Function at 0x100bc0d0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10146298]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x10144024]
xor eax, dword [0x10144028]
mov ecx, 0xc098e265
xor edx, edx
div ecx
sub eax, 0xba1d2cf2
xor eax, 0xbf9a11a1
sub eax, 0x70ba37a9
add eax, 0xc37e44f
add eax, 0xb8434d52
sub eax, 0xb421df1b
imul eax, eax, 0x10959528
imul eax, eax, 0xc44c816c
imul eax, eax, 0x2b52286
add eax, 0x26b1bb9c
add eax, 0x21dd5412
mov ecx, 0x48d3fa47
xor edx, edx
div ecx
sub eax, 0x1047d7fd
xor eax, 0xdde9c901
sub eax, 0xedafb110
xor eax, 0x3cc14bb
add eax, 0x90503ec4
add eax, 0xac307394
xor eax, 0xa33fd81
cmp eax, 0x4177f41b
jbe 0x100bccea
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0xe61e3568
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100e6cf0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.1005f870
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0x25a1af39
jbe 0x100bccea
mov al, byte [ebp - 0x16]
test al, 1
jne 0x100bc279
jmp 0x100bc6f8
mov eax, dword [0x10144034]
imul eax, dword [0x10144038]
xor eax, 0x956199c2
imul eax, eax, 0xb0fb2db2
imul eax, eax, 0x8ecc7318
imul eax, eax, 0x5d869f38
or eax, 0x7cca0705
add eax, 0x46002fcb
and eax, 0xe98003d2
or eax, 0x9d40576c
xor eax, 0x4a8a8b24
and eax, 0xbdd1bb19
xor eax, 0x3471ca62
sub eax, 0xb6d7a133
and eax, 0xb07ef6f
imul eax, eax, 0x2ac3ce71
xor eax, 0x47b4c632
or eax, 0x1b1af70
mov ecx, 0xe92a56ec
xor edx, edx
div ecx
mov ecx, 0xf8c212e3
xor edx, edx
div ecx
xor eax, 0xaaa625da
mov ecx, 0x679ddfb
xor edx, edx
div ecx
cmp eax, 0xb4f2417c
jae 0x100bcdc3
mov eax, dword [0x1014403c]
sub eax, dword [0x10144040]
or eax, 0x96a41a63
and eax, 0x9af330ca
mov ecx, 0x8bb3c75a
xor edx, edx
div ecx
add eax, 0x38ac9ec6
sub eax, 0x9a738c00
sub eax, 0xea152c71
add eax, 0xe79d8dbb
mov ecx, 0x8dd7d7dc
xor edx, edx
div ecx
and eax, 0xccc373d5
mov ecx, 0xe9947d48
xor edx, edx
div ecx
xor eax, 0x1e7f4f9e
sub eax, 0xe16a2c1c
and eax, 0x123e54a8
add eax, 0x9bd28b16
and eax, 0x1b043399
imul eax, eax, 0x5fe36340
add eax, 0x178170da
sub eax, 0x346e160e
and eax, 0x9f463f0f
xor eax, 0xda4eece9
cmp eax, 0x515ef3ed
je 0x100bc304
mov eax, dword [0x10144044]
or eax, dword [0x10144048]
imul eax, eax, 0xbd499e43
sub eax, 0x30bff1df
mov ecx, 0x8cb3fbb2
xor edx, edx
div ecx
or eax, 0x1bcad876
and eax, 0xf6fff69c
add eax, 0xd99a6722
mov ecx, 0xa4d17881
xor edx, edx
div ecx
imul eax, eax, 0x4b7bad28
imul eax, eax, 0x97b41fe5
mov ecx, 0xb8663078
xor edx, edx
div ecx
or eax, 0xcabfaa24
