Function at 0x100c0ed4
Capabilities:
Create process on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x1000f6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x31c], edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x340], ebx
lea edi, [ebp - 0x33c]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x3a0]
push ebx
push eax
mov dword [ebp - 0x3a4], 0x44
call sub.MSVCR100.dll_memset
xor eax, eax
mov dword [ebp - 0x354], ebx
lea edi, [ebp - 0x350]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x103
stosd dword es:[edi], eax
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
xor esi, esi
inc esi
push 0x100c1654
mov dword [ebp - 0x334], esi
call fcn.10002c88
mov edi, dword [ebp - 0x31c]
add esp, 0x1c
test edi, edi
je 0x100c15b4
call fcn.100036ad
test eax, eax
je 0x100c0f93
call fcn.1002c8f8
test eax, eax
je 0x100c15b4
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
mov dword [ebp - 0x338], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [ebp - 0x340], 0xc
call esi
mov dword [ebp - 0x328], eax
test eax, eax
je 0x100c15b4
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call esi
mov dword [ebp - 0x320], eax
test eax, eax
je 0x100c158a
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call esi
mov dword [ebp - 0x344], eax
test eax, eax
je 0x100c158a
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
mov dword [ebp - 0x314], esi
test esi, esi
je 0x100c158c
xor eax, eax
push eax
push 0x9c9c
push eax
push 4
lea eax, [ebp - 0x340]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x330], eax
test eax, eax
je 0x100c158c
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x324], esi
test esi, esi
je 0x100c1576
push 0x9c9c
xor eax, eax
push eax
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi], 0x9c9c
mov dword [esi + 4], 0x20000
mov eax, dword [edi]
push edi
call dword [eax]
mov dword [esi + 0x28], eax
test eax, eax
je 0x100c156f
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov dword [esi + 8], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [esi + 0xc], eax
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [edi]
lea eax, [esi + 0x8470]
push eax
push edi
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x318]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x320]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x314]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x344]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x4c], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x14]
xor ecx, ecx
mov dword [esi + 0x44], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 0xc
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], 0x21
mov dword [esi + 0x3c], 2
mov eax, dword [edi]
push edi
call dword [eax + 0x20]
test eax, eax
lea eax, [esi + 0x2c]
jne 0x100c112f
or dword [eax], 0x80
mov ecx, dword [ebp - 0x318]
xor edx, edx
cmp dword [ecx + 0x20], edx
je 0x100c1140
or dword [esi + 0x38], 4
mov edx, dword [ebp - 0x32c]
test edx, edx
je 0x100c1172
xor edi, edi
cmp word [edx], di
mov edi, dword [ebp - 0x31c]
je 0x100c1172
or dword [eax], 1
push edx
push 0x400
lea eax, [esi + 0x9ac]
push eax
call fcn.100c259e
mov ecx, dword [ebp - 0x318]
xor eax, eax
cmp dword [ecx + 0xc], eax
je 0x100c1191
or dword [esi + 0x2c], 1
push dword [ecx + 0xc]
lea eax, [esi + 0x9ac]
push 0x400
push eax
call fcn.100c259e
mov ecx, dword [edi]
push 0x400
lea eax, [esi + 0x9ac]
push eax
push edi
call dword [ecx + 0x18]
test eax, eax
je 0x100c11ab
or dword [esi + 0x2c], 1
mov ecx, dword [ebp - 0x318]
cmp dword [ecx + 0x10], ebx
je 0x100c11cd
push 0x400
lea eax, [esi + 0x19ac]
push eax
push dword [ecx + 0x10]
call fcn.100bbefd
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x40], eax
call fcn.100c1b5c
push eax
push 0x100c1670
lea eax, [esi + 0x59c]
push 0xffffffffffffffff
push eax
call fcn.100c1708
push 0x104
lea eax, [esi + 0x50]
push eax
push 0x100c167c
call fcn.100bbefd
add esp, 0x1c
lea edi, [esi + 0x7a4]
push 0x1f
pop ecx
mov esi, 0x100c15d8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x318]
mov esi, dword [ebp - 0x324]
cmp dword [edi + 4], ebx
je 0x100c1237
push 0x38
lea eax, [esi + 0x21ac]
push eax
push dword [edi + 4]
call fcn.100bbefd
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x100c1253
push 0x104
lea eax, [esi + 0x3d1c]
