Function at 0x10034600
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov esi, ecx
mov eax, dword [0x10065040]
xor eax, esp
mov dword [esp + 0x8c], eax
cmp dword [ecx + 0x10], 0
sete byte [esp + 0x2f]
mov ecx, 0x279ea91d
mov eax, 0x964af2a1
lea edi, [esp + 0x48]
lea ebx, [esp + 0x38]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10034650
mov ecx, 0x279ea91d
nop word cs:[eax + eax]
nop dword [eax]
cmp ecx, 0x843eb73
jle 0x100346a0
cmp ecx, 0x1753ccc1
jle 0x100346f0
cmp ecx, 0x279ea91c
jle 0x100347e3
cmp ecx, 0x5f33bf30
je 0x100348d1
cmp ecx, 0x58487476
je 0x100348ed
cmp ecx, 0x279ea91d
jne 0x10034650
mov dword [esp + 0x28], eax
mov ecx, 0x10e38d38
jmp 0x10034650
cmp ecx, 0xc1b276f5
jle 0x10034730
cmp ecx, 0xdf3b54f3
jle 0x10034812
cmp ecx, 0xe89411d7
je 0x10034909
cmp ecx, 0xfea78e7a
jne 0x1003498d
mov ecx, dword [esp + 0x28]
cmp ecx, 0x133da99c
mov ecx, 0xdef1ff87
mov edx, 0xc1b276f6
cmovl ecx, edx
jmp 0x10034650
cmp ecx, 0x160380ce
jg 0x10034846
cmp ecx, 0x843eb74
je 0x10034913
cmp ecx, 0x10e38d38
jne 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0xcd7103db
mov ecx, 0x5f33bf30
mov edx, 0x58487476
cmovl ecx, edx
jmp 0x10034650
cmp ecx, 0xabbdd52b
jg 0x1003489d
cmp ecx, 0x807b4880
je 0x1003492f
cmp ecx, 0x888ecdb5
jne 0x10034650
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x40], 0
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
movups xmmword [eax], xmm0
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10034792
mov eax, dword [esi]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
movaps xmm0, xmmword [0x10061970]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
mov eax, 0xcd7103db
mov ecx, 0xfe548d95
cmove eax, ecx
mov ecx, 0x160380cf
jmp 0x10034650
cmp ecx, 0x1753ccc2
je 0x10034939
cmp ecx, 0x193b4a15
jne 0x10034650
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, 0x160380cf
mov eax, 0x133da99c
jmp 0x10034650
cmp ecx, 0xc1b276f6
je 0x10034955
cmp ecx, 0xdef1ff87
jne 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0x133da99c
mov ecx, 0x807b4880
mov edx, 0xdf3b54f4
cmove ecx, edx
jmp 0x10034650
cmp ecx, 0x160380cf
je 0x1003463d
cmp ecx, 0x16f4c5b2
jne 0x10034650
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call ebp
sub esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebp
sub esp, 4
mov ecx, 0x160380cf
mov eax, 0xfe548d95
jmp 0x10034650
cmp ecx, 0xabbdd52c
je 0x10034971
cmp ecx, 0xb3254aa4
jne 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0x8b04b920
mov ecx, 0x807b4880
mov edx, 0x888ecdb5
cmove ecx, edx
jmp 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0xfe548d95
mov ecx, 0xfea78e7a
mov edx, 0x1753ccc2
cmovl ecx, edx
jmp 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0x964af2a1
mov ecx, 0xabbdd52c
mov edx, 0xb3254aa4
cmovl ecx, edx
jmp 0x10034650
mov ecx, 0x160380cf
jmp 0x10034650
cmp byte [esp + 0x2f], 0
mov eax, 0x8b04b920
mov ecx, 0x133da99c
cmovne eax, ecx
mov ecx, 0x160380cf
jmp 0x10034650
mov ecx, 0xe89411d7
jmp 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0xcd7103db
mov ecx, 0x807b4880
mov edx, 0x16f4c5b2
cmove ecx, edx
jmp 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0xfe548d95
mov ecx, 0x807b4880
mov edx, 0x193b4a15
cmove ecx, edx
jmp 0x10034650
mov ecx, dword [esp + 0x28]
cmp ecx, 0x964af2a1
mov ecx, 0x807b4880
mov edx, 0x843eb74
cmove ecx, edx
jmp 0x10034650
cmp ecx, 0xdf3b54f4
jne 0x10034650
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.100531fa
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret