Function at 0x1012bb10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov ecx, dword [0x101d3b48]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
and al, 1
mov byte [ebp - 0x69], al
lea eax, [ebp - 0x54]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1017e550
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0
mov edx, dword [ebp + 8]
xor eax, eax
lea ecx, [ebp - 0x54]
lea eax, [ebp - 0x64]
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.100c3360
mov dword [ebp - 0x68], 0x44139a44
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], eax
mov al, byte [ebp - 0x69]
mov byte [ebp - 0x75], al
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7c], eax
sub eax, 0x8004ade4
je 0x1012c5f0
jmp 0x1012bc05
mov eax, dword [ebp - 0x7c]
sub eax, 0x89980967
je 0x1012c179
jmp 0x1012bc18
mov eax, dword [ebp - 0x7c]
sub eax, 0xda8d056d
je 0x1012c5ae
jmp 0x1012bc2b
mov eax, dword [ebp - 0x7c]
sub eax, 0xe8dc77f4
je 0x1012c5a0
jmp 0x1012bc3e
mov eax, dword [ebp - 0x7c]
sub eax, 0xd1a52b7
je 0x1012bc86
jmp 0x1012bc51
mov eax, dword [ebp - 0x7c]
sub eax, 0x44139a44
je 0x1012bc69
jmp 0x1012bc64
jmp 0x1012c610
mov eax, dword [ebp - 0x74]
mov bl, byte [ebp - 0x75]
mov ecx, 0xda8d056d
mov edx, 0xd1a52b7
test bl, 1
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x1012c610
mov eax, dword [0x101d3198]
xor edx, edx
div dword [0x101d319c]
mov ecx, 0x8b309b62
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xb2d23fc2
mov esi, 0xffffffff
xor esi, 0xb2d23fc2
mov ecx, eax
and ecx, esi
imul ecx, edx
mov edx, eax
and edx, 0xb2d23fc2
or eax, 0xb2d23fc2
imul eax, edx
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x1b1e5e5a
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
or eax, 0x48d3c0ae
sub eax, 0x9cd70c6b
imul eax, eax, 0xc43c54b8
or eax, 0x5c9c886d
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0xb1b295b1
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x392b2c7b
mov esi, 0xffffffff
xor esi, 0x392b2c7b
mov ecx, eax
and ecx, esi
imul ecx, edx
mov edx, eax
and edx, 0x392b2c7b
or eax, 0x392b2c7b
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, 0x6d69244b
and eax, 0x6d69244b
xor eax, 0xffffffff
and ecx, eax
xor ecx, 0xffffffff
and ecx, 0x920c7528
mov eax, ecx
xor eax, 0xc62b7c22
mov edx, 0xffffffff
xor edx, 0xc62b7c22
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0xf00f4205
or edx, 0xf00f4205
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or ecx, 0xf00f4205
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xc1a9440b
or eax, 0x3dc28a6e
sub eax, 0x73fa7476
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x6cba1af0
add eax, ecx
sub eax, 0xae2fc38e
mov ecx, 0x35d702ee
xor edx, edx
div ecx
mov ecx, 0x954ff0c0
xor edx, edx
div ecx
sub eax, 0xd1326b4f
imul eax, eax, 0xc3c48dbf
add eax, 0x338dd403
sub eax, 0x9da49a2d
sub eax, 0x338dd403
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x1605f531
add ecx, eax
xor eax, eax
sub eax, ecx
and eax, 0x92557d69