push eax
push dword [edi + 8]
call fcn.100bbefd
add esp, 0xc
mov edi, dword [ebp - 0x31c]
mov eax, dword [edi]
push 0x104
lea ecx, [esi + 0x258]
push ecx
push edi
call dword [eax + 0x1c]
test eax, eax
jne 0x100c1299
call fcn.100c98f4
xor edx, edx
push 0x104
lea ecx, [esi + 0x258]
push ecx
cmp word [eax], dx
je 0x100c1292
push eax
call fcn.100bbefd
add esp, 0xc
jmp 0x100c1299
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.100bf718
pop ecx
pop ecx
test eax, eax
je 0x100c156f
push dword [ebp - 0x330]
lea eax, [ebp - 0x108]
push eax
push 0x100c16a4
lea eax, [ebp - 0x310]
push 0xffffffffffffffff
push eax
call fcn.100c1728
lea eax, [ebp - 0x310]
push eax
push 0x100c16b4
call fcn.10002c88
add esp, 0x1c
lea eax, [ebp - 0x354]
push eax
xor ecx, ecx
lea eax, [ebp - 0x3a4]
push eax
push ecx
push ecx
push 0x4000020
push 1
push ecx
push ecx
lea eax, [ebp - 0x310]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100c156f
lea eax, [ebp - 0x310]
push eax
push 0x100c16d0
call fcn.10002c88
mov eax, dword [edi]
pop ecx
pop ecx
push dword [ebp - 0x34c]
push edi
call dword [eax + 0x2c]
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x354]
xor ecx, ecx
inc ecx
xor eax, eax
test edx, edx
setne al
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x31c], ecx
add eax, 2
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x328]
mov dword [ebp - 0x360], ecx
mov ecx, dword [ebp - 0x320]
mov dword [ebp - 0x35c], ecx
xor ecx, ecx
push ecx
push 0x4e20
push ecx
lea ecx, [ebp - 0x360]
push ecx
push eax
mov dword [ebp - 0x358], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x100c13ad
mov eax, dword [edi]
push edi
call dword [eax + 0x30]
jmp 0x100c1439
cmp eax, 1
je 0x100c146c
cmp eax, 2
je 0x100c1460
cmp eax, 0x102
je 0x100c13d0
push 0x10151e
call fcn.100bbd1d
xor eax, eax
push eax
push 0x4e20
push dword [ebp - 0x314]
mov dword [ebp - 0x31c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
je 0x100c146c
cmp eax, 0x80
je 0x100c1452
xor eax, eax
push eax
push 1
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x100c1423
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov dword [ebp - 0x334], eax
jmp 0x100c142d
mov dword [ebp - 0x31c], 1
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x334], ebx
je 0x100c146c
mov eax, dword [ebp - 0x32c]
mov edx, dword [ebp - 0x324]
jmp 0x100c1369
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100c146c
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi]
push edi
call dword [eax + 0x34]
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x100c156f
mov ecx, dword [ebp - 0x31c]
test ecx, ecx
mov ecx, dword [ebp - 0x318]
je 0x100c14f4
test dword [ecx + 0x18], eax
je 0x100c14f4
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [esi + 0x9a84]
test ebx, ebx
jne 0x100c14d8
dec eax
je 0x100c14d0
dec eax
je 0x100c14cc
dec eax
dec eax
je 0x100c14c8
push 0x101520
call fcn.100bbd1d
xor eax, eax
mov ebx, eax
jmp 0x100c156f
push 7
jmp 0x100c14d2
push 6
jmp 0x100c14d2
push 9
pop ebx
jmp 0x100c156f
mov dword [ebx], eax
mov eax, dword [ebp - 0x330]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x324]
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
jmp 0x100c15b4
test dword [ecx + 0x1c], eax
je 0x100c1522
dec eax
je 0x100c151e
dec eax
je 0x100c151a
dec eax
dec eax
je 0x100c1516
sub eax, 0xc
je 0x100c1545
push 0x101522
call fcn.100bbd1d
xor eax, eax
jmp 0x100c156f
push 3
jmp 0x100c14d2
push 2
jmp 0x100c14d2
push 5
jmp 0x100c14d2
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
test eax, eax
je 0x100c156f
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x100c1565
cmp eax, 2
jbe 0x100c1554
cmp eax, 4
je 0x100c154a
cmp eax, 0x10
jne 0x100c1565
xor ebx, ebx
inc ebx
jmp 0x100c156f
push 3
pop ebx
push 0x101523
jmp 0x100c156a
mov eax, dword [ebp - 0x318]
mov eax, dword [eax]
mov eax, dword [eax]
push dword [eax]
call fcn.100bf7c4
push 0x101541
call fcn.100bbd1d
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x314]
jmp 0x100c158c
mov esi, ebx
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x100c15a9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100c15b4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100c16f0
call fcn.10002c88
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10002069
leave
ret 0x10