Function at 0x1004276a
Capabilities:
Create process on windows
Read file via mapping

Disassembly:
push 0xb0
mov eax, 0x1011d093
call fcn.10003d4a
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x38], ecx
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x64]
xor eax, eax
mov dword [ebp - 0x54], ebx
stosd dword es:[edi], eax
push 0x40
push 0
mov dword [ebp - 0xbc], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb8]
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 4], eax
mov edi, eax
mov byte [ebp - 0x2a], 1
mov dword [ebp - 0x3c], edi
test ebx, ebx
je 0x10042e33
cmp byte [0x101aed14], al
je 0x100427f9
call fcn.1004247b
test al, al
jne 0x100427f9
mov ecx, dword [ebp - 0x38]
push edi
mov eax, dword [ecx]
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.kernel32.dll_RaiseFailFastException]
push 0x101a8990
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
pop ecx
push eax
call fcn.1003a42b
mov byte [ebp - 4], 0
mov eax, dword [ebx]
push ebx
call dword [eax + 0x38]
test eax, eax
je 0x10042822
call fcn.1003a42b
cmp dword [0x101ae924], 0
je 0x10042838
cmp dword [0x101aed28], 0
je 0x10042e21
mov ebx, dword [sym.imp.kernel32.dll_CreateEventExW]
lea eax, [ebp - 0x64]
push 0x1f0003
push 0
push 0
push eax
mov dword [ebp - 0x64], 0xc
mov dword [ebp - 0x5c], 1
call ebx
mov dword [ebp - 0x50], eax
test eax, eax
je 0x10042e21
push 0x1f0003
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call ebx
mov dword [ebp - 0x40], eax
test eax, eax
je 0x10042dfc
push 0x1f0003
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call ebx
mov dword [ebp - 0x30], eax
test eax, eax
je 0x10042dfc
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
je 0x10042dff
push 0
push 0x9c9c
push 0
push 4
lea eax, [ebp - 0x64]
push eax
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x10042dff
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10042dee
push 0x9c94
lea ecx, [ebx + 8]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x54]
add esp, 0xc
mov dword [ebx], 0x9c9c
mov dword [ebx + 4], 0x20000
mov eax, dword [ecx]
push ecx
call dword [eax]
mov dword [ebx + 0x28], eax
test eax, eax
je 0x10042de7
mov esi, dword [ebp - 0x54]
push esi
mov eax, dword [esi]
call dword [eax + 4]
mov dword [ebx + 8], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov dword [ebx + 0xc], eax
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x8470]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x38]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x1c], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x4c], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0xc
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], 0x21
mov dword [ebx + 0x3c], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x20]
test eax, eax
jne 0x100429ad
or dword [ebx + 0x2c], 0x80
cmp dword [edi + 0x20], 0
je 0x100429b7
or dword [ebx + 0x38], 4
cmp dword [edi + 0xc], 0
je 0x100429cf
or dword [ebx + 0x2c], 1
lea ecx, [ebx + 0x9ac]
push dword [edi + 0xc]
call fcn.1003a42b
mov eax, dword [esi]
lea ecx, [ebx + 0x9ac]
push 0x400
push ecx
push esi
call dword [eax + 0x18]
test eax, eax
je 0x100429e9
or dword [ebx + 0x2c], 1
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x10042a00
push 0x400
lea edx, [ebx + 0x19ac]
call fcn.1003a42b
mov eax, dword [ebp - 0x44]
push 0
push 0x101a5df8
mov dword [ebx + 0x40], eax
call dword [sym.imp.kernel32.dll_LocaleNameToLCID]
push eax
push 0x1015f158
lea eax, [ebx + 0x59c]
push 0xffffffffffffffff
push eax
call fcn.1003a42b
add esp, 0x10
lea edx, [ebx + 0x50]
mov ecx, str.Microsoft_Office_16
push 0x104
call fcn.1003a42b
push 0x1f
lea edi, [ebx + 0x7a4]
mov esi, str.mso.dll
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x38]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10042a63
push 0x38
lea edx, [ebx + 0x21ac]
call fcn.1003a42b
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10042a7a
push 0x104
lea edx, [ebx + 0x3d1c]
call fcn.1003a42b
mov edi, dword [ebp - 0x54]
lea esi, [ebx + 0x258]
push 0x104
push esi
push edi
mov eax, dword [edi]
call dword [eax + 0x1c]
test eax, eax
jne 0x10042ab8
push 0x104
cmp word [0x101ae708], ax
je 0x10042aaf
mov edx, esi
mov ecx, 0x101ae708
call fcn.1003a42b
jmp 0x10042ab8
push esi
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
cmp dword [0x101aed28], 0
je 0x10042af2
push 0x1f0003
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.kernel32.dll_CreateEventExW]
mov ecx, dword [0x101aed28]
mov esi, eax
test ecx, ecx
je 0x10042b99
mov eax, dword [ecx]
push esi
push dword [ebp - 0x4c]
call dword [eax + 0x48]
jmp 0x10042b99
and dword [ebp - 0x28], 0
lea edx, [ebp - 0x4c]
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
call fcn.1003a42b