mov ecx, 0xe5c205ae
xor edx, edx
div ecx
sub eax, 0xfc269e1
imul eax, eax, 0x80b197ef
imul eax, eax, 0x6fbd955c
sub eax, 0xdc0ad207
xor eax, 0xf49e8f0e
and eax, 0xf367b656
or eax, 0x87654a1e
or eax, 0xb94e27f1
cmp eax, 0xf31a866b
jb 0x100bca6f
mov eax, dword [0x1014404c]
add eax, dword [0x10144050]
xor eax, 0xd06c25f1
sub eax, 0xce9c5da7
sub eax, 0xfd158ca
xor eax, 0x1539f4c6
mov ecx, 0xc6e09790
xor edx, edx
div ecx
and eax, 0x9823c635
mov ecx, 0xf3539d4b
xor edx, edx
div ecx
mov ecx, 0x52aac2fc
xor edx, edx
div ecx
sub eax, 0x8773c583
add eax, 0xc94a2a28
or eax, 0x44c7e787
add eax, 0x87263016
add eax, 0x496c9b3e
mov ecx, 0xfed66088
xor edx, edx
div ecx
mov ecx, 0x3f74d4dd
xor edx, edx
div ecx
mov ecx, 0xde2fdf9e
xor edx, edx
div ecx
or eax, 0x921e46a8
imul eax, eax, 0x7e9e3a08
add eax, 0xb4e1a80d
xor eax, 0x81270e83
cmp eax, 0x29c94137
jbe 0x100bcdc8
mov eax, dword [0x10144054]
and eax, dword [0x10144058]
and eax, 0x56d54341
xor eax, 0xcfce2f89
sub eax, 0xbd69b703
xor eax, 0xaf559f75
and eax, 0x562524d
mov ecx, 0x97d70b9f
xor edx, edx
div ecx
add eax, 0x23d9cec8
imul eax, eax, 0xc3f51828
xor eax, 0xa286ebc3
xor eax, 0x26db81e4
imul eax, eax, 0x3bc984a9
add eax, 0x454659ce
sub eax, 0xc23e1209
imul eax, eax, 0xb147e69f
sub eax, 0x21ab240d
xor eax, 0x5acaaf5e
and eax, 0x67a3faeb
imul eax, eax, 0x9c176d60
mov ecx, 0xd4e4b4ef
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor ecx, 0x9a3fd3a5
mov dword [ebp - 0x30], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x30]
cmp eax, 0xc5bd257a
je 0x100bcdc8
mov eax, dword [0x1014405c]
xor eax, dword [0x10144060]
add eax, 0xf7a937f9
mov ecx, 0x16c26d1b
xor edx, edx
div ecx
mov ecx, 0x38d9737d
xor edx, edx
div ecx
xor eax, 0x59f593df
sub eax, 0xa101d087
xor eax, 0x6818ef34
and eax, 0xb4741b4e
mov ecx, 0xc4d47cb6
xor edx, edx
div ecx
and eax, 0xcf8e02d8
mov ecx, 0x3ca43c1d
xor edx, edx
div ecx
sub eax, 0x2971a045
and eax, 0x9abe0970
xor eax, 0x4d58e3f4
sub eax, 0x7911a52d
mov ecx, 0xd727f21d
xor edx, edx
div ecx
and eax, 0x36baa5f3
xor eax, 0xcfdaaf9a
add eax, 0x99232684
and eax, 0xc9634535
sub eax, 0x43df194b
cmp eax, 0xf54aa44e
jae 0x100bc41a
mov eax, dword [0x10144064]
xor eax, dword [0x10144068]
xor eax, 0xb1e90155
and eax, 0x2ae02f2c
xor eax, 0xc33f66a5
mov ecx, 0x4b989f7b
xor edx, edx
div ecx
sub eax, 0x8e127000
or eax, 0x3c62544f
add eax, 0xa5a0c2eb
imul eax, eax, 0x33df5e8d
mov ecx, 0xb689dfcb
xor edx, edx
div ecx
sub eax, 0xde96ddc0
mov ecx, 0xcf0c3ecf
xor edx, edx
div ecx
