Function at 0x100656a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100d16b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x100d0fe0]
xor edx, edx
div dword [0x100d0fe4]
mov ecx, 0xfc3a9226
xor edx, edx
div ecx
and eax, 0x51f5b2a2
add eax, 0x8ca48d49
add eax, 0xb071ccdc
and eax, 0x4d799023
and eax, 0xfb6f2cf1
mov ecx, 0x8635d9ba
xor edx, edx
div ecx
add eax, 0x3b65f685
sub eax, 0x7f5d0ea1
add eax, 0xf1c199f5
mov ecx, 0x9702f269
xor edx, edx
div ecx
mov ecx, 0x703c4448
xor edx, edx
div ecx
add eax, 0xe6cd9d53
add eax, 0x4df1c3b4
xor eax, 0x803d4252
xor eax, 0xaed1c688
or eax, 0x6ae682cb
sub eax, 0x2e1d0739
mov ecx, 0xf19fa055
xor edx, edx
div ecx
and eax, 0xf562c8db
sub eax, 0x37365881
mov ecx, 0x77ad6084
xor edx, edx
div ecx
mov ecx, 0x773ab40a
xor edx, edx
div ecx
or eax, 0xf128818d
or eax, 0xfddaf426
xor eax, 0x95cdeddf
or eax, 0x35ee3a2
and eax, 0x511ab939
or eax, 0xfa48b09c
imul eax, eax, 0x4b67c593
mov ecx, 0xb588cbbe
xor edx, edx
div ecx
and eax, 0x2fc39ab4
and eax, 0xe51d7824
imul eax, eax, 0x6f14f84f
sub eax, 0x1d99b20f
xor eax, 0x79400190
sub eax, 0x3729c10c
xor eax, 0x41008ccd
add eax, 0x55b1e08f
mov ecx, 0xb8907ad7
xor edx, edx
div ecx
mov ecx, 0x28b40b9e
xor edx, edx
div ecx
sub eax, 0xd75d8cc2
and eax, 0x235c330c
and eax, 0x9ce628b9
imul eax, eax, 0xad135556
and eax, 0xdac2ddf1
add eax, 0xc182ab75
or eax, 0x9eb5b04e
sub eax, 0xcbbdc4d7
or eax, 0xc23c3914
sub eax, 0xd3addb89
xor eax, 0x5105ee1c
and eax, 0x8e4d035f
xor eax, 0x9156fb4d
sub eax, 0x1a5470f7
imul eax, eax, 0x2178c903
sub eax, 0x2c9ff5d2
and eax, 0x4cfd3aff
sub eax, 0x8ac64eb0
add eax, 0xc9b0617c
add eax, 0xb2c8e97e
xor eax, 0xfc43170e
sub eax, 0xc823dde5
xor eax, 0xc2856b12
sub eax, 0x60ac6836
add eax, 0x1af673d8
and eax, 0x3b737d3d
imul eax, eax, 0xbf1b65e6
or eax, 0xd3069b1
mov ecx, 0xc48a575c
xor edx, edx
div ecx
sub eax, 0x9ad884bd
xor eax, 0xb596fde2
cmp eax, 0xcc608182
jbe 0x10065d4c
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0x4765122
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1007cb30
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.100358d0
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0x4371b5f4
je 0x10065870
mov al, byte [ebp - 0x16]
test al, 1
jne 0x10065975
jmp 0x1006598e
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100d0ff0]
xor eax, dword [0x100d0ff4]
imul eax, eax, 0x43d8a080
add eax, 0x8c750fcf
sub eax, 0x53b0ed09
or eax, 0x59fe5ad9
add eax, 0x7c791bf3
and eax, 0xddff0729
mov ecx, 0x2e5d8caa
xor edx, edx
div ecx
mov ecx, 0x25ddfc75
xor edx, edx
div ecx
imul eax, eax, 0x4a538640
or eax, 0x6ef5b22c
add eax, 0x99c0371d
imul eax, eax, 0xd692654
xor eax, 0x5d5d6dc5
and eax, 0xd6806f1
imul eax, eax, 0xe25d6a10
imul eax, eax, 0x79f9009d
sub eax, 0x4cb0ecd2
or eax, 0xd9298889
sub eax, 0x866cdcc0
mov ecx, 0x7acb97ad
xor edx, edx
div ecx
or eax, 0x77c91120
sub eax, 0x3b60b873
mov ecx, 0xa4945e41
xor edx, edx
div ecx
mov ecx, 0x69e64b63
xor edx, edx
div ecx
sub eax, 0x6b3fce8f
and eax, 0xc73195c5
add eax, 0xa916b1b0
imul eax, eax, 0x7999a8b4
xor eax, 0xe3b0d9c8
add eax, 0x599b6c9a
sub eax, 0x1db61eb2
xor eax, 0x6e6f1366
sub eax, 0x82b2acff
imul eax, eax, 0xe99c640d
and eax, 0x197edd2f
imul eax, eax, 0x11bca33a
mov ecx, 0x504101eb
xor edx, edx
div ecx
and eax, 0xc573747d
sub eax, 0xb223c576
