Function at 0x1036cf7
Capabilities:
Create process on windows
Get common file path
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x560
mov eax, dword [0x1040190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
push 0x40
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x55c]
push ebx
push eax
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x4cc], ebx
mov dword [ebp - 0x560], ebx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x4dc], ebx
lea edi, [ebp - 0x4d8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x2c
stosd dword es:[edi], eax
lea eax, [ebp - 0x518]
push ebx
push eax
mov dword [ebp - 0x4c4], ebx
mov dword [ebp - 0x51c], ebx
call sub.msvcrt.dll_memset
add esp, 0x18
mov edi, 0x104018c
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor esi, esi
inc esi
cmp eax, esi
jne 0x1036dd4
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1036dc5
test dword [eax + 0x1c], 0x80000
je 0x1036dc5
cmp byte [eax + 0x19], 4
jb 0x1036dc5
push 0x1008ed0
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
mov dword [ebp - 0x4c0], 0x800704c7
jmp 0x1036fb2
push 0x10e
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1036f56
push 0x1037008
push 0x10e
lea eax, [ebp - 0x220]
push eax
call fcn.010059df
cmp eax, ebx
mov dword [ebp - 0x4c0], eax
jl 0x1036f68
cmp dword [ebp + 0x14], ebx
je 0x1036e5d
xor eax, eax
cmp dword [ebp + 0x18], ebx
setne al
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x220]
push eax
push 0x103701c
lea eax, [ebp - 0x4bc]
push 0x14e
push eax
call fcn.01004d53
add esp, 0x18
cmp eax, ebx
mov dword [ebp - 0x4c0], eax
jl 0x1036f68
lea eax, [ebp - 0x4bc]
mov dword [ebp - 0x4cc], eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [ebp - 0x4c4], eax
cmp eax, ebx
je 0x1036f56
push 0x30
lea ecx, [ebp - 0x51c]
push ecx
push 2
push eax
mov dword [ebp - 0x50c], 8
mov dword [ebp - 0x500], 5
call dword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x1036f56
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x558], eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x560]
push eax
push ebx
push dword [ebp - 0x4ec]
lea eax, [ebp - 0x220]
push 0x404
push ebx
push ebx
push ebx
push dword [ebp - 0x4cc]
mov dword [ebp - 0x560], 0x44
push eax
push dword [ebp - 0x4e0]
mov dword [ebp - 0x534], esi
mov word [ebp - 0x530], si
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1036f56
push dword [ebp - 0x4dc]
push dword [ebp - 0x4c4]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x1036f56
push dword [ebp - 0x4d8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1036f56
mov esi, dword [ebp - 0x4dc]
lea eax, [ebp - 0x4c8]
push eax
push 0x1d4c0
call fcn.01036c71
cmp eax, ebx
mov dword [ebp - 0x4c0], eax
jl 0x1036f68
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [ebp - 0x4e4]
mov dword [ecx], eax
jmp 0x1036f68
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01036c49
mov dword [ebp - 0x4c0], eax
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1036fb2
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1036fa0
test dword [eax + 0x1c], 0x80000
je 0x1036fa0
cmp byte [eax + 0x19], 4
jb 0x1036fa0
push 0x1008ed0
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
push dword [0x10401ec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10401ec], ebx
cmp dword [ebp - 0x4d8], ebx
je 0x1036fc6
push dword [ebp - 0x4d8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4dc], ebx
je 0x1036fda
push dword [ebp - 0x4dc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4c4], ebx
pop edi
pop esi
pop ebx
je 0x1036ff1
push dword [ebp - 0x4c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c0]
xor ecx, ebp
call fcn.010024b0
leave
ret 0x18