Function at 0x100a27a6
Capabilities:
Create process on windows

Disassembly:
push 0xac
mov eax, 0x10150d5a
call fcn.10147e63
mov eax, dword [ebp + 0x18]
xor ebx, ebx
test eax, eax
je 0x100a27c0
mov dword [eax], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp dword [esi + 8], 0
je 0x100a2aac
push 0xffffffffffffffff
push str.https:__
lea ecx, [ebp - 0x44]
call fcn.1009b840
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.1009b803
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.1013204f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x34]
call fcn.1013204f
test eax, eax
jne 0x100a287c
push esi
lea ecx, [ebp - 0x54]
call fcn.1009b803
push ebx
mov byte [ebp - 4], 3
call fcn.1013204f
pop ecx
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, eax
call fcn.1013204f
mov esi, eax
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 4
push str._sender
push eax
call fcn.1013204f
pop ecx
pop ecx
push esi
push eax
call fcn.1013204f
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.1013204f
push 1
push ebx
push ebx
push dword [ebp - 0x50]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
lea ecx, [ebp - 0x54]
setge bl
call fcn.1013204f
jmp 0x100a2a7e
mov eax, dword [esi + 8]
lea eax, [eax*2 + 2]
push eax
call fcn.1013204f
pop ecx
push dword [esi + 8]
mov edi, eax
mov ecx, esi
push edi
mov dword [ebp - 0x1c], edi
call fcn.1013204f
mov eax, dword [esi + 8]
xor ecx, ecx
push 0x44
pop esi
push esi
mov word [edi + eax*2], cx
lea eax, [ebp - 0xa8]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x7c], 1
push 0xfffffffffffffff6
call dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x70], eax
call dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [ebp - 0x6c], eax
call dword [sym.imp.kernel32.dll_GetStdHandle]
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xa4], ebx
jne 0x100a28f8
push 5
jmp 0x100a28fa
push 7
pop eax
push edi
mov word [ebp - 0x78], ax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov dword [ebp - 0x14], eax
add eax, eax
push eax
call fcn.1013204f
pop ecx
pop ecx
push edi
push dword [ebp - 0x14]
mov esi, eax
push esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 0x10
dec eax
movzx ecx, word [esi + eax*2]
cmp ecx, 0x5c
je 0x100a293d
cmp ecx, 0x2f
jne 0x100a292e
xor ecx, ecx
push edi
mov word [esi + eax*2], cx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
lea esi, [eax + 0xa]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100a295d
mov eax, dword [eax + 8]
add eax, 2
add esi, eax
lea eax, [esi + esi]
push eax
call fcn.1013204f
pop ecx
mov edi, eax
xor eax, eax
push 0x22
pop ecx
push 0x20
mov word [edi], ax
mov word [ebp - 0x16], ax
pop eax
mov word [ebp - 0x24], ax
xor eax, eax
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x1c]
mov word [ebp - 0x18], cx
cmp word [eax], cx
je 0x100a29a0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov ax, word [eax]
cmp ax, word [ebp - 0x18]
je 0x100a29c7
lea eax, [ebp - 0x18]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100a2a23
mov eax, dword [eax + 8]
lea eax, [eax*2 + 2]
push eax
call fcn.1013204f
pop ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
push dword [eax + 8]
push ecx
mov ecx, eax
call fcn.1013204f
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x24]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x14]
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x1c
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xa8]
push eax
push esi
push ebx
push 8
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x100a2a66
mov eax, dword [ebp - 0x5c]
mov dword [ecx], eax
push dword [ebp - 0x64]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x60]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
jne 0x100a2a92
lea ecx, [ebp - 0x34]
call fcn.1013204f
lea ecx, [ebp - 0x44]
call fcn.1013204f
mov al, bl
jmp 0x100a2aae
lea ecx, [ebp - 0x34]
call fcn.1013204f
lea ecx, [ebp - 0x44]
call fcn.1013204f
mov al, 1
jmp 0x100a2aae
xor al, al
call fcn.10147dc1
ret