0x19], 2
jb 0x103d8c6
push dword [ebp - 0x210]
push ebx
push 0x37
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101e0d7
jmp 0x103d8c6
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x230]
call esi
push dword [ebp - 0x214]
call fcn.0101e9ef
cmp dword [ebp - 0x218], 0
pop edi
pop esi
pop ebx
je 0x103d8e9
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
call fcn.0101d9bb
leave
ret 8