Function at 0x1003bf42
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1006876d
call fcn.100673b8
sub esp, 0xc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x18], ebx
xor edi, edi
inc edi
mov esi, edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], 0xafa9b64f
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], esi
cmp eax, dword [ebp - 0x18]
jl 0x1003bf95
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1003bfaf
push 0xa42
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], 0x43af7806
mov dword [ebp - 0x10], 0x607800ff
mov dword [ebp - 0x10], ebx
jmp 0x1003bfda
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x44], 0xbd43
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1003bfcc
mov dword [ebp - 0x14], ebx
jmp 0x1003c13c
mov dword [ebp - 0x1c], 0xab6ec79c
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x18], 0x2395e2de
mov dword [ebp - 0x24], 0x90dfc1f7
mov dword [ebp - 0x28], 0xca0e2c23
push 3
call fcn.10016d71
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1003c026
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], 0x5340
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003c016
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
sub eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0xe0d1
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0xf1f1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0xf748
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0xffff6e48
jg 0x1003c088
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
je 0x1003c0df
mov dword [ebp - 0x34], 0x795c380a
lea ecx, [ebp - 0xb8]
push 4
call fcn.10016d71
mov dword [ebp - 0x10], ebx
jmp 0x1003c0c9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0x6d1d89e1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1003c0b6
inc dword [ebp - 0x44]
lea ecx, [ebp - 0xb8]
call fcn.10016f47
jmp 0x1003c0f4
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003c0f4
push ebx
push 0x12d2
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x44], ebx
je 0x1003c107
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x60]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x60]
or dword [ebp - 4], 0xffffffff
call fcn.10016f47
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jge 0x1003bfe8
mov eax, 0xf665683c
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x28], 0xc405b401
mov dword [ebp - 0x1c], 0x1867b8f5
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x28], 0x9d5fac12
mov dword [ebp - 0x10], ebx
jmp 0x1003c195
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc4], 0xc3707822
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003c184
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003c1ad
push 0x6d
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8c]
dec dword [ebp - 0x24]
cmp eax, ecx
mov eax, edi
lea ecx, [ebp - 0xac]
cmovle eax, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 0xfa72
mov dword [ebp - 0x14], 0xe0091df8
mov dword [ebp - 0x10], 8
push edi
call fcn.10016d71
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x1003c20c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xac]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1003c1fc
mov dword [ebp - 0x28], 0x1810
cmp dword [ebp - 0x28], 0xaba
jge 0x1003c2a6
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x10008510
call fcn.1004f2db
mov edi, dword [ebp - 0x50]
add esp, 0x14
cmp dword [ebp - 0x3c], 0
mov ebx, dword [ebp - 0x4c]
jne 0x1003c25b
test ebx, ebx
jne 0x1003c25b
test edi, edi
jne 0x1003c25b
cmp dword [ebp - 0x38], ebx
je 0x1003c29e
mov esi, dword [ebp - 0x3c]
mov edx, edi
sub edx, dword [ebp - 0x38]
sub esi, ebx
mov ecx, edi
sub ecx, ebx
cmp dword [ebp - 0x38], edi
lea eax, [edx + 0x28]
cmovg edx, eax
cmp edi, ebx
lea eax, [ecx + 0x28]
cmovg eax, ecx
add edx, eax
cmp ebx, dword [ebp - 0x3c]
lea eax, [esi + 0x28]
cmovg esi, eax
add edx, esi
imul eax, edx, 9
add eax, 0x9d
push eax
push 0x10008214
call fcn.1004ff5e
pop ecx
pop ecx
jmp 0x1003c225
mov esi, dword [ebp - 0x30]
xor edi, edi
xor ebx, ebx
inc edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0xfb37
mov eax, dword [ebp - 0x14]
cmp eax, 0x73672d71
setl cl
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], 0x83d78398
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], ebx
je 0x1003c31f
mov dword [ebp - 0x30], 0x4292978d
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0x3fc2
mov dword [ebp - 0x10], ebx
jmp 0x1003c314
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003c307
dec dword [ebp - 0x34]
jmp 0x1003c32c
mov dword [ebp - 0x30], 0x68993dd6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0xac]
call fcn.10016f47
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x1c], 0xafa9b64f
mov dword [ebp - 0x24], 0xf572
mov dword [ebp - 0x14], 0x30f94f37
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x34], 0xffffffff
push edi
call fcn.10016d71
mov dword [ebp - 0x28], 0x585c
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x14], ebx
jmp 0x1003c393
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x84]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003c383
mov dword [ebp - 0x14], ebx
jmp 0x1003c3ab
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0x366e5232
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1003c39d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jne 0x1003c3df
dec dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x10], eax
jge 0x1003c3d2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1c], ebx
jne 0x1003c3df
cmp dword [ebp - 0x24], ebx
je 0x1003c3e6
mov eax, edi
cmp dword [ebp - 0x10], ebx
jne 0x1003c3e8
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x84]
cmp ecx, dword [eax]
jg 0x1003c3ff
mov ecx, edi
cmp dword [ebp - 0x10], ebx
jne 0x1003c401
mov ecx, ebx
mov eax, dword [ebp - 0x28]
sub ecx, eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.10016f47
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jl 0x1003c440
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0xafa9b64f
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
jl 0x1003c47d
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], 0
je 0x1003c498
push 0xa42
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
cmp byte [ebp - 0x29], 0
je 0x1003c53d
push 3
lea ecx, [ebp - 0x6c]
call fcn.10016d71
mov dword [ebp - 0x14], 0xe2236432
mov dword [ebp - 0x10], ebx
jmp 0x1003c4c8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0xb9b55bb2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003c4b8
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1003c52a
mov dword [ebp - 0x18], 0xe1879501
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1003c525
mov dword [ebp - 0x10], 0xdfbd6c3f
mov dword [ebp - 0x10], ebx
jmp 0x1003c51a
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1003c508
dec dword [ebp - 0x18]
jns 0x1003c4fc
dec dword [ebp - 0x14]
jns 0x1003c4da
lea ecx, [ebp - 0x6c]
call fcn.10016f47
push 0xa42
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x18], ebx
jmp 0x1003c564
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1003c553
mov dword [ebp - 0x14], 0x1a
jmp 0x1003c68e
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
add eax, 0xc520
cmp eax, 0xc8d4
mov eax, edi
setl cl
xor edx, edx
sub eax, ecx
cmp eax, 0x6ec7
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
mov eax, dword [ebp - 0x14]
mov ebx, 0x34a2c930
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0xa0], ebx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
sub eax, ebx
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 9
jb 0x1003c63b
cmp dword [ebp - 0x30], ebx
jne 0x1003c698
jmp 0x1003c68b
mov dword [ebp - 0x18], ebx
jmp 0x1003c676
push 3
lea ecx, [ebp - 0x78]
call fcn.10016d71
mov dword [ebp - 0x10], ebx
jmp 0x1003c65c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1003c64f
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.10016f47
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffd
jne 0x1003c640
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x1003c68b
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
jne 0x1003c576
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x54]
mov edi, edx
mov esi, eax
call fcn.1003bed0
mov ecx, dword [ebp - 0xc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret