Function at 0x10360110
Capabilities:
Create pipe
Create process on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
push ebx
push ebp
mov ebp, dword [esp + 0x8c]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
mov edx, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], ebx
test ebp, ebp
jne 0x1036013b
xor eax, eax
jmp 0x103603e6
push esi
mov esi, ebp
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10360141
sub esi, ecx
lea eax, [esi - 1]
cmp eax, 1
ja 0x103603e3
mov ecx, edi
test esi, esi
jle 0x10360178
mov al, byte [edx]
cmp al, 0x72
je 0x10360172
cmp al, 0x77
je 0x10360172
cmp al, 0x62
je 0x10360172
cmp al, 0x74
jne 0x103603e3
inc edx
inc ecx
cmp ecx, esi
jl 0x1036015c
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], edi
test esi, esi
je 0x103603e3
push 0x800
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x103603e3
push 0x44
lea eax, [esp + 0x4c]
push edi
push eax
call sub.MSVCR110.dll_memset
xor eax, eax
lea edi, [esp + 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0xfffffffffffffff4
stosd dword es:[edi], eax
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 0x100
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0x88], eax
xor eax, eax
cmp byte [ebp], 0x72
sete al
mov dword [esp + 0x28], eax
cmp esi, 2
jne 0x1036020c
cmp byte [ebp + 1], 0x62
mov edi, 0x8000
je 0x10360211
mov edi, 0x4000
test eax, eax
je 0x10360237
mov ecx, dword [esp + 0x14]
call fcn.10360060
push 0xfffffffffffffff6
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x10]
jmp 0x10360257
mov ecx, dword [esp + 0x10]
call fcn.10360060
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff5
mov dword [esp + 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0x20
pop esi
push 4
push 0x10622124
push dword [sym.php5.dll_sapi_module]
mov dword [esp + 0x90], eax
call sub.MSVCR110.dll_memcmp
add esp, 0xc
test eax, eax
lea eax, [esp + 0x1c]
push eax
mov ecx, 0x8000020
push 1
cmovne esi, ecx
push 0xf01ff
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x103602c0
lea eax, [esp + 0x18]
push eax
push 1
push 2
lea eax, [esp + 0x38]
push eax
push 0x2000000
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x103602d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x3f0
cmove ebx, ecx
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x90]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x103602de
mov esi, dword [0x106606e8]
sub ecx, edx
mov edx, esi
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x103602f2
sub edx, ebx
lea eax, [ecx + 7]
add eax, edx
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x103603e3
push dword [esp + 0x90]
push esi
push str._s__c___s_
push ebx
call sym.php5.dll_php_sprintf
add esp, 0x10
cmp dword [esp + 0x20], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0xa0]
lea eax, [esp + 0x38]
push dword [esp + 0xa8]
push dword [esp + 0x34]
push dword [esp + 0x48]
push eax
push eax
push ebx
push 0
je 0x10360374
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
push dword [esp + 0x18]
mov dword [esp + 0x28], eax
call esi
jmp 0x1036037e
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0x24], eax
push ebx
call dword [sym.imp.MSVCR110.dll_free]
cmp dword [esp + 0x28], 0
pop ecx
je 0x103603e3
push dword [esp + 0x3c]
call esi
xor ecx, ecx
call fcn.103603f0
cmp dword [esp + 0x28], 0
mov ebx, eax
je 0x103603b6
push edi
push dword [esp + 0x18]
call dword [sym.imp.MSVCR110.dll__open_osfhandle]
pop ecx
pop ecx
push dword [esp + 0x10]
jmp 0x103603ca
or edi, 1
push edi
push dword [esp + 0x14]
call dword [sym.imp.MSVCR110.dll__open_osfhandle]
pop ecx
pop ecx
push dword [esp + 0x14]
mov edi, eax
call esi
push ebp
push edi
call dword [sym.imp.MSVCR110.dll__fdopen]
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
mov dword [ebx + 4], ecx
mov dword [ebx], eax
jmp 0x103603e5
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x7c
ret