Function at 0x1000c760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0x208], 0x10017270
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x210], str.Forth
cmp dword [ebp + 0xc], 0
je 0x1000c7ee
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2ac], eax
jmp 0x1000c7f8
mov dword [ebp - 0x2ac], str._NULL_
lea ecx, [ebp - 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xfc], eax
push 0x10
lea edx, [ebp - 0x200]
push edx
call fcn.1000f930
add esp, 8
push 0x44
lea eax, [ebp - 0x258]
push eax
call fcn.1000f930
add esp, 8
mov ecx, dword [ebp - 0x1f0]
push ecx
call dword [sym.imp.GDI32.dll_GetBkMode]
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x20c], 0
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
movzx edx, ax
mov dword [ebp - 0x204], edx
mov eax, 0x3d
sub eax, dword [ebp - 0x1e8]
imul eax, dword [ebp - 0x204]
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x258], 0x44
mov ecx, dword [ebp - 0x2a8]
movzx edx, byte [ecx + 8]
test edx, edx
je 0x1000ca5d
mov eax, dword [ebp - 0x2a8]
movzx ecx, byte [eax + 0xb]
test ecx, ecx
jne 0x1000ca5d
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
je 0x1000ca5b
mov edx, dword [ebp - 0x208]
push edx
lea eax, [ebp - 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov dword [ebp - 0x274], eax
mov edx, dword [ebp - 0x210]
movsx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x204]
push ecx
lea edx, [ebp - 0x268]
push edx
call dword [sym.imp.USER32.dll_InflateRect]
mov dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x210]
push eax
lea ecx, [ebp - 0xf8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0x210]
push edx
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x1001a014
mov ecx, dword [ebp - 0x2a8]
add ecx, 0x128
call fcn.10001980
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
je 0x1000ca41
lea ecx, [ebp - 0x270]
push ecx
mov edx, dword [ebp - 0x27c]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x270]
push eax
push 1
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x284], eax
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x204]
add ecx, dword [ebp - 0x268]
mov dword [ebp - 0x204], ecx
lea edx, [ebp - 0x280]
push edx
push 0x2000000
mov eax, dword [ebp - 0x284]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000ca37
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x258]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x1000ca2f
mov dword [ebp - 0x20c], 0xf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000ca41
mov dword [ebp - 0x20c], 0x10
mov eax, dword [ebp - 0x278]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x1000ca96
lea edx, [ebp - 0x200]
push edx
lea eax, [ebp - 0x258]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1000ca96
mov dword [ebp - 0x20c], 0x11
cmp dword [ebp + 0xc], 0
je 0x1000caa7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2b0], eax
jmp 0x1000cab1
mov dword [ebp - 0x2b0], str._NULL_
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0xfc]
lea eax, [edx + eax + 1]
mov dword [ebp - 0xfc], eax
mov ecx, dword [ebp - 0x1f0]
push ecx
call dword [sym.imp.GDI32.dll_GetBkMode]
mov eax, dword [ebp - 0x20c]
mov esp, ebp
pop ebp
ret 8