Function at 0x1009e6a0
Capabilities:
Create process on windows

Disassembly:
push 0xa8
mov eax, 0x1014c703
call fcn.101437b3
mov eax, dword [ebp + 0x18]
xor edi, edi
test eax, eax
je 0x1009e6ba
mov dword [eax], edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
cmp dword [esi + 8], 0
je 0x1009e99d
push 0xffffffffffffffff
push str.https:__
lea ecx, [ebp - 0x40]
call fcn.10097b30
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.10097af3
push dword [ebp - 0x38]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.101061b1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x30]
call fcn.101061b1
test eax, eax
jne 0x1009e78c
push esi
lea ecx, [ebp - 0x50]
call fcn.10097af3
push edi
mov byte [ebp - 4], 3
call fcn.101061b1
pop ecx
lea ecx, [ebp - 0xb4]
push ecx
mov ecx, eax
call fcn.101061b1
mov esi, eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 4
push str._sender
push eax
call fcn.101061b1
pop ecx
pop ecx
push esi
push eax
call fcn.101061b1
pop ecx
pop ecx
lea ecx, [ebp - 0xb4]
call fcn.101061b1
push 1
push edi
push edi
push dword [ebp - 0x4c]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
lea ecx, [ebp - 0x50]
setge bl
call fcn.101061b1
lea ecx, [ebp - 0x30]
call fcn.101061b1
lea ecx, [ebp - 0x40]
call fcn.101061b1
mov al, bl
jmp 0x1009e99f
mov eax, dword [esi + 8]
lea eax, [eax*2 + 2]
push eax
call fcn.101061b1
pop ecx
push dword [esi + 8]
mov ebx, eax
mov ecx, esi
push ebx
mov dword [ebp - 0x18], ebx
call fcn.101061b1
mov eax, dword [esi + 8]
xor ecx, ecx
push 0x44
pop esi
push esi
mov word [ebx + eax*2], cx
lea eax, [ebp - 0xa4]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [ebp - 0x78], 1
push 0xfffffffffffffff6
call esi
push 0xfffffffffffffff5
mov dword [ebp - 0x6c], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x68], eax
call esi
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xa0], edi
jne 0x1009e802
push 5
jmp 0x1009e804
push 7
pop eax
push ebx
mov word [ebp - 0x74], ax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov dword [ebp - 0x14], eax
add eax, eax
push eax
call fcn.101061b1
pop ecx
pop ecx
push ebx
push dword [ebp - 0x14]
mov esi, eax
push esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 0x10
dec eax
movzx ecx, word [esi + eax*2]
cmp ecx, 0x5c
je 0x1009e847
cmp ecx, 0x2f
jne 0x1009e838
xor ecx, ecx
push ebx
mov word [esi + eax*2], cx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
lea esi, [eax + 0xa]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1009e867
mov eax, dword [eax + 8]
add eax, 2
add esi, eax
lea eax, [esi + esi]
push eax
call fcn.101061b1
pop ecx
mov ebx, eax
xor eax, eax
push 0x22
pop ecx
push 0x20
mov word [ebx], ax
mov word [ebp + 0xe], ax
pop eax
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x18]
mov word [ebp + 0xc], cx
cmp word [eax], cx
je 0x1009e8aa
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov eax, dword [ebp - 0x18]
add esp, 0xc
push eax
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov ax, word [eax]
cmp ax, word [ebp + 0xc]
je 0x1009e8d1
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1009e92d
mov eax, dword [eax + 8]
lea eax, [eax*2 + 2]
push eax
call fcn.101061b1
pop ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
push dword [eax + 8]
push ecx
mov ecx, eax
call fcn.101061b1
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x14]
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x1c
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xa4]
push eax
push esi
push edi
push 8
push edi
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateProcessW]
push dword [ebp - 0x18]
mov edi, eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x1009e96f
mov eax, dword [ebp - 0x58]
mov dword [ecx], eax
push dword [ebp - 0x60]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x5c]
call esi
lea ecx, [ebp - 0x30]
call fcn.101061b1
lea ecx, [ebp - 0x40]
call fcn.101061b1
test edi, edi
je 0x1009e99d
mov al, 1
jmp 0x1009e99f
xor al, al
call fcn.10143711
ret