Function at 0x1009c19d
Capabilities:
Create process on windows
Read file via mapping
Terminate process

Disassembly:
push 0x5c4
mov eax, 0x100b4138
call fcn.10002f91
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp + 0xc]
push 0x40
mov dword [ebp - 0x564], eax
lea eax, [ebp - 0x5cc]
push edi
push eax
mov dword [ebp - 0x560], esi
mov dword [ebp - 0x570], edi
mov dword [ebp - 0x56c], edi
mov dword [ebp - 0x568], edi
mov dword [ebp - 0x5d0], 0x44
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov dword [ebp - 0x544], edi
mov ebx, edi
mov dword [ebp - 0x554], edi
movups xmmword [ebp - 0x58c], xmm0
mov dword [ebp - 0x574], ebx
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], edi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x578], 1
mov dword [ebp - 0x54c], edi
push str.LaunchDadWatson:_Begin
push 3
call fcn.1009be93
test esi, esi
je 0x1009c91d
cmp byte [0x10108a9d], 0
je 0x1009c260
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10105648
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
push esi
call dword [eax + 0x38]
test eax, eax
je 0x1009c27a
call fcn.1009c0f2
call fcn.10002bed
test eax, eax
je 0x1009c290
call fcn.1009e4e7
test eax, eax
je 0x1009c91d
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventExW]
xor eax, eax
push 0x1f0003
push eax
push eax
lea eax, [ebp - 0x570]
mov dword [ebp - 0x570], 0xc
push eax
mov dword [ebp - 0x568], 1
call esi
mov dword [ebp - 0x55c], eax
test eax, eax
je 0x1009c91d
push 0x1f0003
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x570]
push eax
call esi
mov dword [ebp - 0x550], eax
test eax, eax
je 0x1009c8ef
push 0x1f0003
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x570]
push eax
call esi
mov dword [ebp - 0x57c], eax
test eax, eax
je 0x1009c8ef
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x544], esi
test esi, esi
je 0x1009c8f5
xor eax, eax
push eax
push 0x9c9c
push eax
push 4
lea eax, [ebp - 0x570]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x558], eax
test eax, eax
je 0x1009c8f5
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x548], esi
test esi, esi
je 0x1009c8e3
push 0x9c9c
xor eax, eax
push eax
push esi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x560]
add esp, 0xc
mov dword [esi], 0x9c9c
mov dword [esi + 4], 0x20000
mov eax, dword [ecx]
push ecx
call dword [eax]
mov dword [esi + 0x28], eax
test eax, eax
je 0x1009c8dc
mov edi, dword [ebp - 0x560]
push edi
mov eax, dword [edi]
call dword [eax + 4]
mov dword [esi + 8], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [esi + 0xc], eax
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x8470]
mov ecx, dword [edi]
push eax
push edi
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x55c]
mov ecx, dword [ebp - 0x540]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x550]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x544]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x57c]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x4c], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0xc
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0x21
mov dword [esi + 0x3c], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x20]
test eax, eax
jne 0x1009c442
or dword [esi + 0x2c], 0x80
mov eax, dword [ebp - 0x540]
xor ecx, ecx
cmp dword [eax + 0x20], ecx
je 0x1009c453
or dword [esi + 0x38], 4
