Function at 0x100045ad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1000d450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx ecx, byte [edi]
cmp ecx, 0x7e
ja case.0x1000420c.5
movzx ecx, byte [ecx + 0x10004648]
jmp dword [ecx*4 + 0x100045e4]
cmp eax, 1
jbe case.0x1000420c.5
push ebx
push 4
dec eax
push 0x3000
push eax
push 0
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x1000427a
mov edx, dword [ebp - 0x84]
push edx
inc edi
push edi
push ebx
call dword [0x1000dae8]
add esp, 0xc
cmp dword [esi + 0xfb4], 0
push 1
push 0
push 0
push ebx
je 0x1000428d
push 0x100028b0
push 0
push 0
call fcn.100087f0
mov ecx, dword [esi + 0xfb0]
add esp, 0x1c
mov dword [esi + ecx*4 + 0x10], eax
inc dword [esi + 0xfb0]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 0x10002880
push 0
push 0
call fcn.100087f0
mov edx, dword [esi + 0xfb0]
add esp, 0x1c
mov dword [esi + edx*4 + 0x10], eax
jmp 0x10004274
push 0
push 0
push 0
inc edi
push edi
push 0x100034b0
push 0
push 0
call fcn.100087f0
add esp, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
call fcn.10003770
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
inc edi
push edi
push 0x10003500
jmp 0x100042b7
call fcn.10003730
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
inc edi
push edi
call fcn.100035e0
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 1
push 0
push 0
inc edi
push edi
push 0x10003f30
push 0
push 0
call fcn.100087f0
mov ecx, dword [esi + 0xfb0]
mov dword [esi + ecx*4 + 0x10], eax
add esp, 0x1c
inc dword [esi + 0xfb0]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
movzx edx, byte [edi + 1]
push edx
call fcn.10002c50
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 0
inc edi
push edi
call fcn.10002d40
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 1
inc edi
push edi
call fcn.10002d40
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 1
inc edi
push edi
call fcn.10003360
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 0
inc edi
push edi
call fcn.10003360
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 0
call fcn.10002d70
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push eax
push edi
call fcn.10003090
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
push eax
push edi
call fcn.10003320
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
push ecx
push edi
call fcn.100032d0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 1
push 0
push 0
inc edi
push edi
push 0x10003490
push 0
push 0
call fcn.100087f0
mov edx, dword [esi + 0xfb0]
add esp, 0x1c
mov dword [esi + edx*4 + 0x10], eax
inc dword [esi + 0xfb0]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
push eax
call fcn.10002ce0
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 1
push 0
push 0
inc edi
push edi
push 0x10002c80
jmp 0x10004342
push 0x6c
inc edi
lea edx, [ebp - 0x7c]
push edi
push edx
call dword [0x1000dae8]
mov edx, dword [ebp - 0x78]
add esp, 0xc
lea eax, [ebp - 0x42]
push eax
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x74]
push ecx
mov ecx, dword [esi + 0xc]
push edx
push eax
call fcn.10007b80
test al, al
je case.0x1000420c.5
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0xfa0
idiv ecx
inc edx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi + 0xc]
push 5
lea ecx, [ebp - 0x10]
mov byte [ebp - 0x10], 0xda
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 0xf], eax
call fcn.100016e0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
inc edi
push edi
push 0x10002c20
push 0
push 0
call fcn.100087f0
mov edx, dword [esi + 0xfb0]
mov dword [esi + edx*4 + 0x10], eax
jmp 0x10004355
mov ecx, dword [esi + 0xc]
call fcn.100065f0
mov ecx, dword [esi + 4]
push 1
lea eax, [ebp - 0x7d]
push eax
mov byte [ebp - 0x7d], 0xd9
call fcn.100016e0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
push 0
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi + 4]
mov ecx, dword [ebp - 4]
inc dword [esi + 0x50]
pop edi
xor ecx, ebp
pop esi
call fcn.100088cc
mov esp, ebp
pop ebp
ret 8