Function at 0x10005206
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x28
mov al, byte [0x100c53e8]
test al, al
je 0x100053f3
mov ecx, 0x100c53d0
call fcn.1002958e
cmp dword [0x100c4004], 0x185aeeb
jne 0x10005236
mov dword [0x100c4004], 0x186b721
cmp dword [0x100c4008], 0x11ac9cc
jne 0x1000525c
mov dword [0x100c4008], 0x11ac9cd
cmp dword [0x100c400c], 0x67e
je 0x100053e7
mov al, byte [0x100c5420]
test al, al
je 0x10005443
mov ecx, 0x100c53f0
call fcn.100295d8
cmp dword [0x100c4004], 0x185aeeb
jne 0x10005289
mov dword [0x100c4004], 0x186b721
cmp dword [0x100c4008], 0x11ac9cc
jne 0x100052af
mov dword [0x100c4008], 0x11ac9cd
cmp dword [0x100c400c], 0x67e
je 0x100053e7
mov al, byte [0x100c5448]
test al, al
je 0x100054a9
mov ecx, 0x100c5430
call fcn.1002958e
cmp dword [0x100c4004], 0x185aeeb
jne 0x100052dc
mov dword [0x100c4004], 0x186b721
cmp dword [0x100c4008], 0x11ac9cc
jne 0x10005302
mov dword [0x100c4008], 0x11ac9cd
cmp dword [0x100c400c], 0x67e
je 0x100053e7
mov al, byte [0x100c5480]
test al, al
je 0x100054f9
mov ecx, 0x100c5450
call fcn.100295d8
cmp dword [0x100c4004], 0x185aeeb
jne 0x1000532f
mov dword [0x100c4004], 0x186b721
cmp dword [0x100c4008], 0x11ac9cc
jne 0x10005355
mov dword [0x100c4008], 0x11ac9cd
cmp dword [0x100c400c], 0x67e
je 0x100053e7
mov al, byte [0x100c54a8]
test al, al
je 0x1000555f
mov ecx, 0x100c5490
call fcn.10029622
cmp dword [0x100c4004], 0x185aeeb
jne 0x10005382
mov dword [0x100c4004], 0x186b721
cmp dword [0x100c4008], 0x11ac9cc
jne 0x100053a4
mov dword [0x100c4008], 0x11ac9cd
cmp dword [0x100c400c], 0x67e
je 0x100053e7
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], edx
mov dword [esp + 0x14], 4
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
setne al
add esp, 0x28
ret
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov dword [esp], 0x100c53e8
call fcn.10029bf0
test eax, eax
je 0x10005216
mov byte [0x100c53e4], 1
movaps xmm0, xmmword [0x100b50d0]
movaps xmmword [0x100c53d0], xmm0
mov dword [0x100c53e0], 0x221a63d0
mov dword [esp], 0x10023839
call fcn.100013b0
mov dword [esp], 0x100c53e8
call fcn.10029c97
jmp 0x10005216
mov dword [esp], 0x100c5420
call fcn.10029bf0
test eax, eax
je 0x10005269
movaps xmm0, xmmword [0x100b50e0]
movaps xmmword [0x100c53f0], xmm0
movaps xmm0, xmmword [0x100b50f0]
movaps xmmword [0x100c5400], xmm0
movsd xmm0, qword [0x100b5100]
movsd qword [0x100c5410], xmm0
mov word [0x100c5418], 0x196
mov dword [esp], 0x1002384e
call fcn.100013b0
mov dword [esp], 0x100c5420
call fcn.10029c97
jmp 0x10005269
mov dword [esp], 0x100c5448
call fcn.10029bf0
test eax, eax
je 0x100052bc
mov byte [0x100c5444], 1
movaps xmm0, xmmword [0x100b50d0]
movaps xmmword [0x100c5430], xmm0
mov dword [0x100c5440], 0x221a63d0
mov dword [esp], 0x10023867
call fcn.100013b0
mov dword [esp], 0x100c5448
call fcn.10029c97
jmp 0x100052bc
mov dword [esp], 0x100c5480
call fcn.10029bf0
test eax, eax
je 0x1000530f
movaps xmm0, xmmword [0x100b50e0]
movaps xmmword [0x100c5450], xmm0
movaps xmm0, xmmword [0x100b50f0]
movaps xmmword [0x100c5460], xmm0
movsd xmm0, qword [0x100b5100]
movsd qword [0x100c5470], xmm0
mov word [0x100c5478], 0x196
mov dword [esp], 0x1002387c
call fcn.100013b0
mov dword [esp], 0x100c5480
call fcn.10029c97
jmp 0x1000530f
mov dword [esp], 0x100c54a8
call fcn.10029bf0
test eax, eax
je 0x10005362
movaps xmm0, xmmword [0x100b5110]
movaps xmmword [0x100c5490], xmm0
mov dword [0x100c54a0], 0x81a63f9
mov word [0x100c54a4], 0x182
mov dword [esp], 0x10023895
call fcn.100013b0
mov dword [esp], 0x100c54a8
call fcn.10029c97
jmp 0x10005362