mov ecx, 0xfed5d66e
xor edx, edx
div ecx
and eax, 0x2c92b646
imul eax, eax, 0x866ffee0
add eax, 0x533967de
or eax, 0x4f79c2e1
and eax, 0x2954f5da
sub eax, 0x8421c231
sub eax, 0x44bcc079
add eax, 0x5acdeb85
cmp eax, 0x33f61a5f
jbe 0x100bcde6
mov eax, dword [0x1014406c]
add eax, dword [0x10144070]
add eax, 0xa8ed7aa7
add eax, 0x3d53cff9
xor eax, 0x44c6aec
xor eax, 0xb866bc0d
sub eax, 0xb2bcd06e
imul eax, eax, 0xe9ac3a06
imul eax, eax, 0xafba3b6
imul eax, eax, 0x524e5b4d
and eax, 0x109cb365
xor eax, 0x3a029a8a
imul eax, eax, 0x8752c4b1
or eax, 0x8ca3f2d3
imul eax, eax, 0x112096cb
imul eax, eax, 0xfa7687e1
and eax, 0x7afef8ca
mov ecx, 0x4f136602
xor edx, edx
div ecx
xor eax, 0x4eb55bd4
xor eax, 0xeec9f2d3
add eax, 0x5aaf54a0
xor eax, 0xf6a45f52
cmp eax, 0xbfb85b38
ja 0x100bc66f
jmp 0x100bc6f8
mov eax, dword [0x10144074]
xor edx, edx
div dword [0x10144078]
sub eax, 0x5e86acf8
xor eax, 0xae38c96d
xor eax, 0x4a6f8807
add eax, 0x6932615c
add eax, 0x87fe8e13
mov ecx, 0x7496b176
xor edx, edx
div ecx
xor eax, 0xcda97bf4
and eax, 0x66308cc3
imul eax, eax, 0x8e57cd8
mov ecx, 0xe2089e6f
xor edx, edx
div ecx
and eax, 0x18beeee0
add eax, 0x89de7a44
and eax, 0xd3459aaf
and eax, 0x5f7359fd
mov ecx, 0x155975e
xor edx, edx
div ecx
xor eax, 0xc8959951
add eax, 0x2dab1e18
and eax, 0xdb49007d
mov ecx, 0xee507716
xor edx, edx
div ecx
mov ecx, 0x515123c9
xor edx, edx
div ecx
cmp eax, 0xa00798b9
ja 0x100bcdeb
mov eax, dword [0x1014407c]
xor edx, edx
div dword [0x10144080]
add eax, 0xc7a0843e
mov ecx, 0x436559c6
xor edx, edx
div ecx
sub eax, 0xafb431b5
sub eax, 0xc33aba17
and eax, 0x93d2efc8
add eax, 0x9e72a88f
imul eax, eax, 0x69b4f9ad
sub eax, 0xc5b4ddd
mov ecx, 0x3035fc2
xor edx, edx
div ecx
and eax, 0xa01c7300
or eax, 0xd5ea0448
add eax, 0xf07c433b
add eax, 0xe93905b8
sub eax, 0x8ed41897
xor eax, 0x2ba25361
add eax, 0xc740ad01
and eax, 0x621f51bf
and eax, 0xb893bab6
add eax, 0xef5a556e
add eax, 0xdeeb8044
cmp eax, 0x553a4025
jbe 0x100bc789
mov eax, dword [0x10144084]
imul eax, dword [0x10144088]
mov ecx, 0xed3e07e3
xor edx, edx
div ecx
add eax, 0x2f53fc8d
sub eax, 0xcacae022
mov ecx, 0xce4dc4bd
xor edx, edx
div ecx
add eax, 0x3ccefbf0
sub eax, 0x21d674bc
sub eax, 0xc1ea5770
add eax, 0x8866113f
add eax, 0xa250c88d
add eax, 0x70e4da2e
and eax, 0x1c823f62
and eax, 0x7c3207cc
xor eax, 0x941e5f11
add eax, 0x2cb912c9
imul eax, eax, 0xa0629697
add eax, 0x397673a8
sub eax, 0x771ccc86
add eax, 0x4256a9d8
sub eax, 0xa088bea4
xor eax, 0x74b8b808
cmp eax, 0x441e79e0
jae 0x100bcbaa
mov eax, dword [0x1014408c]
or eax, dword [0x10144090]
sub eax, 0x38caec6d
sub eax, 0xbe6f696a
and eax, 0xfb32e031
or eax, 0x4beb61ce
sub eax, 0xdb180125
sub eax, 0x319f3da1
add eax, 0x5ba180fc
or eax, 0xf5dfcd18
or eax, 0x53b4b8f6
mov ecx, 0x5bfc39e
xor edx, edx
div ecx
imul eax, eax, 0x1c69f448
imul eax, eax, 0x48b2e79b
mov ecx, 0xb8d1a2b0
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
or ecx, 0x2be6121d
sub ecx, 0x22d084f
add ecx, 0x1bda108e
and ecx, 0x911ba67a
imul ecx, ecx, 0x11365a0
imul ecx, ecx, 0xdeeb195f
add ecx, 0xbb087d7b
mov dword [ebp - 0x38], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x34], ecx
cmp eax, 0xa85a4f8c
jb 0x100bcbaa
mov eax, dword [0x10144094]
xor edx, edx
div dword [0x10144098]
or eax, 0xe6195d2c
imul eax, eax, 0x288e4f7c
xor eax, 0x61e58de3
xor eax, 0xa3589048
imul eax, eax, 0x6f31bc55
or eax, 0xeff10115
or eax, 0xafa6fc55
and eax, 0x527ac4ac
add eax, 0x87aa6d26
or eax, 0xb4e20145
and eax, 0xb29838c
add eax, 0xc3f66ff7
xor eax, 0x951c7a5a
sub eax, 0xf4270226
xor eax, 0xa4bcdf9a
or eax, 0xcbb2a810
add eax, 0xba6f8cd2
and eax, 0x3e08b84a
add eax, 0xd455a1bf
sub eax, 0x615e6b45
cmp eax, 0xd645fc42
jae 0x100bcdf0
mov eax, dword [0x1014409c]
imul eax, dword [0x101440a0]
xor eax, 0x52b9e1dc
xor eax, 0x51c35640
or eax, 0x4a68be8b
sub eax, 0x747c508
mov ecx, 0x703636c1
xor edx, edx
div ecx
xor eax, 0x4fd1651c
and eax, 0xc6f411ca
imul eax, eax, 0xa3643573
imul eax, eax, 0x39e15ab3
add eax, 0x42abeefe
mov ecx, 0xf1f7fa8b
xor edx, edx
div ecx
add eax, 0xc78c4ba5
and eax, 0xff66eb47
add eax, 0xb9fd9746
mov ecx, 0xeb0350bd
xor edx, edx
div ecx
imul eax, eax, 0xcd36b8a5
and eax, 0x26a37f64
xor eax, 0xd3f795fd
imul eax, eax, 0x1cf52e6a
sub eax, 0xf62d7924
cmp eax, 0x4fdd5710
je 0x100bcdf0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e332f
mov eax, dword [ebp - 0x34]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x101440a4]
add eax, dword [0x101440a8]
and eax, 0xc76d7f6e
imul eax, eax, 0x5dfa0b8a
or eax, 0xa5b3bee2
imul eax, eax, 0xaa66853d
and eax, 0xc692aec7
or eax, 0x3f81fd01
xor eax, 0x6d7acbd9
sub eax, 0xb40e9eea
imul eax, eax, 0xee78c941
mov ecx, 0x32bd9563
xor edx, edx
div ecx
add eax, 0x6b73e8da
and eax, 0xe809d533
add eax, 0x4944a042
and eax, 0x6c009216
and eax, 0x7f33d673
mov ecx, 0x65e3bd2e
xor edx, edx
div ecx
and eax, 0xf6871d72
and eax, 0x922daebc
imul eax, eax, 0x9fdbe63d
sub eax, 0x2ade5671
cmp eax, 0xefac618d
ja 0x100bcdf5
mov eax, dword [0x101440ac]
and eax, dword [str.k_]
