Function at 0x10014157
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100754fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x17c
push esi
and dword [ebp - 0x64], 0
mov dword [ebp - 0xfc], 0xb0ceafd
mov dword [ebp - 0xe8], 0xca968364
mov dword [ebp - 0x100], 0xb0ae28de
mov dword [ebp - 0xf4], 0xb1510afb
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0x108], 0
push 1
lea ecx, [ebp - 0x138]
call fcn.1001737c
and dword [ebp - 4], 0
mov dword [ebp - 0xdc], 1
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
call fcn.1001404f
add esp, 0xc
lea eax, [ebp - 0xdc]
push eax
push 0x4996
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x71b4
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x138]
push eax
push 0
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.10015451
add esp, 0x2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.10017405
lea ecx, [ebp - 0x188]
call fcn.10017159
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
shr eax, 1
push eax
lea ecx, [ebp - 0x188]
call fcn.10017215
push 3
lea ecx, [ebp - 0x164]
call fcn.1001737c
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c], 0x6aabecba
mov dword [ebp - 0x14c], 0x9f3690f1
mov dword [ebp - 0x3c], 0
jmp 0x10014299
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x100142b5
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x164]
call fcn.1001740a
mov dword [eax], 0x313dd33a
jmp 0x10014292
mov dword [ebp - 0x2c], 0
jmp 0x100142c5
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x100142e7
mov dword [ebp - 0xf8], 0
lea eax, [ebp - 0xf8]
push eax
push 0
call fcn.100153b1
pop ecx
pop ecx
jmp 0x100142be
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x164]
call fcn.10017405
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 0xc]
jae 0x10014a55
mov dword [ebp - 0x10], 0
push 2
lea ecx, [ebp - 0x12c]
call fcn.1001737c
mov byte [ebp - 4], 3
push 0
push 0x1634
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.10015659
add esp, 0x10
mov dword [ebp - 0x10], 0xfffffff5
jmp 0x1001434b
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff3
jge 0x1001446d
mov dword [ebp - 0x58], 5
mov dword [ebp - 0xcc], 0x3e75cb55
mov dword [ebp - 0xc8], 0xb6eab3cf
mov dword [ebp - 0x104], 0x5943e2f7
mov dword [ebp - 0x44], 0
jmp 0x1001438a
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x100143a0
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x154], 0xfffffffa
jmp 0x10014383
mov dword [ebp - 0x58], 0x1fc9
cmp dword [ebp - 0x58], 0
jne 0x10014402
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x100143c7
mov dword [ebp - 0x70], 1
jmp 0x100143cb
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x70], eax
jne 0x100143dc
mov dword [ebp - 0x68], 1
jmp 0x100143e0
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xcc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0xcc], eax
je 0x10014402
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x20f2
jg 0x10014423
mov dword [ebp - 0xa4], 1
jmp 0x1001442a
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x74], eax
push 0
lea ecx, [ebp - 0x12c]
call fcn.1001740a
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
mov eax, 0xc6e5
sub eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0xa4]
jne 0x1001445b
mov dword [ebp - 0x7c], 1
jmp 0x1001445f
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x104], eax
jmp 0x10014344
mov byte [ebp - 0x1a], 0
movzx eax, byte [ebp - 0x1a]
test eax, eax
je 0x10014486
push 0x4ec
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
call fcn.10017405
lea eax, [ebp - 0x50]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0xb905d09e
mov dword [ebp - 0x20], 0xbd29a2a6
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x100144c7
mov dword [ebp - 0xbc], 1
jmp 0x100144ce
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100144f6
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x100144f1
push 1
call fcn.100140c4
pop ecx
jmp 0x10014801
push 2
lea ecx, [ebp - 0xd8]
call fcn.1001737c
mov byte [ebp - 4], 4
mov dword [ebp - 0x40], 0
jmp 0x10014517
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10014533
push dword [ebp - 0x40]
lea ecx, [ebp - 0xd8]
call fcn.1001740a
mov dword [eax], 0xfffffffd
jmp 0x10014510
mov dword [ebp - 0x18], 0
jmp 0x10014543
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x100147b1
mov dword [ebp - 0x54], 0xff529126
mov dword [ebp - 0x38], 0
jmp 0x10014564
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1001457a
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x148], 2
jmp 0x1001455d
mov dword [ebp - 0x14], 0
jmp 0x1001458a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x100147ac
mov dword [ebp - 0xe0], 0xfc331464
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x18], eax
je 0x100145b2
mov dword [ebp - 0x84], 1
jmp 0x100145b9
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x84], eax
jne 0x100145d0
mov dword [ebp - 0xac], 1
jmp 0x100145d7
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xac]
jge 0x100145ee
mov dword [ebp - 0x8c], 1
jmp 0x100145f5
and dword [ebp - 0x8c], 0
cmp dword [ebp - 0x8c], 0xd711a53f
jbe 0x1001460d
mov dword [ebp - 0xc4], 1
