Function at 0x1000e949
Capabilities:
Create process on windows

Disassembly:
jae 0x1000e81a
jmp 0x1000e815
call fcn.1000e81c
jae 0x1000e815
add esp, 4
jmp 0x1000e821
dec dword [esp]
jno 0x1000e826
jns 0x1000e811
jp 0x1000e82a
add esp, 4
popf
jmp 0x1000e831
clc
jae 0x1000e836
test dword [eax + 0x50], ebx
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e84f
jne 0x1000e84f
pop eax
jl 0x1000e854
jmp 0x1000e856
je 0x1000e851
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e870
jne 0x1000e86f
call 0x9304d8f7
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e87e
jne 0x1000e87e
call 0x106b24ec
push 0x3c
push 0
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.100a76a0
add esp, 0xc
mov dword [ebp - 0x1a8], 0x3c
mov dword [ebp - 0x1a4], 0x40
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
lea edx, [ebp - 0xc]
mov dword [ebp - 0x198], edx
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x194], eax
lea ecx, [ebp - 0x1d4]
push ecx
mov ecx, dword [0x10103540]
call fcn.10052d40
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b8]
call fcn.10007e30
mov dword [ebp - 0x190], eax
lea ecx, [ebp - 0x1d4]
call fcn.10002d70
nop
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x188], 0
jl 0x1000e91c
jmp 0x1000e91e
je 0x1000e919
xor eax, eax
test eax, eax
je 0x1000e927
jne 0x1000e926
call 0x9304d9ae
rol byte [ebx + eax*4], 0xf0
add eax, 0x260273f8
bnd je 0x1000e93a
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1000e935
bnd je 0x1000e93a
je 0x1000e93a
jne 0x1000e93a
pushf
pushf
push 0xa
jae 0x1000e947
jmp 0x1000e942
call 0x1000e949
jae 0x1000e942
add esp, 4
jmp 0x1000e94e
dec dword [esp]
jno 0x1000e953
jns 0x1000e93e
jp 0x1000e957
add esp, 4
popf
jmp 0x1000e95e
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e977
jne 0x1000e977
call 0x1fc11ccb
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1000e9be
mov ecx, dword [0x101034a8]
call fcn.10009e20
push eax
push 0
push 0x100ca8d4
push 0
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x10103414]
call fcn.10011500
nop
jl 0x1000e9c3
jmp 0x1000e9c5
je 0x1000e9c0
xor eax, eax
test eax, eax
je 0x1000e9ce
jne 0x1000e9cd
call 0x9304da55
rol byte [ebx + eax*4], 0xf0
add eax, 0x770273f8
test byte [ebx + eax + 0x75], dh
add dword [esi + 0x730a6a9c], eax
pop es
xor eax, 3
add eax, 4
xor eax, 5
clc
jae 0x1000e9dc
ja 0x1000e960
je 0x1000e9e1
jne 0x1000e9e1
test byte [esi - 0x64], ah
pushf
push 0xa
jae 0x1000e9ee
jmp 0x1000e9e9
call 0x1000e9f0
jae 0x1000e9e9
add esp, 4
jmp 0x1000e9f5
dec dword [esp]
jno 0x1000e9fa
jns 0x1000e9e5
jp 0x1000e9fe
add esp, 4
popf
jmp 0x1000ea05
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000ea1e
jne 0x1000ea1e
call 0x1fc11d72
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
mov esp, ebp
pop ebp
ret 4