Function at 0x100beaef
Capabilities:
Create process on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x1000f7ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x31c], edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x340], ebx
lea edi, [ebp - 0x33c]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x3a0]
push ebx
push eax
mov dword [ebp - 0x3a4], 0x44
call sub.MSVCR100.dll_memset
xor eax, eax
mov dword [ebp - 0x354], ebx
lea edi, [ebp - 0x350]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x103
stosd dword es:[edi], eax
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
xor esi, esi
inc esi
push 0x100bf26c
mov dword [ebp - 0x334], esi
call fcn.10002d8f
mov edi, dword [ebp - 0x31c]
add esp, 0x1c
test edi, edi
je 0x100bf1cf
call fcn.100037b1
test eax, eax
je 0x100bebae
call fcn.1002c570
test eax, eax
je 0x100bf1cf
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
mov dword [ebp - 0x338], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [ebp - 0x340], 0xc
call esi
mov dword [ebp - 0x328], eax
test eax, eax
je 0x100bf1cf
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call esi
mov dword [ebp - 0x320], eax
test eax, eax
je 0x100bf1a5
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call esi
mov dword [ebp - 0x344], eax
test eax, eax
je 0x100bf1a5
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
mov dword [ebp - 0x314], esi
test esi, esi
je 0x100bf1a7
xor eax, eax
push eax
push 0x9c9c
push eax
push 4
lea eax, [ebp - 0x340]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x330], eax
test eax, eax
je 0x100bf1a7
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x324], esi
test esi, esi
je 0x100bf191
push 0x9c9c
xor eax, eax
push eax
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi], 0x9c9c
mov dword [esi + 4], 0x20000
mov eax, dword [edi]
push edi
call dword [eax]
mov dword [esi + 0x28], eax
test eax, eax
je 0x100bf18a
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov dword [esi + 8], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [esi + 0xc], eax
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [edi]
lea eax, [esi + 0x8470]
push eax
push edi
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x318]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x320]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x314]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x344]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x4c], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x14]
xor ecx, ecx
mov dword [esi + 0x44], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 0xc
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], 0x21
mov dword [esi + 0x3c], 2
mov eax, dword [edi]
push edi
call dword [eax + 0x20]
test eax, eax
lea eax, [esi + 0x2c]
jne 0x100bed4a
or dword [eax], 0x80
mov ecx, dword [ebp - 0x318]
xor edx, edx
cmp dword [ecx + 0x20], edx
je 0x100bed5b
or dword [esi + 0x38], 4
mov edx, dword [ebp - 0x32c]
test edx, edx
je 0x100bed8d
xor edi, edi
cmp word [edx], di
mov edi, dword [ebp - 0x31c]
je 0x100bed8d
or dword [eax], 1
push edx
push 0x400
lea eax, [esi + 0x9ac]
push eax
call fcn.100c01b6
mov ecx, dword [ebp - 0x318]
xor eax, eax
cmp dword [ecx + 0xc], eax
je 0x100bedac
or dword [esi + 0x2c], 1
push dword [ecx + 0xc]
lea eax, [esi + 0x9ac]
push 0x400
push eax
call fcn.100c01b6
mov ecx, dword [edi]
push 0x400
lea eax, [esi + 0x9ac]
push eax
push edi
call dword [ecx + 0x18]
test eax, eax
je 0x100bedc6
or dword [esi + 0x2c], 1
mov ecx, dword [ebp - 0x318]
cmp dword [ecx + 0x10], ebx
je 0x100bede8
push 0x400
lea eax, [esi + 0x19ac]
push eax
push dword [ecx + 0x10]
call fcn.100ba2ad
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x40], eax
call fcn.100bf774
push eax
push 0x100bf288
lea eax, [esi + 0x59c]
push 0xffffffffffffffff
push eax
call fcn.100bf320
push 0x104
lea eax, [esi + 0x50]
push eax
push 0x100bf294
call fcn.100ba2ad
add esp, 0x1c
lea edi, [esi + 0x7a4]
push 0x1f
pop ecx
mov esi, 0x100bf1f0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x318]
mov esi, dword [ebp - 0x324]
cmp dword [edi + 4], ebx
je 0x100bee52
push 0x38
lea eax, [esi + 0x21ac]
push eax
push dword [edi + 4]
call fcn.100ba2ad
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x100bee6e
push 0x104
lea eax, [esi + 0x3d1c]
push eax
push dword [edi + 8]
call fcn.100ba2ad
add esp, 0xc
mov edi, dword [ebp - 0x31c]
mov eax, dword [edi]
push 0x104
lea ecx, [esi + 0x258]
push ecx
push edi
call dword [eax + 0x1c]
test eax, eax
jne 0x100beeb4
call fcn.100c7234
xor edx, edx
push 0x104
lea ecx, [esi + 0x258]
push ecx
cmp word [eax], dx
je 0x100beead
push eax
call fcn.100ba2ad
add esp, 0xc
jmp 0x100beeb4
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.100bd318
pop ecx
pop ecx
test eax, eax
je 0x100bf18a
push dword [ebp - 0x330]
lea eax, [ebp - 0x108]
push eax
push 0x100bf2bc
lea eax, [ebp - 0x310]
push 0xffffffffffffffff
push eax
call fcn.100bf340
lea eax, [ebp - 0x310]
push eax
push 0x100bf2cc
call fcn.10002d8f
add esp, 0x1c
lea eax, [ebp - 0x354]
push eax
xor ecx, ecx
lea eax, [ebp - 0x3a4]
push eax
push ecx
push ecx
push 0x4000020
push 1
push ecx
push ecx
lea eax, [ebp - 0x310]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100bf18a
lea eax, [ebp - 0x310]
push eax
push 0x100bf2e8
call fcn.10002d8f
mov eax, dword [edi]
pop ecx
pop ecx
push dword [ebp - 0x34c]
push edi
call dword [eax + 0x2c]
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x354]
xor ecx, ecx
inc ecx
xor eax, eax
test edx, edx
setne al
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x31c], ecx
add eax, 2
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x328]
mov dword [ebp - 0x360], ecx
mov ecx, dword [ebp - 0x320]
mov dword [ebp - 0x35c], ecx
xor ecx, ecx
push ecx
push 0x4e20
push ecx
lea ecx, [ebp - 0x360]
push ecx
push eax
mov dword [ebp - 0x358], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x100befc8
mov eax, dword [edi]
push edi
call dword [eax + 0x30]
jmp 0x100bf054
cmp eax, 1
je 0x100bf087
cmp eax, 2
je 0x100bf07b
cmp eax, 0x102
je 0x100befeb
push 0x10151e
call fcn.100ba0cd
xor eax, eax
push eax
push 0x4e20
push dword [ebp - 0x314]
mov dword [ebp - 0x31c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
je 0x100bf087
cmp eax, 0x80
je 0x100bf06d
xor eax, eax
push eax
push 1
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x100bf03e
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov dword [ebp - 0x334], eax
jmp 0x100bf048
mov dword [ebp - 0x31c], 1
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x334], ebx
je 0x100bf087
mov eax, dword [ebp - 0x32c]
mov edx, dword [ebp - 0x324]
jmp 0x100bef84
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100bf087
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi]
push edi
call dword [eax + 0x34]
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x100bf18a
mov ecx, dword [ebp - 0x31c]
test ecx, ecx
mov ecx, dword [ebp - 0x318]
je 0x100bf10f
test dword [ecx + 0x18], eax
je 0x100bf10f
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [esi + 0x9a84]
test ebx, ebx
jne 0x100bf0f3
dec eax
je 0x100bf0eb
dec eax
je 0x100bf0e7
dec eax
dec eax
je 0x100bf0e3
push 0x101520
call fcn.100ba0cd
xor eax, eax
mov ebx, eax
jmp 0x100bf18a
push 7
jmp 0x100bf0ed
push 6
jmp 0x100bf0ed
push 9
pop ebx
jmp 0x100bf18a
mov dword [ebx], eax
mov eax, dword [ebp - 0x330]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x324]
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
jmp 0x100bf1cf
test dword [ecx + 0x1c], eax
je 0x100bf13d
dec eax
je 0x100bf139
dec eax
je 0x100bf135
dec eax
dec eax
je 0x100bf131
sub eax, 0xc
je 0x100bf160
push 0x101522
call fcn.100ba0cd
xor eax, eax
jmp 0x100bf18a
push 3
jmp 0x100bf0ed
push 2
jmp 0x100bf0ed
push 5
jmp 0x100bf0ed
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
test eax, eax
je 0x100bf18a
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x100bf180
cmp eax, 2
jbe 0x100bf16f
cmp eax, 4
je 0x100bf165
cmp eax, 0x10
jne 0x100bf180
xor ebx, ebx
inc ebx
jmp 0x100bf18a
push 3
pop ebx
push 0x101523
jmp 0x100bf185
mov eax, dword [ebp - 0x318]
mov eax, dword [eax]
mov eax, dword [eax]
push dword [eax]
call fcn.100bd3c4
push 0x101541
call fcn.100ba0cd
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x314]
jmp 0x100bf1a7
mov esi, ebx
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x100bf1c4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100bf1cf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100bf308
call fcn.10002d8f
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10002059
leave
ret 0x10