Function at 0x1001f41
Capabilities:
Create process on windows

Disassembly:
mov esi, esi
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push edi
push esi
push dword [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
mov byte [ebp - 1], bl
call edi
or eax, eax
je 0x1002026
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x1001200
call esi
or eax, eax
jne 0x100200f
push 0x20a
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov dword [esp], 0x105
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or eax, eax
je 0x1001fff
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 8
push ebx
push ebx
push ebx
push ebx
push edi
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x50], bx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop edi
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0x10
push dword [ebp + 0x10]
push 0x10011f8
call esi
or eax, eax
jne 0x1002026
mov byte [ebp - 1], 1
call fcn.01002832
push dword [0x1004010]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x1002006
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100208a
cmp byte [ebp - 1], bl
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1002061
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1002080
push dword [0x1004014]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
je 0x1002080
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
push dword [ebp + 0x10]
call edi
jmp 0x1002006
push dword [0x1004014]
push ebx
push ebx
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x10020aa
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002006
cmp byte [ebp - 1], bl
je 0x10020b4
call fcn.01002639
call fcn.010027e4
test eax, eax
je 0x10020c7
call fcn.01001649
jmp 0x10021eb
mov eax, dword [ebp + 8]
mov dword [0x1004088], eax
call fcn.010025f2
push 0x1004084
mov dword [0x1004094], ebx
call dword [sym.imp.msvcrt.dll_time]
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100408c], eax
call fcn.01002ace
cmp eax, ebx
je 0x10020bd
push eax
call edi
test eax, eax
je 0x10020bd
call fcn.01002da5
or eax, eax
je 0x10020bd
call fcn.01001ea9
or eax, eax
je 0x10021eb
call fcn.01002a80
test eax, eax
je 0x100212f
push dword [ebp + 0x14]
push dword [0x1004090]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.01002cc0
cdq
sub eax, edx
mov edi, eax
sar edi, 1
inc edi
call fcn.01001762
cmp eax, edi
jle 0x1002151
mov dword [0x1004080], 0x36ee80
jmp 0x100215b
call fcn.010029c2
mov dword [0x1004080], eax
push ebx
push 0x7530
mov edi, 0x140
push edi
push dword [0x1004090]
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], esi
push 0xff
push dword [0x1004080]
lea eax, [ebp - 0x10]
push ebx
push eax
push 2
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 0x102
jne 0x10021d1
cmp dword [0x1004080], 0x36ee80
jne 0x10021ca
call fcn.01002cc0
cdq
sub eax, edx
mov esi, eax
sar esi, 1
inc esi
call fcn.01001762
cmp eax, esi
jg 0x10021ca
call fcn.010029c2
mov dword [0x1004080], eax
call fcn.01001c74
jmp 0x100217f
cmp eax, ebx
jne 0x1002202
call fcn.01002639
call fcn.01002da5
or eax, eax
jne 0x100217f
call fcn.01001649
xor ebx, ebx
inc ebx
push dword [ebp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
mov eax, ebx
jmp 0x1002008
cmp eax, 1
jne 0x100222c
push edi
push dword [0x1004090]
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
push 0x7530
push edi
push dword [0x1004090]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x100217f
cmp eax, 2
jne 0x100217f
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x100217f
cmp dword [ebp - 0x38], 0x12
je 0x10021e8
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100217f