Function at 0x10070990
Capabilities:
Create process on windows
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e5f51
mov eax, dword fs:[0]
push eax
mov eax, 0x11b4
call fcn.101e01e0
mov eax, dword [0x10276bc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10062c70
cmp eax, 0xa
jle 0x100709dd
call fcn.10062c70
mov dword [0x10280e1c], eax
jmp 0x100709e2
mov eax, dword [0x10280e1c]
cmp eax, 0xa
jg 0x100709f0
push 0x1f4
call esi
jmp 0x100709c7
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [0x10280e14], edi
test edi, edi
jne 0x10070a0e
xor esi, esi
jmp 0x10070a63
lea eax, [ebp - 0x1150]
mov dword [ebp - 0x1150], 0
push eax
push 0x1000
lea eax, [ebp - 0x1114]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x10070a3a
xor esi, esi
jmp 0x10070a5d
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x1114]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
neg eax
sbb esi, esi
and esi, dword [ebp - 0x1114]
mov edi, dword [0x10280e14]
push 0
push 1
lea eax, [ebp - 0x1149]
push eax
lea eax, [esi + 0x2fada]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call edi
cmp byte [ebp - 0x1149], 0xe9
jne 0x10070abf
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
push 8
movups xmmword [eax], xmm0
push str.C2_08_00
push eax
mov dword [eax + 0x10], 8
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov edx, 0x2fada
mov ecx, esi
call fcn.1006c880
add esp, 0x18
push 0
push 1
lea eax, [ebp - 0x114a]
push eax
lea eax, [esi + 0x7bb1c]
push eax
push dword [0x10280e14]
call edi
cmp byte [ebp - 0x114a], 0xe9
jne 0x10070b1a
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
push 8
movups xmmword [eax], xmm0
push str.C2_08_00
push eax
mov dword [eax + 0x10], 8
mov dword [eax + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov edx, 0x7bb1c
mov ecx, esi
call fcn.1006c880
add esp, 0x18
push dword [0x10280e18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.EMUPID_______:
call fcn.10052140
push 0x10061770
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [0x10280e1c]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
push 0x10052360
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
mov ecx, esi
push 0x20
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10052f60
mov dword [esi], eax
mov dword [esi + 0x10], 0x15
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [str.TaskKill___F__IM_adb]
movups xmmword [eax], xmm0
mov ecx, dword [0x1025f450]
mov dword [eax + 0x10], ecx
mov cl, byte [0x1025f454]
mov byte [eax + 0x14], cl
mov byte [eax + 0x15], 0
call fcn.10062810
add esp, 0x18
mov dword [ebp - 0x111c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1118], 0xf
lea ecx, [ebp - 0x112c]
movups xmmword [ebp - 0x112c], xmm0
push 0x30
call fcn.10052f60
movups xmm0, xmmword [str.adb_kill_serveradb_start_server]
mov dword [ebp - 0x112c], eax
mov dword [ebp - 0x111c], 0x20
mov dword [ebp - 0x1118], 0x2f
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x1025f468]
movups xmmword [eax + 0x10], xmm0
mov byte [eax + 0x20], 0
push 3
push 0x1025e7b0
push 0
lea ecx, [ebp - 0x112c]
mov dword [ebp - 4], 0
call fcn.10077d10
cmp dword [ebp - 0x1118], 0x10
lea eax, [ebp - 0x112c]
xorps xmm0, xmm0
mov dword [ebp - 0x11a8], 0x3c
cmovae eax, dword [ebp - 0x112c]
mov dword [ebp - 0x1194], eax
lea eax, [ebp - 0x11a8]
push eax
movlpd qword [ebp - 0x1184], xmm0
movlpd qword [ebp - 0x117c], xmm0
movlpd qword [ebp - 0x1174], xmm0
mov dword [ebp - 0x11a4], 0x40
mov dword [ebp - 0x11a0], 0
mov dword [ebp - 0x119c], 0
mov dword [ebp - 0x1198], str.cmd.exe
mov dword [ebp - 0x1190], 0
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x10070e24
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1118]
cmp ecx, 0x10
jb 0x10070d10
mov edx, dword [ebp - 0x112c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10070d04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10070e8c