mov ecx, 0x984b3ad2
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0xb26c5815
xor ecx, 0xb26c5815
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
or ecx, edx
and ecx, 0xbc1b62c6
xor ecx, 0xffffffff
mov edx, 0xbc1b62c6
and edx, 0xbc1b62c6
xor edx, 0xffffffff
and eax, edx
xor eax, 0xffffffff
and ecx, eax
xor ecx, 0xffffffff
and ecx, 0xc0708e74
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x38ab5be1
mov edx, 0xffffffff
xor edx, 0x38ab5be1
and ecx, edx
or eax, ecx
sub eax, 0xd3bacea8
sub eax, 0x444f5131
sub eax, 0xc623d1e5
add eax, 0x3c8289c3
mov ecx, eax
and ecx, 0xd568ab74
shl ecx, 1
add eax, 0xd568ab74
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0x95312ad8
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x95312ad8
add eax, edx
sub eax, ecx
mov esi, 0xffffffff
xor esi, 0xba1d0f84
mov edx, eax
and edx, esi
mov ecx, eax
or ecx, esi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xba1d0f84
or eax, 0xba1d0f84
imul eax, edx
add eax, ecx
mov ecx, 0x1a3d7daa
xor edx, edx
div ecx
mov esi, eax
or esi, 0x76cb52f9
mov ecx, esi
xor ecx, 0xffffffff
and ecx, 0xa3500a85
mov edx, 0xffffffff
xor edx, 0xa3500a85
mov eax, esi
and eax, edx
imul eax, ecx
mov ecx, esi
and ecx, 0xa3500a85
or esi, 0xa3500a85
imul esi, ecx
add esi, eax
or esi, 0xf879705e
mov eax, esi
xor eax, 0xffffffff
and eax, 0x1080a697
mov ecx, 0xffffffff
xor ecx, 0x1080a697
and esi, ecx
sub esi, eax
sub esi, 0x7d2258c6
or esi, 0x15aa0304
mov eax, esi
xor eax, 0xffffffff
and eax, 0xc657f13b
mov edx, 0xffffffff
xor edx, 0xc657f13b
and esi, edx
mov ecx, 0xffffffff
xor ecx, 0x9472c494
and ecx, 0xc657f13b
and edx, 0x9472c494
or eax, esi
or ecx, edx
xor eax, ecx
or eax, 0xbe2ffc8c
sub eax, 0x58e33033
add eax, 0xe7ba2ad3
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x4181dae5
add eax, ecx
mov ecx, 0xff0749fe
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6ea6d095
mov esi, 0xffffffff
xor esi, 0x6ea6d095
mov ecx, eax
and ecx, esi
imul ecx, edx
mov edx, eax
and edx, 0x6ea6d095
or eax, 0x6ea6d095
imul eax, edx
add eax, ecx
mov edx, 0xffffffff
xor edx, 0x88cb3525
mov ecx, eax
xor ecx, edx
and ecx, eax
and ecx, 0x9bcc1fd
mov eax, ecx
xor eax, 0xffffffff
mov dword [ebp - 0x80], eax
mov esi, 0xffffffff
xor esi, 0x6df1ada9
mov edx, 0xffffffff
xor edx, 0xb65ea91f
and eax, 0xb65ea91f
and ecx, edx
mov edi, esi
and edi, 0xb65ea91f
mov ebx, edx
and ebx, 0x6df1ada9
or eax, ecx
mov ecx, dword [ebp - 0x80]
or edi, ebx
xor eax, edi
or ecx, esi
xor ecx, 0xffffffff
or edx, 0xb65ea91f
and ecx, edx
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xcc306f3a
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x7b9fe4e
add eax, ecx
add eax, 1
mov esi, 0xffffffff
xor esi, 0x20ef025d
mov edx, eax
and edx, esi
mov ecx, eax
or ecx, esi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x20ef025d
or eax, 0x20ef025d
imul eax, edx
add eax, ecx
xor eax, 0xe9e7d41
mov ecx, 0xbc931620
xor edx, edx
div ecx
or eax, 0x6f5d53e2
mov ecx, eax
xor ecx, 0xb8df8988
xor ecx, 0xffffffff
or eax, 0xb8df8988
and eax, ecx
mov esi, 0xffffffff
xor esi, 0xb020a7b5
mov edx, eax
and edx, esi
mov ecx, eax
or ecx, esi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xb020a7b5
or eax, 0xb020a7b5
imul eax, edx
add eax, ecx
sub eax, 0x604f29c3
mov esi, 0xffffffff
xor esi, 0x98344a59
mov edx, eax
and edx, esi
mov ecx, eax
or ecx, esi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x98344a59
or eax, 0x98344a59
imul eax, edx
add eax, ecx
mov ecx, 0x394358ab
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x74]
imul ecx, ecx, 0xcf6c3625
mov esi, ecx
or esi, esi
xor esi, 0xffffffff
mov edx, 0x49304baf
or edx, 0x49304baf
xor edx, 0xffffffff
or esi, edx
xor esi, 0xffffffff
or ecx, 0x49304baf
xor ecx, 0xffffffff
or esi, ecx
xor esi, 0xffffffff
mov ecx, esi
xor ecx, 0x3fa5ae7d
mov edx, 0xffffffff
xor edx, 0x3fa5ae7d
and esi, edx
shl esi, 1
sub esi, ecx
sub esi, 0x49a0d1dd
sub esi, 0x6dd3ab33
mov ecx, 0x8004ade4
mov edx, 0x89980967
cmp esi, 0xfe931209
cmovb ecx, edx
mov dword [eax], ecx
jmp 0x1012c610
mov eax, dword [0x101d31a0]
mov esi, dword [0x101d31a4]
mov edx, esi
xor edx, 0xffffffff
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, esi
add eax, edx
sub eax, ecx
sub eax, 0x8ca134dc
add eax, 0xa6dff4dc
add eax, 0x8ca134dc
mov ecx, 0xb26319f
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x68648c8e
xor ecx, 0xffffffff
add eax, 0x68648c8e
add eax, 1
add eax, ecx
mov ecx, 0x5ab0f2b2
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0xf101f9c
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0xe653cce4
xor edx, edx
div ecx
xor eax, 0x6fc41397
mov ecx, 0xffffffff
xor ecx, 0x4b90750f
add eax, ecx
add eax, 1
imul eax, eax, 0xcb56e118
xor eax, 0xfab93c6b
xor eax, 0xad5c01ab
add eax, 0x90f0cb11
mov ecx, 0xfd8f8d63
xor edx, edx
div ecx
add eax, 0xdbdc29b1
mov esi, 0xffffffff
xor esi, 0xd316efbc
mov edx, eax
and edx, esi
mov ecx, eax
or ecx, esi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd316efbc
or eax, 0xd316efbc
imul eax, edx
add eax, ecx
sub eax, 0x4808c6aa
mov ecx, eax
xor ecx, 0x85fa57ce
xor ecx, 0xffffffff
and ecx, 0x85fa57ce
shl ecx, 1
sub ecx, 0x85fa57ce
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xce601f8e
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x1261e909
mov esi, 0xffffffff
xor esi, 0x1261e909
mov ecx, eax
and ecx, esi
imul ecx, edx
mov edx, eax
and edx, 0x1261e909
or eax, 0x1261e909
imul eax, edx
add eax, ecx
mov ecx, 0xb8842d9b
xor edx, edx
div ecx
xor eax, 0xa883b9cd
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0xd48ebea8
add eax, ecx
mov edx, 0xffffffff
xor edx, 0x9ec7e1fe
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x9ec7e1fe
add eax, edx
sub eax, ecx
xor eax, 0x475dfb3b
mov ecx, eax
and ecx, 0xcf6b0be7
xor eax, 0xcf6b0be7
or ecx, eax
sub ecx, 0x22a71476
or ecx, 0x707ec75d
sub ecx, 0x88e9e24
xor eax, eax
sub eax, 0x8a75be89
add ecx, eax
mov esi, 0xffffffff
xor esi, 0xd933eeba
mov edx, ecx
and edx, esi
mov eax, ecx
or eax, esi
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0xd933eeba
or ecx, 0xd933eeba
imul ecx, edx
add ecx, eax
sub ecx, 0x27d34673
or ecx, 0x372dcd73
xor ecx, 0x6e6867b3
xor ecx, 0xebf3846c
sub ecx, 0x11a4fe45
sub ecx, 0xea848fb2
mov eax, ecx
xor eax, 0xffffffff
mov dword [ebp - 0x88], eax
mov esi, 0xffffffff
xor esi, 0x4f5db1e5
mov edx, 0xffffffff
xor edx, 0x2f9927f1
and eax, 0x2f9927f1
and ecx, edx
mov edi, esi
and edi, 0x2f9927f1
mov ebx, edx
and ebx, 0x4f5db1e5
or eax, ecx
mov ecx, dword [ebp - 0x88]
or edi, ebx
xor eax, edi
or ecx, esi
xor ecx, 0xffffffff
or edx, 0x2f9927f1
and ecx, edx
or eax, ecx
add eax, 0x7b916217
sub eax, 0x6de6b0f7
sub eax, 0x7b916217
add eax, 0xfc408483
imul eax, eax, 0x8cb2d45d
mov ecx, eax
and ecx, 0x8c7e00b9
shl ecx, 1
xor eax, 0x8c7e00b9
add eax, ecx
mov ecx, 0x8572e2cf
xor edx, edx
div ecx
add eax, 0xb8d56fa3
mov ecx, 0x94742884
xor edx, edx
div ecx
sub eax, 0x218a210e
and eax, 0xf37aa788
mov ecx, 0xffffffff
xor ecx, 0xda0a848b
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
and eax, 0xff133974
xor ecx, ecx
sub ecx, 0x8e6d89d2
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0x8019153e
mov ecx, eax
xor ecx, edx
and ecx, eax
xor ecx, 0x56b5a436
or ecx, 0x415b43f4
mov eax, 0xffffffff
xor eax, 0xaa3caf0c
add ecx, eax
add ecx, 1
and ecx, 0xa37aca99
xor ecx, 0x28286e41
add ecx, 0x45e48771
xor ecx, 0x9bcc4e4b
mov eax, ecx
xor eax, 0xffffffff
mov dword [ebp - 0x84], eax
mov esi, 0xffffffff
xor esi, 0x2124a065
mov edx, 0xffffffff
xor edx, 0x362dd80d
and eax, 0x362dd80d
and ecx, edx
mov edi, esi
and edi, 0x362dd80d
mov ebx, edx
and ebx, 0x2124a065
or eax, ecx
mov ecx, dword [ebp - 0x84]
or edi, ebx
xor eax, edi
or ecx, esi
xor ecx, 0xffffffff
or edx, 0x362dd80d
and ecx, edx
or eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf7af975e
mov esi, 0xffffffff
xor esi, 0xf7af975e
mov ecx, eax
and ecx, esi
imul ecx, edx
mov edx, eax
and edx, 0xf7af975e
or eax, 0xf7af975e
imul eax, edx
add eax, ecx
mov ecx, 0xdceb0968
xor edx, edx
div ecx
add eax, 0x4d646b25
mov ecx, 0x99a28f31
xor edx, edx
div ecx
mov esi, eax
sub esi, 0xb27e9720
add esi, 0x8b3ee6b1
sub esi, 0x86a3cf85
mov ecx, esi
xor ecx, 0xffffffff
and ecx, 0x70576aba
mov edx, 0xffffffff
xor edx, 0x70576aba
mov eax, esi
and eax, edx
imul eax, ecx
mov ecx, esi
and ecx, 0x70576aba
or esi, 0x70576aba
imul esi, ecx
add esi, eax
add esi, 0x19b83929
mov eax, esi
add eax, 1
xor esi, 0xffffffff
or esi, 0x9afee8fc
add esi, eax
sub esi, 0x9c1248db
xor esi, 0xb3403536
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [ebp - 0x74]
mov ecx, 0x8004ade4
mov edx, 0xe8dc77f4
cmp esi, 0x427edbd1
cmovae ecx, edx
mov dword [eax], ecx
jmp 0x1012c610
mov eax, dword [ebp - 0x74]
mov dword [eax], 0xda8d056d
jmp 0x1012c610
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017ab8f
mov eax, dword [ebp - 0x8c]
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [ebp - 0x74]
mov dword [eax], 0x89980967
jmp 0x1012bbef