jmp 0x10014614
and dword [ebp - 0xc4], 0
push 0
lea ecx, [ebp - 0xd8]
call fcn.1001740a
mov ecx, dword [ebp - 0xc4]
cmp ecx, dword [eax]
jge 0x10014637
mov dword [ebp - 0x94], 1
jmp 0x1001463e
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x94], eax
jl 0x10014655
mov dword [ebp - 0xb4], 1
jmp 0x1001465c
and dword [ebp - 0xb4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0xb4], eax
je 0x1001467d
mov dword [ebp - 0x9c], 1
jmp 0x10014684
and dword [ebp - 0x9c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9c]
neg ecx
add ecx, 0x6c56d20a
cmp dword [ebp + eax - 0x148], ecx
jg 0x100146b3
mov eax, 0x1cc545e2
test eax, eax
je 0x100146b3
mov dword [ebp - 0x6c], 1
jmp 0x100146b7
and dword [ebp - 0x6c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x6c], eax
je 0x100146d1
mov dword [ebp - 0x60], 1
jmp 0x100146d5
and dword [ebp - 0x60], 0
push 0
lea ecx, [ebp - 0xd8]
call fcn.1001740a
mov ecx, dword [ebp - 0x60]
cmp ecx, dword [eax]
je 0x100146f2
mov dword [ebp - 0x78], 1
jmp 0x100146f6
and dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 9
jae 0x1001470e
mov dword [ebp - 0x80], 1
jmp 0x10014712
and dword [ebp - 0x80], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x80], eax
je 0x10014736
cmp dword [ebp - 0x20], 0
je 0x10014736
mov dword [ebp - 0x88], 1
jmp 0x1001473d
and dword [ebp - 0x88], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd8]
call fcn.1001740a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x88]
jle 0x1001477d
mov eax, 0x46aa1dd
test eax, eax
je 0x1001477d
push dword [ebp - 0x14]
lea ecx, [ebp - 0xd8]
call fcn.1001740a
cmp dword [eax], 0
je 0x1001477d
mov dword [ebp - 0x90], 1
jmp 0x10014784
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xe0], eax
push 1
lea ecx, [ebp - 0xd8]
call fcn.1001740a
cmp dword [eax], 0
je 0x100147a7
jmp 0x10014583
jmp 0x10014583
jmp 0x1001453c
mov dword [ebp - 0x20], 0xfffffffe
jmp 0x100147c1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xb
jne 0x100147f2
mov dword [ebp - 0xe4], 0xfffc
push 0x2f0
push 0x1bb0
push 0
call fcn.10014e26
add esp, 0xc
cmp dword [ebp - 0xe4], 0
je 0x100147f0
jmp 0x100147f2
jmp 0x100147ba
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd8]
call fcn.10017405
and dword [ebp - 0x4c], 0
jmp 0x10014815
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x4c], 2
jae 0x1001490e
mov dword [ebp - 0x30], 0xfffffffc
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x1001484b
push 0x476d
push 0x2f98
push 1
push 0x11dc
call fcn.100140f2
add esp, 0x10
mov dword [ebp - 0x30], 0
jmp 0x1001485b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x16
jl 0x100148d2
push 1
lea ecx, [ebp - 0x120]
call fcn.1001737c
mov byte [ebp - 4], 5
mov dword [ebp - 0x34], 0
jmp 0x10014882
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1001489e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x120]
call fcn.1001740a
mov dword [eax], 0xc70c
jmp 0x1001487b
push 0
lea ecx, [ebp - 0x120]
call fcn.1001740a
cmp dword [eax], 0
je 0x100148c1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
call fcn.10017405
jmp 0x100148d2
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
call fcn.10017405
jmp 0x10014854
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x28]
xor edx, edx
div dword [0x1007b830]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
movzx edx, byte [eax + edx]
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
movzx ecx, byte [ecx + eax]
call fcn.10008a33
mov ecx, dword [ebp - 0xec]
add ecx, dword [ebp - 0x4c]
mov byte [ecx], al
jmp 0x10014807
mov dword [ebp - 0x5c], 0xc789
mov dword [ebp - 0x168], 0xffffffff
push 4
lea ecx, [ebp - 0x114]
call fcn.1001737c
mov byte [ebp - 4], 6
mov dword [ebp - 0x98], 0xfffd
mov dword [ebp - 0xa0], 0x289a
mov dword [ebp - 0x48], 0
jmp 0x10014954
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1001496d
push dword [ebp - 0x48]
lea ecx, [ebp - 0x114]
call fcn.1001740a
and dword [eax], 0
jmp 0x1001494d
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x5c], eax
jg 0x10014991
mov dword [ebp - 0xa8], 1
jmp 0x10014998
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xa8]
jl 0x100149b2
mov dword [ebp - 0xb8], 1
jmp 0x100149b9
and dword [ebp - 0xb8], 0
push 3
lea ecx, [ebp - 0x114]
call fcn.1001740a
cmp dword [eax], 0
jne 0x10014a04
mov eax, 0x272b
sub eax, dword [ebp - 0x5c]
cmp eax, 0x4b064ba
je 0x100149e6
mov dword [ebp - 0xb0], 1
jmp 0x100149ed
and dword [ebp - 0xb0], 0
imul eax, dword [ebp - 0xb0], 0x36fe
test eax, eax
je 0x10014a04
and dword [ebp - 0xc0], 0
jmp 0x10014a0e
mov dword [ebp - 0xc0], 1
mov esi, dword [ebp - 0xb8]
add esi, dword [ebp - 0xc0]
add esi, dword [ebp - 0x5c]
push 0
lea ecx, [ebp - 0x114]
call fcn.1001740a
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x114]
call fcn.10017405
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.100156cf
add esp, 0xc
jmp 0x100142fa
lea eax, [ebp - 0x188]
push eax
mov ecx, dword [ebp + 8]
call fcn.1001716c
mov eax, dword [ebp - 0x64]
or eax, 1
mov dword [ebp - 0x64], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.100171b6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret