Function at 0x10031be0
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov esi, ecx
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x8c], eax
cmp dword [ecx + 0x10], 0
sete byte [esp + 0x2f]
mov ecx, 0x140642be
mov eax, 0x2c4a4308
lea ebp, [esp + 0x48]
lea edi, [esp + 0x38]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10031c30
mov ecx, 0x140642be
nop word cs:[eax + eax]
nop dword [eax]
cmp ecx, 0xe8848b64
jg 0x10031c90
cmp ecx, 0xb754475e
jle 0x10031cd0
cmp ecx, 0xc7301307
jle 0x10031d50
cmp ecx, 0xc7301308
je 0x10031eb6
cmp ecx, 0xda32b226
je 0x10031ed2
cmp ecx, 0xddaea7d7
jne 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0xe4dc6e29
mov ecx, 0xc7301308
mov edx, 0x9c4e6ea8
cmovl ecx, edx
jmp 0x10031c30
cmp ecx, 0x57d24d7b
jg 0x10031d10
cmp ecx, 0x140642bd
jle 0x10031d84
cmp ecx, 0x140642be
je 0x10031eee
cmp ecx, 0x4eb9e50c
jne 0x10031f71
mov ecx, 0x90d840f3
jmp 0x10031c30
cmp ecx, 0x9c4e6ea7
jg 0x10031db8
cmp ecx, 0x90d840f3
je 0x10031efc
cmp ecx, 0x964664b3
jne 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0x2c4a4308
mov ecx, 0xda32b226
mov edx, 0xddaea7d7
cmovl ecx, edx
jmp 0x10031c30
cmp ecx, 0x5ca09061
jg 0x10031e5f
cmp ecx, 0x57d24d7c
je 0x10031f06
cmp ecx, 0x59198eab
jne 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0x2c4a4308
mov ecx, 0x4eb9e50c
mov edx, 0xf2f23c6
cmove ecx, edx
jmp 0x10031c30
cmp ecx, 0xb754475f
je 0x10031f1d
cmp ecx, 0xc3557779
jne 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0x695a7c47
mov ecx, 0x5ca09062
mov edx, 0xb754475f
cmovl ecx, edx
jmp 0x10031c30
cmp ecx, 0xe8848b65
je 0x10031c1d
cmp ecx, 0xf2f23c6
jne 0x10031c30
cmp byte [esp + 0x2f], 0
mov eax, 0x695a7c47
mov ecx, 0xe4dc6e29
cmovne eax, ecx
mov ecx, 0xe8848b65
jmp 0x10031c30
cmp ecx, 0x9c4e6ea8
je 0x10031f39
cmp ecx, 0xa1949bfc
jne 0x10031c30
mov dword [esp + 0x30], ebp
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x40], 0
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
movups xmmword [eax], xmm0
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10031e0e
mov eax, dword [esi]
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebp
movaps xmm0, xmmword [0x1005f970]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
mov eax, 0x3f7e515b
mov ecx, 0xae5aad35
cmove eax, ecx
mov ecx, 0xe8848b65
jmp 0x10031c30
cmp ecx, 0x5ca09062
je 0x10031f55
cmp ecx, 0x79259e73
jne 0x10031c30
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebx
sub esp, 4
mov ecx, 0xe8848b65
mov eax, 0xae5aad35
jmp 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0xe4dc6e29
mov ecx, 0x4eb9e50c
mov edx, 0x49117e47
cmove ecx, edx
jmp 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0x3f7e515b
mov ecx, 0xc3557779
mov edx, 0x59198eab
cmovl ecx, edx
jmp 0x10031c30
mov dword [esp + 0x28], eax
mov ecx, 0x964664b3
jmp 0x10031c30
mov ecx, 0xe8848b65
jmp 0x10031c30
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, 0xe8848b65
mov eax, 0xe4dc6e29
jmp 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0x3f7e515b
mov ecx, 0x4eb9e50c
mov edx, 0x79259e73
cmove ecx, edx
jmp 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0xae5aad35
mov ecx, 0x4eb9e50c
mov edx, 0x57d24d7c
cmove ecx, edx
jmp 0x10031c30
mov ecx, dword [esp + 0x28]
cmp ecx, 0x695a7c47
mov ecx, 0x4eb9e50c
mov edx, 0xa1949bfc
cmove ecx, edx
jmp 0x10031c30
cmp ecx, 0x49117e47
jne 0x10031c30
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.10050a8a
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret