Function at 0x1002db8
Capabilities:
Create process on windows

Disassembly:
push 0x94
push 0x1001a90
call fcn.01008060
mov eax, dword [0x100a140]
mov dword [ebp - 0x1c], eax
mov ebx, ecx
mov dword [ebp - 0x48], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov eax, dword [ebp + 0x10]
push eax
push dword [esi]
call fcn.010029ab
mov dword [ebx], fcn.01002a53
xor edx, edx
mov dword [ebp - 0xa4], edx
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x48], edx
lea edi, [ebx + 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 0x60], edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], edx
mov ecx, dword [esi + 0xc]
mov dword [ebx + 0x64], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x44], edx
cmp eax, edx
je 0x10033e4
cmp dword [ebx + 0x20], edx
je 0x10033e4
mov dword [ebx + 0x20], edx
lea eax, [ebp - 0x5c]
push eax
push 0xffff
push dword [esi + 8]
call fcn.010081d8
test eax, eax
jl 0x10033e4
mov ecx, ebx
call fcn.01002af4
test eax, eax
je 0x10033e4
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x1002ea0
cmp eax, 0x720
je 0x1002ea0
test byte [0x100a0bc], 8
je 0x10033e4
cmp byte [0x100a0b9], 2
jb 0x10033e4
push eax
push 0x10017b8
push 0xa
jmp 0x1002f41
lea esi, [ebx + 0x4c]
push esi
lea eax, [ebp - 0x34]
push eax
mov edi, dword [sym.imp.RPCRT4.dll_UuidToStringW]
call edi
test eax, eax
je 0x1002ed8
test byte [0x100a0bc], 8
je 0x10033e4
cmp byte [0x100a0b9], 2
jb 0x10033e4
push eax
push 0x10017b8
push 0xb
jmp 0x1002f41
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x1002f11
cmp eax, 0x720
je 0x1002f11
test byte [0x100a0bc], 8
je 0x10033e4
cmp byte [0x100a0b9], 2
jb 0x10033e4
push eax
push 0x10017b8
push 0xc
jmp 0x1002f41
lea eax, [ebx + 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
call edi
test eax, eax
je 0x1002f57
test byte [0x100a0bc], 8
je 0x10033e4
cmp byte [0x100a0b9], 2
jb 0x10033e4
push eax
push 0x10017b8
push 0xd
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
jmp 0x10033e4
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x4c], eax
push dword [esi]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
mov edi, eax
push dword [ebx + 0x48]
call esi
add edi, eax
push dword [ebp - 0x4c]
call esi
add edi, eax
push 0x1001a64
call esi
add edi, eax
push 0x10019c8
call esi
add edi, eax
push 0x10019b4
call esi
add edi, eax
push 0x1001988
call esi
add edi, eax
push 0x1001964
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x100195c
call esi
add edi, eax
push 0x100195c
call esi
add edi, eax
push 0x100195c
call esi
add edi, eax
push 0x100195c
call esi
add esp, 0x40
add edi, eax
push dword [ebx + 0x44]
call esi
add edi, dword [ebp - 0x5c]
lea esi, [eax + edi + 1]
lea eax, [esi + esi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x58], edi
test edi, edi
jne 0x1003046
test byte [0x100a0bc], 8
je 0x10033e4
cmp byte [0x100a0b9], 3
jb 0x10033e4
push 0x10017b8
push 0xe
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
jmp 0x10033e4
push 0x100195c
push esi
push edi
call fcn.010081b6
test eax, eax
jl 0x10033dd
push dword [ebx + 0x44]
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x100195c
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x1001960
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x1001964
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push dword [ebx + 0x4c]
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x1001960
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x1001988
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push dword [ebx + 0x48]
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x1001960
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x10019b4
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x10019c8
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push dword [ebx + 0x30]
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x1001960
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x1001a64
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x100195c
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
mov eax, dword [ebp - 0x50]
push dword [eax + 8]
push esi
push edi
call fcn.01008239
test eax, eax
jl 0x10033dd
push 0x100195c
push esi
push edi
call fcn.01008239
xor esi, esi
cmp eax, esi
jl 0x10033dd
test byte [0x100a0bc], 8
je 0x10031d4
cmp byte [0x100a0b9], 5
jb 0x10031d4
push edi
push 0x10017b8
push 0xf
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028e7
call fcn.01008690
mov dword [ebp - 0x40], eax
cmp eax, esi
jne 0x1003217
test byte [0x100a0bc], 8
je 0x10033dd
cmp byte [0x100a0b9], 2
jb 0x10033dd
push 0x10017b8
push 0x10
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
jmp 0x10033dd
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0xa4]
push eax
push esi
push esi
push 0x10
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
jne 0x1003273
test byte [0x100a0bc], 8
je 0x10033d3
cmp byte [0x100a0b9], 2
jb 0x10033d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10017b8
push 0x11
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
jmp 0x10033d3
push esi
push dword [ebp - 0x40]
push 3
lea eax, [ebx + 0x60]
push eax
push dword [ebx + 0x48]
call fcn.01008ee3
mov dword [ebp - 0x38], eax
cmp eax, esi
jge 0x10032b2
test byte [0x100a0bc], 8
je 0x10033d3
cmp byte [0x100a0b9], 2
jb 0x10033d3
push 0x10017b8
push 0x12
jmp 0x10033ae
mov dword [ebp - 0x3c], esi
mov eax, dword [ebx + 0x68]
imul eax, eax, 0x3e8
cmp dword [ebp - 0x3c], eax
jae 0x1003390
mov eax, dword [0x1001954]
mov dword [ebp - 0x24], eax
mov eax, dword [0x1001958]
mov dword [ebp - 0x20], eax
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], esi
lea edx, [ebp - 0x44]
push edx
push esi
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebx + 0x60]
call fcn.01002749
mov dword [ebp - 0x38], eax
or dword [ebp - 4], 0xffffffff
jmp 0x1003367
mov eax, dword [ebp - 0x38]
and eax, 0xffff
cmp eax, 0x6ba
jne 0x100338d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [ebp - 0x3c], 0x3e8
jmp 0x10032b5
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], esi
jge 0x10033c1
test byte [0x100a0bc], 8
je 0x10033d3
cmp byte [0x100a0b9], 2
jb 0x10033d3
push 0x10017b8
push 0x14
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
jmp 0x10033d3
xor esi, esi
inc esi
mov dword [ebx + 0x20], esi
push ebx
mov ecx, dword [ebx + 0x70]
call fcn.01003afe
mov dword [ebx + 0x74], esi
push dword [ebp - 0x40]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0x1c]
call fcn.01007d97
call fcn.0100809b
ret 0xc