Function at 0x1031fbc
Capabilities:
Create process on windows

Disassembly:
push 0x78
mov eax, 0x105d5e6
call fcn.0104dc9c
xor edi, edi
push 0x1002da8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
call fcn.01031375
push 0x1066af4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.010442ec
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov eax, dword [ebp + 0x10]
mov esi, 0x1066980
mov ecx, esi
mov byte [ebp - 4], 4
mov dword [eax], 0x80004005
call fcn.01039f59
cmp eax, edi
je 0x1032021
push 0x1002d88
lea ecx, [ebp - 0x14]
call fcn.01030c38
mov ecx, esi
call fcn.01039f98
cmp eax, edi
je 0x1032039
push 0x1002d60
lea ecx, [ebp - 0x14]
call fcn.01030c38
mov ecx, esi
call fcn.01039fa1
cmp eax, edi
je 0x1032051
push 0x1002d38
lea ecx, [ebp - 0x14]
call fcn.01030c38
mov ecx, esi
call fcn.01039f8f
cmp eax, edi
je 0x1032069
push 0x1002d10
lea ecx, [ebp - 0x14]
call fcn.01030c38
mov ecx, esi
call fcn.01039f74
cmp eax, edi
je 0x1032081
push 0x1002cf8
lea ecx, [ebp - 0x14]
call fcn.01030c38
mov ecx, esi
call fcn.010385ae
cmp eax, edi
je 0x1032099
push 0x1002ce0
lea ecx, [ebp - 0x14]
call fcn.01030c38
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0103a05a
cmp eax, edi
je 0x10320bc
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 0x1002cc8
push eax
call fcn.01030c79
add esp, 0xc
mov ecx, esi
call fcn.01039f6b
cmp eax, edi
je 0x10320d4
push 0x1002ca8
lea ecx, [ebp - 0x14]
call fcn.01030c38
mov ecx, esi
call fcn.01039f2d
cmp eax, edi
je 0x10320ec
push 0x1002c98
lea ecx, [ebp - 0x14]
call fcn.01030c38
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0103a0c1
cmp eax, edi
je 0x103210f
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 0x1002c78
push eax
call fcn.01030c79
add esp, 0xc
mov ecx, esi
call fcn.01039f7d
cmp eax, edi
je 0x1032127
push 0x1002c60
lea ecx, [ebp - 0x14]
call fcn.01030c38
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.01039f36
cmp eax, edi
je 0x103214a
push dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push 0x1002c3c
push eax
call fcn.01030c79
add esp, 0xc
mov ecx, esi
call fcn.01039f86
cmp eax, edi
je 0x1032162
push 0x1002c2c
lea ecx, [ebp - 0x14]
call fcn.01030c38
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x14]
push 0x1002c10
push eax
call fcn.01030c79
add esp, 0xc
push 0x106688c
lea ecx, [ebp - 0x18]
call fcn.01030ac4
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.01030b8e
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 0x1002bf0
push eax
call fcn.01030c79
add esp, 0xc
push 0x44
pop esi
push esi
lea eax, [ebp - 0x84]
push edi
push eax
call sub.msvcrt.dll_memset
push dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x48], edi
xor eax, eax
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx]
push eax
mov edi, 0x1002428
push edi
mov dword [ebp - 0x84], esi
push 0x1002bc8
mov esi, 0x4000000
push esi
mov dword [ebp - 0x58], 0x100
call fcn.01048e9b
mov eax, dword [ebx]
add esp, 0x20
lea ecx, [ebp - 0x14]
mov dword [ebp + 0xc], eax
call fcn.0102ff7d
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x84]
push ecx
xor ecx, ecx
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov dword [ebp + 0xc], eax
call fcn.01030140
cmp dword [ebp + 0xc], 0
jne 0x1032290
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x1032246
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x1032254
mov dword [ebp - 0x1c], 0x80004005
push dword [ebp - 0x14]
mov ebx, dword [ebx]
push ebx
push 0x1002b48
push 0x1002b30
call esi
push eax
call fcn.01048d15
add esp, 0x14
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0102fb3e
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0102fb3e
mov eax, dword [ebp - 0x1c]
call fcn.0104dd50
ret 0xc
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1032312
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x10322cc
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x10322da
mov dword [ebp - 0x1c], 0x80004005
push 0x1002ad8
push 0x1002ac0
call esi
push eax
call fcn.01048d15
add esp, 0xc
test ebx, ebx
je 0x10322fb
lea ecx, [ebp - 0x24]
call fcn.0102fb22
cmp dword [ebp - 0x20], 0
je 0x103226f
lea ecx, [ebp - 0x20]
call fcn.0102fb22
jmp 0x103226f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
push eax
push edi
push 0x1002a98
push esi
mov dword [ecx], eax
call fcn.01048e9b
add esp, 0x10
jmp 0x10322ef