add eax, 0x461d7327
or eax, 0x28a6da87
mov ecx, 0x8db6a7cc
xor edx, edx
div ecx
imul eax, eax, 0xbc6b30bc
and eax, 0xc203e267
xor eax, 0x3d38fde2
mov ecx, 0x4152f83
xor edx, edx
div ecx
add eax, 0xd5639c0c
imul eax, eax, 0x514657d2
mov ecx, 0x3b2f0965
xor edx, edx
div ecx
and eax, 0xf3057554
sub eax, 0xbe5f0bc0
sub eax, 0xd557972f
add eax, 0x6beb9656
or eax, 0xb7afffa9
or eax, 0x6950c91
imul eax, eax, 0x37b40e17
imul eax, eax, 0xf1d0bb1f
mov ecx, 0xf09d539b
xor edx, edx
div ecx
mov ecx, 0x9608bdd3
xor edx, edx
div ecx
or eax, 0xa6677fab
xor eax, 0x48fba550
imul eax, eax, 0x643ce9ee
sub eax, 0x5ad08944
and eax, 0xe462ebe5
mov ecx, 0x33b75566
xor edx, edx
div ecx
sub eax, 0x856c50ad
mov ecx, 0x366945e9
xor edx, edx
div ecx
add eax, 0x9d7a6e99
sub eax, 0xd8f18f84
and eax, 0xf2d30ec4
add eax, 0x29d83d44
and eax, 0xbab8bbe9
cmp eax, 0xd10a4859
jae 0x10065e25
mov eax, dword [0x100d0ff8]
and eax, dword [0x100d0ffc]
xor eax, 0xc237a871
or eax, 0xe97453ae
add eax, 0x2fa0308a
imul eax, eax, 0x36550b1a
mov ecx, 0xae670a21
xor edx, edx
div ecx
xor eax, 0x9cf3fc3b
imul eax, eax, 0x5c17aba4
and eax, 0x42d5d168
imul eax, eax, 0x8ebe39c9
and eax, 0xf02c7aec
xor eax, 0x5cd8b692
or eax, 0xbb22ed32
xor eax, 0x2d4ed56e
and eax, 0x9b389a63
add eax, 0x8df88dae
sub eax, 0xad24393
mov ecx, 0xdad76404
xor edx, edx
div ecx
sub eax, 0xb0a11045
xor eax, 0x11b2918e
xor eax, 0x8d2153c
sub eax, 0xc66525df
sub eax, 0x96fd1bcb
xor eax, 0xdae9c689
and eax, 0x532b518b
mov ecx, 0x434eee95
xor edx, edx
div ecx
xor eax, 0xcb4318d6
xor eax, 0x4452760d
and eax, 0x6214b8f0
and eax, 0x22796608
mov ecx, 0x51afca40
xor edx, edx
div ecx
or eax, 0xc6f572dd
and eax, 0xdc666d82
mov ecx, 0xe740669b
xor edx, edx
div ecx
xor eax, 0x65b19f91
and eax, 0xf89df6f9
or eax, 0x2cca1174
add eax, 0x7dfe8c54
and eax, 0x7dd96a8b
or eax, 0xf31dac43
mov ecx, 0x7f71a186
xor edx, edx
div ecx
and eax, 0x8740e3a6
and eax, 0x1a586dcc
imul eax, eax, 0x8908de19
or eax, 0xab8650e1
xor eax, 0x65df35f6
mov ecx, 0xbc19add7
xor edx, edx
div ecx
mov ecx, 0x323811ba
xor edx, edx
div ecx
and eax, 0x72442ce0
or eax, 0x32e02aa0
mov ecx, 0x9590eeff
xor edx, edx
div ecx
imul eax, eax, 0xddfe12d8
or eax, 0xabb42edf
or eax, 0x5eb85136
or eax, 0x898fd8e6
sub eax, 0x3c5699f0
add eax, 0x5b6b408e
xor eax, 0x8f4a5a26
mov ecx, 0xbb7bd139
xor edx, edx
div ecx
mov ecx, 0x43175366
xor edx, edx
div ecx
and eax, 0xdbfffd66
or eax, 0x921dd58b
xor eax, 0xc4becfd5
add eax, 0xe14f6a66
sub eax, 0xc7bd2bc2
or eax, 0x4f3af528
imul eax, eax, 0x7039bda
and eax, 0x8f992c7b
or eax, 0x8765573a
sub eax, 0xd8ffcbe0
mov ecx, 0xdec7c49
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor ecx, 0x2768272c
and ecx, 0xe63cb4ad
mov dword [ebp - 0x34], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x30], ecx
cmp eax, 0x70f2ddfc
je 0x10065e25
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007916f
mov eax, dword [ebp - 0x30]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [ebp - 0x40], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x3c], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x38], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1007cb30
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.100358d0
add esp, 0xc
jmp 0x10065870
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10065b4d