Function at 0x106faf5
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10ede19
call fcn.01003440
mov eax, 0x1085c
call fcn.0102727b
mov eax, dword [0x1116788]
and word [ebp - 0x810], 0
push ebx
mov dword [ebp - 0x10], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x10814], eax
push edi
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x80e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x24]
sub eax, 0
je 0x106fb81
dec eax
je 0x106fb6c
mov eax, dword [0x11169c4]
cmp byte [eax + 0x19], 2
jb 0x106fb65
push 0x106955c
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f4dc
mov eax, dword [0x11169c4]
mov ebx, 0x80070057
jmp 0x106fba4
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0x1069588
push 0x29
jmp 0x106fb94
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0x1069588
push 0x25
call fcn.0106fe6f
mov ebx, eax
test ebx, ebx
jge 0x106fbbb
mov eax, dword [0x11169c4]
cmp byte [eax + 0x19], 2
jb 0x106fde6
push ebx
push 0x106955c
push 0x28
jmp 0x106fc97
cmp dword [esi + 0x24], 1
jne 0x106fc31
cmp byte [esi + 0x6c], 0
jne 0x106fc12
cmp byte [esi + 0x6e], 0
jne 0x106fc12
push 0x25
mov ecx, esi
call fcn.0106f6a4
mov ebx, eax
test ebx, ebx
jge 0x106fc12
mov eax, dword [0x11169c4]
cmp byte [eax + 0x19], 2
jb 0x106fde6
mov esi, dword [esi + 0x14]
push ebx
call fcn.010315a5
push eax
mov eax, dword [0x11169c4]
push esi
push 0x106955c
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f566
jmp 0x106fde6
call fcn.010315a5
push eax
push dword [ebp - 0x10814]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x106fc4e
call fcn.0103fcf0
jmp 0x106fc4e
call fcn.0103fcf0
push eax
push dword [ebp - 0x10814]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x106fc4e
call fcn.010315a5
and word [ebp - 0x10810], 0
xor eax, eax
mov ecx, 0x3fff
lea edi, [ebp - 0x1080e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7fff
lea eax, [ebp - 0x10810]
push eax
mov ecx, esi
call fcn.0106f8aa
mov ebx, eax
test ebx, ebx
mov eax, dword [0x11169c4]
jge 0x106fca7
cmp byte [eax + 0x19], 2
jb 0x106fde6
push ebx
push 0x106955c
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f624
jmp 0x106fde6
cmp byte [eax + 0x19], 4
mov esi, 0x106955c
jb 0x106fcce
lea ecx, [ebp - 0x10810]
push ecx
lea ecx, [ebp - 0x810]
push ecx
push esi
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0103fa59
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x10814]
call fcn.0103f8bf
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x10864]
rep stosd dword es:[edi], eax
mov ax, word [ebp + 8]
mov word [ebp - 0x10838], ax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x10824], ecx
lea edi, [ebp - 0x10820]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 4], 0
stosd dword es:[edi], eax
lea eax, [ebp - 0x10824]
push eax
lea eax, [ebp - 0x10868]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x10810]
push eax
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x10868], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x106fd84
mov eax, dword [0x11169c4]
cmp byte [eax + 0x19], 4
jb 0x106fd6c
lea ecx, [ebp - 0x10810]
push ecx
lea ecx, [ebp - 0x810]
push ecx
push esi
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0103fa59
push dword [ebp - 0x10820]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10824]
call esi
jmp 0x106fdd2
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x106fd96
call edi
mov ebx, eax
jmp 0x106fda6
call edi
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
test ebx, ebx
jge 0x106fdd2
mov eax, dword [0x11169c4]
cmp byte [eax + 0x19], 2
jb 0x106fdd2
push ebx
lea ecx, [ebp - 0x10810]
push ecx
lea ecx, [ebp - 0x810]
push ecx
push esi
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f566
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x10814], 0
je 0x106fde6
push 0
call fcn.0103f8e2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, ebx
pop ebx
call fcn.010032ea
leave
ret 4