Function at 0x1008b310
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e621d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
mov eax, dword [0x103dda04]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebx + 8]
mov eax, dword [edx + 8]
movzx eax, word [eax + 4]
add eax, 0xfffffa8f
cmp eax, 0x9f
ja case.0x1008b36f.1394
movzx eax, byte [eax + 0x1008b9a4]
jmp dword [eax*4 + 0x1008b974]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push edx
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.1008b1b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
jle 0x1008b3d9
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x1008b3a7
add ecx, 2
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jle 0x1008b3d9
sub edx, ecx
cmp edx, 8
jb 0x1008b3d9
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + ecx + 4]
mov esi, dword [eax + ecx]
add ecx, 8
mov dword [ebp - 0x1c], ecx
test edx, edx
jl 0x1008b3e7
jg 0x1008b3d0
cmp esi, 0x7fffffff
jbe 0x1008b3e7
mov esi, SysReAllocString
xor edx, edx
jmp 0x1008b3e7
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov ecx, esi
call fcn.100b6a90
mov eax, 0x78f461
movd xmm2, eax
mov eax, 0xc93a49
movd xmm1, eax
pxor xmm2, xmm1
movd eax, xmm2
movsd qword [eax], xmm0
lea ecx, [ebp - 0x20]
call fcn.1000cf80
jmp case.0x1008b36f.1394
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push edx
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.1008b1b0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0
cmp eax, ecx
jg 0x1008b446
xor eax, eax
jmp 0x1008b45e
sub eax, ecx
cmp eax, 2
jae 0x1008b451
xor eax, eax
jmp 0x1008b45e
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + ecx]
add ecx, 2
mov dword [ebp - 0x1c], ecx
mov ecx, 0x78f261
cwde
mov esi, 0x78f461
movd xmm0, ecx
movd xmm1, esi
pxor xmm0, xmm1
movd ecx, xmm0
cmp eax, ecx
jne 0x1008b53e
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x20]
call fcn.1008b210
cmp dword [ebp - 0x58], 0
je 0x1008b50a
cmp dword [ebp - 0x54], 0x10
lea ecx, [ebp - 0x68]
mov eax, 0x78f460
movd xmm1, esi
cmovae ecx, dword [ebp - 0x68]
mov dword [ebp - 0x30], 0xd276d26a
mov dword [ebp - 0x2c], 0x6a48c415
movd xmm0, eax
pxor xmm0, xmm1
mov dword [ebp - 0x28], 0xb7adc482
movd eax, xmm0
mov dword [ebp - 0x24], 0xea624fe8
mov dword [ebp - 0x50], 0xbc13a205
push eax
push 0
push 0
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], 0x6a48c415
mov dword [ebp - 0x48], 0xb7adc482
mov dword [ebp - 0x44], 0xea624fe8
movaps xmm1, xmmword [ebp - 0x50]
pxor xmm1, xmmword [ebp - 0x30]
push eax
push 0
movaps xmmword [ebp - 0x30], xmm1
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x54]
cmp ecx, 0x10
jb 0x1008b53e
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1008b534
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008b968
push ecx
push edx
call fcn.100b631d
add esp, 8
lea ecx, [ebp - 0x20]
call fcn.1000cf80
jmp case.0x1008b36f.1394
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push edx
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.1008b1b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 1
cmp edx, ecx
jle 0x1008b40c
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x1008b587
add ecx, 2
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jle 0x1008b40c
mov eax, edx
sub eax, ecx
cmp eax, 4
jb 0x1008b40c
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + ecx]
add ecx, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ecx
test eax, eax
jle 0x1008b40c
cmp edx, ecx
jg 0x1008b5c0
mov dword [ebp - 0x6c], 0
jmp 0x1008b5de
mov eax, edx
sub eax, ecx
cmp eax, 4
jae 0x1008b5d2
mov dword [ebp - 0x6c], 0
jmp 0x1008b5de
mov eax, dword [esi + ecx]
add ecx, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jg 0x1008b5e6
xor edi, edi
jmp 0x1008b5fc
mov eax, edx
sub eax, ecx
cmp eax, 4
jae 0x1008b5f3
xor edi, edi
jmp 0x1008b5fc
mov edi, dword [esi + ecx]
add ecx, 4
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jg 0x1008b604
xor eax, eax
jmp 0x1008b618
sub edx, ecx
cmp edx, 4
jae 0x1008b60f
xor eax, eax
jmp 0x1008b618
mov eax, dword [esi + ecx]
add ecx, 4
mov dword [ebp - 0x1c], ecx
push eax
push edi
push dword [ebp - 0x6c]
mov ecx, 0x103e5aa4
call fcn.1002f800
sub dword [ebp - 0x24], 1
je 0x1008b40c
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jmp 0x1008b5b3
push edx
call fcn.1003b960
add esp, 4
jmp case.0x1008b36f.1394
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push edx
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.1008b1b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 2
cmp edx, ecx
jle 0x1008b6ab
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x1008b685
add ecx, 2
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jle 0x1008b6ab
sub edx, ecx
cmp edx, 4
jb 0x1008b6ab
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ecx]
add ecx, 4
mov dword [ebp - 0x1c], ecx
test eax, eax
jle 0x1008b6ab
push eax
mov ecx, 0x103e8940
call fcn.1008a390
lea ecx, [ebp - 0x20]
call fcn.1000cf80
jmp case.0x1008b36f.1394
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push edx
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.1008b1b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 3
cmp edx, ecx
jle 0x1008b40c
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x1008b6f4
add ecx, 2
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jle 0x1008b40c
mov eax, edx
sub eax, ecx
cmp eax, 4
jb 0x1008b40c
mov edi, dword [ebp - 0x18]
mov eax, dword [edi + ecx]
add ecx, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ecx
test eax, eax
jle 0x1008b40c
cmp edx, ecx
jg 0x1008b728
xor esi, esi
jmp 0x1008b73e
mov eax, edx
sub eax, ecx
cmp eax, 4
jae 0x1008b735
xor esi, esi
jmp 0x1008b73e
mov esi, dword [edi + ecx]
add ecx, 4
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jg 0x1008b746
xor al, al
jmp 0x1008b758
sub edx, ecx
cmp edx, 1
jae 0x1008b751
xor al, al
jmp 0x1008b758
mov al, byte [edi + ecx]
inc ecx
mov dword [ebp - 0x1c], ecx
movzx eax, al
mov ecx, 0x103e84f8
push eax
push esi
call fcn.100371d0
sub dword [ebp - 0x24], 1
je 0x1008b40c
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jmp 0x1008b720
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push edx
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.1008b1b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 4
cmp edx, ecx
jle 0x1008b40c
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x1008b7b8
add ecx, 2
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jle 0x1008b40c
mov eax, edx
sub eax, ecx
cmp eax, 4
jb 0x1008b40c
mov edi, dword [ebp - 0x18]
mov eax, dword [edi + ecx]
add ecx, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ecx
test eax, eax
jle 0x1008b40c
cmp edx, ecx
jg 0x1008b7ec
xor esi, esi
jmp 0x1008b802
mov eax, edx
sub eax, ecx
cmp eax, 4
jae 0x1008b7f9
xor esi, esi
jmp 0x1008b802
mov esi, dword [edi + ecx]
add ecx, 4
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jg 0x1008b80a
xor al, al
jmp 0x1008b81c
sub edx, ecx
cmp edx, 1
jae 0x1008b815
xor al, al
jmp 0x1008b81c
mov al, byte [edi + ecx]
inc ecx
mov dword [ebp - 0x1c], ecx
movzx eax, al
mov ecx, 0x103e84f8
push eax
push esi
call fcn.10037130
sub dword [ebp - 0x24], 1
je 0x1008b40c
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jmp 0x1008b7e4
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push edx
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.1008b1b0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], 5
cmp edx, ecx
jle 0x1008b893
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x1008b87b
add ecx, 2
mov dword [ebp - 0x28], ecx
cmp edx, ecx
jle 0x1008b893
mov eax, edx
sub eax, ecx
cmp eax, 4
jb 0x1008b893
mov edi, dword [esi + ecx]
add ecx, 4
mov dword [ebp - 0x28], ecx
jmp 0x1008b895
xor edi, edi
cmp edx, ecx
jg 0x1008b89d
xor esi, esi
jmp 0x1008b8b1
sub edx, ecx
cmp edx, 4
jae 0x1008b8a8
xor esi, esi
jmp 0x1008b8b1
mov esi, dword [esi + ecx]
add ecx, 4
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1008b210
mov byte [ebp - 4], 6
test edi, edi
jle 0x1008b8df
test esi, esi
jle 0x1008b8df
cmp dword [ebp - 0x40], 0
je 0x1008b8df
lea eax, [ebp - 0x50]
mov ecx, 0x103e655c
push eax
push esi
push edi
call fcn.10033e00
mov ecx, dword [ebp - 0x3c]
cmp ecx, 0x10
jb 0x1008b90f
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1008b905
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008b96d
push ecx
push edx
call fcn.100b631d
add esp, 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
call fcn.1000cf80
jmp case.0x1008b36f.1394
mov ecx, 0x103e8940
call fcn.1008a430
test al, al
je case.0x1008b36f.1394
mov byte [0x103df468], 1
jmp case.0x1008b36f.1394
push edx
call fcn.1008ba50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b684e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.100bbdff
call fcn.100bbdff
nop
jbe 0x1008b929
or byte [eax], dl
sbb dword [eax + ecx + 0x8b54b10], esi
adc byte [edi], bh
mov dh, 8
adc byte [eax - 0x47], cl
or byte [eax], dl
dec ebp
mov dh, 8
adc byte [eax + 0x7c1008b6], bh
mov bh, 8
adc byte [eax - 0x48], al
or byte [eax], dl
sub edi, dword [ecx - 0x46bdeff8]
or byte [eax], dl
dec eax
mov ecx, 184553480
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or eax, dword [ecx]
add al, byte [ebx]
add al, 5
push es
pop es
or byte [ebx], cl
or dword [ebx], ecx
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [edx]
int3