cmp dword [eax + 0xc], ecx
je 0x1009c470
or dword [esi + 0x2c], 1
push dword [eax + 0xc]
lea eax, [esi + 0x9ac]
push 0x400
push eax
call fcn.1009ce17
mov ecx, dword [edi]
lea eax, [esi + 0x9ac]
push 0x400
push eax
push edi
call dword [ecx + 0x18]
test eax, eax
je 0x1009c48a
or dword [esi + 0x2c], 1
mov ecx, dword [ebp - 0x540]
cmp dword [ecx + 0x10], 0
je 0x1009c4aa
push 0x400
lea eax, [esi + 0x19ac]
push eax
push dword [ecx + 0x10]
call fcn.100061d8
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x40], eax
call fcn.1009e709
push eax
push str.skulcid_d
lea eax, [esi + 0x59c]
push 0xffffffffffffffff
push eax
call fcn.1009c015
add esp, 0x10
lea eax, [esi + 0x50]
push 0x104
push eax
push str.Microsoft_Office_16
call fcn.100061d8
lea edi, [esi + 0x7a4]
mov esi, str.mso.dll
push 0x1f
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x540]
mov esi, dword [ebp - 0x548]
cmp dword [edi + 4], 0
je 0x1009c512
push 0x38
lea eax, [esi + 0x21ac]
push eax
push dword [edi + 4]
call fcn.100061d8
cmp dword [edi + 8], 0
je 0x1009c52c
push 0x104
lea eax, [esi + 0x3d1c]
push eax
push dword [edi + 8]
call fcn.100061d8
mov edi, dword [ebp - 0x560]
lea ecx, [esi + 0x258]
push 0x104
push ecx
push edi
mov eax, dword [edi]
call dword [eax + 0x1c]
test eax, eax
jne 0x1009c56f
call fcn.10091474
xor edx, edx
lea ecx, [esi + 0x258]
push 0x104
push ecx
cmp word [eax], dx
je 0x1009c568
push eax
call fcn.100061d8
jmp 0x1009c56f
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1009e4e7
test eax, eax
je 0x1009c5d2
push 0x1f0003
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x570]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventExW]
push eax
lea ecx, [ebp - 0x574]
call fcn.10091422
call fcn.1009e4e7
mov ebx, dword [ebp - 0x574]
test eax, eax
je 0x1009c5bd
mov edx, dword [eax]
mov ecx, eax
push ebx
push dword [ebp - 0x564]
push dword [ebp - 0x558]
call dword [edx + 0x48]
mov edx, dword [ebp - 0x554]
mov dword [ebp - 0x548], 1
jmp 0x1009c697
push 0x104
lea eax, [ebp - 0x114]
push eax
call fcn.1009ce8a
test eax, eax
je 0x1009c8d6
push dword [ebp - 0x558]
lea eax, [ebp - 0x114]
push eax
push str.__S___x__s__Iu
push 0xffffffffffffffff
lea eax, [ebp - 0x524]
push 0x208
push eax
call fcn.10098c56
add esp, 0x18
lea eax, [ebp - 0x524]
push eax
push str.LaunchDadWatson:_run__s
push 3
call fcn.1009bedd
lea eax, [ebp - 0x58c]
xor ecx, ecx
push eax
lea eax, [ebp - 0x5d0]
push eax
push ecx
push ecx
push 0x4000020
push 1
push ecx
push ecx
lea eax, [ebp - 0x524]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1009c8d6
lea eax, [ebp - 0x524]
push eax
push str.LaunchDadWatson:_started__s
push 3
call fcn.1009bf2b
push dword [ebp - 0x584]
mov eax, dword [edi]
push edi
call dword [eax + 0x2c]
push dword [ebp - 0x588]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x58c]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x554], edx
mov dword [ebp - 0x548], ecx
xor eax, eax
test edx, edx
setne al
add eax, 2
mov dword [ebp - 0x564], eax
mov ecx, dword [ebp - 0x55c]
mov dword [ebp - 0x530], ecx
mov ecx, dword [ebp - 0x550]
push 0x4e20
mov dword [ebp - 0x52c], ecx
lea ecx, [ebp - 0x530]
push 0
push ecx
push eax
mov dword [ebp - 0x528], edx
call fcn.1009d6d2
test eax, eax
jne 0x1009c6e8
mov eax, dword [edi]
push edi
call dword [eax + 0x30]
jmp 0x1009c76e
cmp eax, 1
je 0x1009c7a2
cmp eax, 2
je 0x1009c796
cmp eax, 0x102
