Function at 0x10131e37
Capabilities:
Create process on windows

Disassembly:
push 0x7c0
mov eax, 0x10326428
call fcn.1027911b
mov eax, ecx
mov dword [ebp - 0x76c], eax
cmp dword [eax + 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x774], ecx
mov dword [ebp - 0x778], esi
je 0x10131e97
mov ecx, eax
call fcn.10132260
test al, al
jne 0x10131e97
push str.Attempting_to_start_a_new_process_when_the_process_has_already_been_started
push 0x43
lea ecx, [ebp - 0x3e0]
call fcn.100e1c8c
push 0x1060513c
lea eax, [ebp - 0x3e0]
push eax
call fcn.1027a8f4
and dword [ebp - 0x18], 0
xor eax, eax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
cmp dword [ebx + 0x10], eax
sete al
test al, al
jne 0x10131f28
cmp dword [esi + 0x10], 0
sete al
test al, al
jne 0x10131f28
cmp dword [esi + 0x14], 8
jb 0x10131ec9
mov eax, dword [esi]
jmp 0x10131ecb
mov eax, esi
push 0x20
pop edx
cmp dx, word [eax]
je 0x10131f28
and dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
push ebx
call fcn.100f430f
push esi
lea eax, [ebp - 0x40]
push eax
push str._s__s
lea eax, [ebp - 0x58]
push eax
call fcn.10014df9
push eax
lea ecx, [ebp - 0x28]
call fcn.10006b39
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.10007cb3
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10007cb3
jmp 0x10131f41
cmp dword [esi + 0x10], 0
je 0x10131f41
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x10131f41
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.10007eb1
push 0x44
pop edi
push edi
lea eax, [ebp - 0x7cc]
push 0
push eax
call fcn.1027bff1
mov dword [ebp - 0x7cc], edi
xor eax, eax
lea edi, [ebp - 0x788]
xor edx, edx
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x76c]
cmp byte [ebp + 8], dl
je 0x1013203e
cmp dword [edi + 0x1c], edx
jne 0x10131f82
mov eax, edx
jmp 0x10131f8d
lea eax, [edi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x10131f8d
mov eax, dword [eax]
cmp dword [ebp - 0x18], edx
jne 0x10131f9a
mov dword [ebp - 0x770], edx
jmp 0x10131fab
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 0x770], ecx
cmp dword [ebx + 0x14], 8
jb 0x10131fbb
mov ecx, dword [ebx]
mov dword [ebp - 0x76c], ecx
jmp 0x10131fc1
mov dword [ebp - 0x76c], ebx
mov esi, dword [ebp - 0x774]
lea ecx, [ebp - 0x788]
push ecx
lea ecx, [ebp - 0x7cc]
push ecx
mov esi, dword [esi + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
or eax, 0x8000000
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x770]
push dword [ebp - 0x76c]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1013210b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp + 0x18], 0
mov esi, eax
je 0x101320fb
push dword [ebp - 0x778]
lea ecx, [ebp - 0x3e0]
push ebx
push str.Failed_to_start_process__as_user__for_file:__s_arguments:__s
push esi
push 0xf
call fcn.10130481
jmp 0x10131e86
cmp dword [edi + 0x1c], edx
jne 0x10132047
mov eax, edx
jmp 0x10132052
lea eax, [edi + 0xc]
cmp dword [eax + 0x14], 8
jb 0x10132052
mov eax, dword [eax]
cmp dword [ebp - 0x18], edx
jne 0x1013205f
mov dword [ebp - 0x76c], edx
jmp 0x10132070
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
mov dword [ebp - 0x76c], ecx
cmp dword [ebx + 0x14], 8
jb 0x10132080
mov ecx, dword [ebx]
mov dword [ebp - 0x770], ecx
jmp 0x10132086
mov dword [ebp - 0x770], ebx
lea ecx, [ebp - 0x788]
push ecx
lea ecx, [ebp - 0x7cc]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
or eax, 0x8000000
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x76c]
push dword [ebp - 0x770]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1013210b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp byte [ebp + 0x18], 0
je 0x101320f9
push esi
push ebx
push str.Failed_to_start_process_for_file:__s_arguments:__s
call edi
push eax
push 0xf
lea ecx, [ebp - 0x768]
call fcn.1013034f
push 0x1060513c
lea eax, [ebp - 0x768]
jmp 0x10131e91
mov esi, eax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10007cb3
mov eax, esi
jmp 0x10132135
mov eax, dword [ebp - 0x788]
push dword [ebp - 0x784]
mov dword [edi + 4], eax
mov dword [edi + 8], 0x103
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10007cb3
xor eax, eax
call fcn.102790cd
ret 0x14