push ecx
push edx
call fcn.101df293
add esp, 8
nop
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
mov ecx, esi
push 0x30
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10052f60
mov dword [esi], eax
mov dword [esi + 0x10], 0x24
mov dword [esi + 0x14], 0x2f
movups xmm0, xmmword [str.adb_shell_getprop_sys.boot_completed]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x1025f48c]
movups xmmword [eax + 0x10], xmm0
mov ecx, dword [0x1025f49c]
mov dword [eax + 0x20], ecx
lea ecx, [ebp - 0x1144]
mov byte [eax + 0x24], 0
call fcn.10062930
add esp, 0x18
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [ebp - 0x112c], xmm0
mov dword [ebp - 0x111c], 1
mov dword [ebp - 0x1118], 0xf
mov byte [ebp - 0x112c], 0x31
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1144]
cmp dword [ebp - 0x1130], 0x10
mov edi, dword [ebp - 0x1134]
cmovae eax, dword [ebp - 0x1144]
mov dword [ebp - 0x115c], 0
mov dword [ebp - 0x1158], 0
mov dword [ebp - 0x1150], edi
mov dword [ebp - 0x1154], eax
movups xmmword [ebp - 0x116c], xmm0
cmp edi, 0x7fffffff
ja 0x10071048
cmp edi, 0x10
jae 0x10070e92
movups xmm0, xmmword [eax]
mov esi, 0xf
mov dword [ebp - 0x1150], edi
mov dword [ebp - 0x115c], edi
movups xmmword [ebp - 0x116c], xmm0
mov edx, dword [ebp - 0x116c]
mov dword [ebp - 0x1158], esi
jmp 0x10070ef1
push 0xffffffffffffffff
push dword [ebp - 0x1170]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1148]
push eax
push dword [ebp - 0x1170]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1170]
call edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1118]
cmp ecx, 0x10
jb 0x10070d10
mov edx, dword [ebp - 0x112c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10070d04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10070d04
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10070ea6
mov esi, accept
jmp 0x10070eb1
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x116c]
call fcn.10052f60
lea ecx, [edi + 1]
mov dword [ebp - 0x1148], eax
push ecx
push dword [ebp - 0x1154]
mov dword [ebp - 0x116c], eax
push eax
mov dword [ebp - 0x115c], edi
mov dword [ebp - 0x1158], esi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0x1148]
add esp, 0xc
movups xmm0, xmmword [ebp - 0x112c]
mov byte [ebp - 4], 2
xor edi, edi
mov eax, dword [ebp - 0x1150]
add eax, 0xffffffff
mov dword [ebp - 0x11b0], 1
mov dword [ebp - 0x11ac], 0xf
movups xmmword [ebp - 0x11c0], xmm0
mov dword [ebp - 0x1148], eax
js 0x10070f60
nop word [eax + eax]
xor eax, eax
cmp esi, 0x10
lea ecx, [ebp - 0x116c]
cmovae ecx, edx
add ecx, edi
mov cl, byte [ecx + eax]
cmp cl, byte [ebp + eax - 0x11c0]
jne 0x10070f52
inc eax
cmp eax, 1
jl 0x10070f32
cmp eax, 1
je 0x10070fb2
inc edi
cmp edi, dword [ebp - 0x1148]
jle 0x10070f30
cmp esi, 0x10
jb 0x10070f8e
inc esi
mov eax, edx
cmp esi, 0x1000
jb 0x10070f84
mov edx, dword [eax - 4]
add esi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10070e8c
push esi
push edx
call fcn.101df293
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1130]
cmp eax, 0x10
jb 0x10070d10
mov edx, dword [ebp - 0x1144]
lea ecx, [eax + 1]
jmp 0x10070ce6
cmp esi, 0x10
jb 0x10070fe0
inc esi
mov eax, edx
cmp esi, 0x1000
jb 0x10070fd6
mov edx, dword [eax - 4]
add esi, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10070e8c
push esi
push edx
call fcn.101df293
add esp, 8
cmp edi, 0xffffffff
je 0x10070f8e
mov eax, dword [ebp - 0x1130]
cmp eax, 0x10
jb 0x10071021
mov edx, dword [ebp - 0x1144]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x10071017
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10070e8c
push ecx
push edx
call fcn.101df293
add esp, 8
mov dword [0x10280df0], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101dee0e
mov esp, ebp
pop ebp
ret
call fcn.10047970
int3