je 0x1009c70b
push 0x6998ce
call fcn.1008f237
push 0x4e20
push dword [ebp - 0x544]
xor eax, eax
mov dword [ebp - 0x548], eax
call fcn.1009d6fc
cmp eax, 0x102
je 0x1009c7a2
cmp eax, 0x80
je 0x1009c788
push 1
push dword [ebp - 0x55c]
call fcn.1009d6fc
test eax, eax
je 0x1009c758
push dword [ebp - 0x550]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov dword [ebp - 0x578], eax
jmp 0x1009c762
mov dword [ebp - 0x548], 1
push dword [ebp - 0x544]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x578], 0
je 0x1009c7a2
mov eax, dword [ebp - 0x564]
mov edx, dword [ebp - 0x554]
jmp 0x1009c6a7
push dword [ebp - 0x544]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x1009c7a2
push dword [ebp - 0x550]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi]
push edi
call dword [eax + 0x34]
call fcn.1009e4e7
test eax, eax
je 0x1009c7e4
test ebx, ebx
je 0x1009c7c9
push 0xffffffffffffffff
push ebx
call fcn.1009d6fc
test eax, eax
jne 0x1009c7c9
xor edi, edi
inc edi
jmp 0x1009c8dc
push 0x6998cf
call fcn.1008f237
mov ecx, dword [ebp - 0x540]
mov eax, dword [ecx]
mov eax, dword [eax]
push dword [eax]
call fcn.1009c9a3
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x1009c8d6
mov ecx, dword [ebp - 0x548]
test ecx, ecx
mov ecx, dword [ebp - 0x540]
je 0x1009c86c
test dword [ecx + 0x18], eax
je 0x1009c86c
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov eax, dword [esi + 0x9a84]
test edi, edi
jne 0x1009c850
sub eax, 1
je 0x1009c848
sub eax, 1
je 0x1009c844
dec eax
sub eax, 1
je 0x1009c840
push 0x6998d0
call fcn.1008f237
xor eax, eax
mov edi, eax
jmp 0x1009c8dc
push 7
jmp 0x1009c84a
push 6
jmp 0x1009c84a
push 9
pop edi
jmp 0x1009c8dc
mov dword [edi], eax
mov eax, dword [ebp - 0x558]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x554]
mov dword [edi + 4], esi
mov dword [edi + 0xc], eax
jmp 0x1009c91d
test dword [ecx + 0x1c], eax
je 0x1009c89d
sub eax, 1
je 0x1009c899
sub eax, 1
je 0x1009c895
dec eax
sub eax, 1
je 0x1009c891
sub eax, 0xc
je 0x1009c7c1
push 0x6998d2
jmp 0x1009c832
push 3
jmp 0x1009c84a
push 2
jmp 0x1009c84a
push 5
jmp 0x1009c84a
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
test eax, eax
je 0x1009c8d6
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x1009c8cc
cmp eax, 2
jbe 0x1009c996
cmp eax, 4
je 0x1009c984
cmp eax, 0x10
je 0x1009c7c1
push 0x6998d5
call fcn.1008f237
mov edi, dword [ebp - 0x54c]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x558]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x544]
push dword [ebp - 0x55c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x550]
test eax, eax
je 0x1009c912
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1009c91d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._tLaunchDadWatson:_End
lea ecx, [ebp - 0x53c]
call fcn.1000312a
lea eax, [ebp - 0x53c]
push eax
push 3
call fcn.1000585e
xor eax, eax
lea ecx, [ebp - 0x53c]
push eax
push 1
call fcn.100033e2
mov ecx, dword [ebp - 0x560]
test ecx, ecx
je 0x1009c964
mov eax, dword [ecx]
push ecx
call dword [eax + 0x38]
test eax, eax
je 0x1009c964
call fcn.1009c047
push 0x10105648
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1009c97a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.100034a6
ret 0x10
push 3
pop edi
push 0x6998d3
call fcn.1008f237
jmp 0x1009c8dc
mov eax, dword [ebp - 0x540]
mov eax, dword [eax]
jmp 0x1009c7db