Function at 0x1000a7a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b0
mov eax, dword [0x10076610]
xor eax, ebp
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x688], ax
push 0x206
push 0
lea ecx, [ebp - 0x686]
push ecx
call fcn.1004e4c0
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x1000a7fc
lea edx, [ebp - 0x688]
push edx
call fcn.1000a1f0
add esp, 4
test eax, eax
jne 0x1000a7f7
jmp 0x1000aabc
jmp 0x1000a8fc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x894], eax
mov ecx, dword [ebp - 0x894]
add ecx, 2
mov dword [ebp - 0x898], ecx
mov edx, dword [ebp - 0x894]
mov ax, word [edx]
mov word [ebp - 0x89a], ax
add dword [ebp - 0x894], 2
cmp word [ebp - 0x89a], 0
jne 0x1000a814
mov ecx, dword [ebp - 0x894]
sub ecx, dword [ebp - 0x898]
sar ecx, 1
mov dword [ebp - 0x8a0], ecx
mov dword [ebp - 0x8a4], str.AliyunWrapExe.Exe
mov edx, dword [ebp - 0x8a4]
add edx, 2
mov dword [ebp - 0x8a8], edx
mov eax, dword [ebp - 0x8a4]
mov cx, word [eax]
mov word [ebp - 0x8aa], cx
add dword [ebp - 0x8a4], 2
cmp word [ebp - 0x8aa], 0
jne 0x1000a862
mov edx, dword [ebp - 0x8a4]
sub edx, dword [ebp - 0x8a8]
sar edx, 1
mov dword [ebp - 0x8b0], edx
mov eax, 0x104
sub eax, dword [ebp - 0x8b0]
sub eax, 2
cmp dword [ebp - 0x8a0], eax
jb 0x1000a8b2
jmp 0x1000aabc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x688]
push edx
call fcn.1004b0c1
add esp, 0xc
push 0x1007282c
push 0x104
lea eax, [ebp - 0x688]
push eax
call fcn.1004cde1
add esp, 0xc
push 0x10072830
push 0x104
lea ecx, [ebp - 0x688]
push ecx
call fcn.1004cde1
add esp, 0xc
xor edx, edx
mov word [ebp - 0x478], dx
push 0x40e
push 0
lea eax, [ebp - 0x476]
push eax
call fcn.1004e4c0
add esp, 0xc
lea ecx, [ebp - 0x688]
push ecx
push 0x208
lea edx, [ebp - 0x478]
push edx
call fcn.1004b0c1
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x1000a96e
push 0x10072854
push 0x208
lea eax, [ebp - 0x478]
push eax
call fcn.1004cde1
add esp, 0xc
push 0x10072858
push 0x208
lea ecx, [ebp - 0x478]
push ecx
call fcn.1004cde1
add esp, 0xc
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea edx, [ebp - 0x5c]
push edx
call fcn.1004e4c0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 7
xor eax, eax
mov word [ebp - 0x30], ax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
xor edx, edx
mov word [ebp - 0x890], dx
push 0x206
push 0
lea eax, [ebp - 0x88e]
push eax
call fcn.1004e4c0
add esp, 0xc
lea ecx, [ebp - 0x890]
push ecx
call fcn.1000b220
add esp, 4
test eax, eax
jne 0x1000a9fe
jmp 0x1000aabc
mov dword [ebp - 0x47c], 0
lea edx, [ebp - 0x47c]
push edx
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000aa6f
cmp dword [ebp - 0x47c], 0
je 0x1000aa6f
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x890]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x478]
push eax
push 0
mov ecx, dword [ebp - 0x47c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x47c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000aa9a
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x890]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x478]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000aab4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jne 0x1000a7ba
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.1004b0b2
mov esp, ebp
pop ebp
ret