test al, al
je 0x10042daa
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0xbc]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push ecx
push ecx
push 0x2000400
push 1
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x10042daa
push dword [ebp - 0x70]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x6c]
mov eax, dword [edi]
push edi
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x10042b96
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], ecx
cmp eax, 0x1000
jb 0x10042b8e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1003a42b
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov esi, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x48]
xor eax, eax
test ecx, ecx
mov byte [ebp - 0x29], 1
setne al
add eax, 2
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
call fcn.1008f964
test al, al
jne 0x10042bdd
push 0
push 0x4e20
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.kernel32.dll_WaitForMultipleObjectsEx]
jmp 0x10042bea
push ecx
push ecx
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x1c]
call fcn.1003a42b
test eax, eax
jne 0x10042bf6
mov eax, dword [edi]
push edi
call dword [eax + 0x30]
jmp 0x10042c5f
cmp eax, 1
je 0x10042c81
cmp eax, 2
je 0x10042c78
cmp eax, 0x102
je 0x10042c15
push 0x6998ce
call fcn.1003a42b
mov ecx, dword [ebp - 0x34]
mov edx, 0x4e20
mov byte [ebp - 0x29], 0
call fcn.10043633
cmp eax, 0x102
je 0x10042c81
cmp eax, 0x80
je 0x10042c6d
mov ecx, dword [ebp - 0x50]
xor edx, edx
inc edx
call fcn.10043633
test eax, eax
je 0x10042c52
push dword [ebp - 0x40]
call dword [sym.imp.kernel32.dll_SetEvent]
mov byte [ebp - 0x2a], 0
jmp 0x10042c56
mov byte [ebp - 0x29], 1
push dword [ebp - 0x34]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp byte [ebp - 0x2a], 0
je 0x10042c81
mov ecx, dword [ebp - 0x48]
jmp 0x10042bad
push dword [ebp - 0x34]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
jmp 0x10042c81
push dword [ebp - 0x40]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [edi]
push edi
call dword [eax + 0x34]
cmp dword [0x101aed28], 0
je 0x10042cb2
test esi, esi
je 0x10042e54
or edx, 0xffffffff
mov ecx, esi
call fcn.10043633
test eax, eax
jne 0x10042e54
xor edi, edi
inc edi
jmp 0x10042de7
mov eax, dword [ebx + 0x9a84]
test eax, eax
je 0x10042de4
cmp byte [ebp - 0x29], 0
mov ecx, dword [ebp - 0x38]
je 0x10042d2b
test dword [ecx + 0x18], eax
je 0x10042d2b
push 0x10
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov edi, eax
mov eax, dword [ebx + 0x9a84]
test edi, edi
jne 0x10042d15
sub eax, 1
je 0x10042d0d
sub eax, 1
je 0x10042d09
dec eax
sub eax, 1
je 0x10042d05
push 0x6998d0
call fcn.1003a42b
xor edi, edi
jmp 0x10042de7
push 7
jmp 0x10042d0f
push 6
jmp 0x10042d0f
push 9
pop edi
jmp 0x10042de7
mov dword [edi], eax
mov eax, dword [ebp - 0x4c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x48]
mov dword [edi + 4], ebx
mov dword [edi + 0xc], eax
jmp 0x10042e21
test dword [ecx + 0x1c], eax
je 0x10042d5c
sub eax, 1
je 0x10042d58
sub eax, 1
je 0x10042d54
dec eax
sub eax, 1
je 0x10042d50
sub eax, 0xc
je 0x10042caa
push 0x6998d2
jmp 0x10042cf9
push 3
jmp 0x10042d0f
push 2
jmp 0x10042d0f
push 5
jmp 0x10042d0f
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
test eax, eax
je 0x10042de4
mov eax, dword [ebx + 0x9a84]
sub eax, 1
je 0x10042da0
sub eax, 1
je 0x10042da0
dec eax
sub eax, 1
je 0x10042d91
sub eax, 0xc
je 0x10042caa
push 0x6998d5
call fcn.1003a42b
jmp 0x10042de4
push 3
pop edi
push 0x6998d3
call fcn.1003a42b
jmp 0x10042de7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
jmp 0x10042e63
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x10042de1
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], ecx
cmp eax, 0x1000
jb 0x10042dd9
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1003a42b
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov esi, dword [ebp - 0x58]
mov edi, dword [ebp - 0x3c]
push ebx
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x10042dfc
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ebx, dword [ebp - 0x34]
push dword [ebp - 0x50]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x10042e16
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test ebx, ebx
je 0x10042e21
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [ebp - 0x54]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x38]
test eax, eax
je 0x10042e33
call fcn.1003a42b
push 0x101a8990
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
pop ecx
test esi, esi
je 0x10042e4a
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.1000401a
ret 4
push 0x6998cf
call fcn.1003a42b
mov ecx, dword [ebp - 0x38]
mov eax, dword [ecx]
mov ecx, dword [eax]
mov ecx, dword [ecx]
call fcn.10042603
int3