mov ecx, 0xf0e24f00
xor edx, edx
div ecx
imul eax, eax, 0xfad55f4
mov ecx, 0xe68a5037
xor edx, edx
div ecx
and eax, 0xa1a28b00
mov ecx, 0xf04521eb
xor edx, edx
div ecx
imul eax, eax, 0x2ea6dd97
imul eax, eax, 0xbd0e9c60
add eax, 0x7493165b
add eax, 0x20df5a6b
and eax, 0x4610b656
imul eax, eax, 0x932a83e
sub eax, 0xfe16c15f
or eax, 0xfa7dd959
or eax, 0xf3cc99f1
or eax, 0xdc50cbb0
or eax, 0x26046703
xor eax, 0x36f9f519
sub eax, 0xc6bd28b
mov ecx, 0x6eb1fee9
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
imul ecx, ecx, 0x8d605908
mov dword [ebp - 0x3c], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x3c]
cmp eax, 0xea7c9591
ja 0x100bcdf5
jmp 0x100bc41a
mov eax, dword [0x101440b4]
sub eax, dword [0x101440b8]
xor eax, 0x618ef2ef
mov ecx, 0x54e7e260
xor edx, edx
div ecx
sub eax, 0x38a16d6f
add eax, 0x6a98205e
mov ecx, 0xf2ea037c
xor edx, edx
div ecx
imul eax, eax, 0xcdf1bcaa
add eax, 0x23b64469
and eax, 0xa27ad8cc
imul eax, eax, 0x67003492
xor eax, 0x7b51a0c4
mov ecx, 0x2ef25c44
xor edx, edx
div ecx
or eax, 0xac6c0c5a
or eax, 0x12729ed2
add eax, 0xb3669f1
xor eax, 0x6723c16e
imul eax, eax, 0x18c87682
sub eax, 0xfee89d40
or eax, 0xde92e7ff
imul eax, eax, 0x628b5186
xor eax, 0xf9f64a5c
cmp eax, 0x1cda18c0
jb 0x100bce13
mov eax, dword [0x101440bc]
and eax, dword [0x101440c0]
or eax, 0x29b906e1
add eax, 0x9e1b1103
sub eax, 0x7bd9bba1
and eax, 0x42634f89
add eax, 0x9e3afdfd
add eax, 0xfee3a1a3
imul eax, eax, 0xa6529953
sub eax, 0x552fd857
and eax, 0xe4bbb66b
xor eax, 0x3f991d5b
xor eax, 0x38627fa5
mov ecx, 0xc4f0ee21
xor edx, edx
div ecx
add eax, 0x49224d4c
xor eax, 0xd813bc06
or eax, 0x3e333e09
and eax, 0x8634766c
mov ecx, 0x637aaf47
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor ecx, 0xef4c015e
sub ecx, 0x11106967
and ecx, 0x6a80a6d2
mov dword [ebp - 0x40], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x40]
cmp eax, 0x924298e
jb 0x100bce13
jmp 0x100bc892
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [ebp - 0x4c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x48], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x44], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100e6cf0
mov edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.1005f870
add esp, 0xc
jmp 0x100bc174
jmp 0x100bc304
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100bc4ad
jmp 0x100bc66f
jmp 0x100bc789
jmp 0x100bc9cf
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100bcaf5
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100bcc34