Function at 0x1032973
Capabilities:
Create process on windows

Disassembly:
push 0x78
mov eax, 0x105ed06
call fcn.0104f320
xor edi, edi
push 0x1002db8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
call fcn.01031665
push 0x1068adc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.010309e3
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov eax, dword [ebp + 0x10]
mov esi, 0x1068968
mov ecx, esi
mov byte [ebp - 4], 4
mov dword [eax], 0x80004005
call fcn.0103a4cd
cmp eax, edi
je 0x10329d8
push 0x1002d98
lea ecx, [ebp - 0x14]
call fcn.01031508
mov ecx, esi
call fcn.0103a50c
cmp eax, edi
je 0x10329f0
push 0x1002d70
lea ecx, [ebp - 0x14]
call fcn.01031508
mov ecx, esi
call fcn.0103a515
cmp eax, edi
je 0x1032a08
push 0x1002d48
lea ecx, [ebp - 0x14]
call fcn.01031508
mov ecx, esi
call fcn.0103a503
cmp eax, edi
je 0x1032a20
push 0x1002d20
lea ecx, [ebp - 0x14]
call fcn.01031508
mov ecx, esi
call fcn.0103a4e8
cmp eax, edi
je 0x1032a38
push 0x1002d08
lea ecx, [ebp - 0x14]
call fcn.01031508
mov ecx, esi
call fcn.0103a498
cmp eax, edi
je 0x1032a50
push 0x1002cf0
lea ecx, [ebp - 0x14]
call fcn.01031508
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0103a5ce
cmp eax, edi
je 0x1032a73
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 0x1002cd8
push eax
call fcn.01031549
add esp, 0xc
mov ecx, esi
call fcn.0103a4df
cmp eax, edi
je 0x1032a8b
push 0x1002cb8
lea ecx, [ebp - 0x14]
call fcn.01031508
mov ecx, esi
call fcn.0103a4a1
cmp eax, edi
je 0x1032aa3
push 0x1002ca8
lea ecx, [ebp - 0x14]
call fcn.01031508
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0103a635
cmp eax, edi
je 0x1032ac6
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 0x1002c88
push eax
call fcn.01031549
add esp, 0xc
mov ecx, esi
call fcn.0103a4f1
cmp eax, edi
je 0x1032ade
push 0x1002c70
lea ecx, [ebp - 0x14]
call fcn.01031508
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0103a4aa
cmp eax, edi
je 0x1032b01
push dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
push 0x1002c4c
push eax
call fcn.01031549
add esp, 0xc
mov ecx, esi
call fcn.0103a4fa
cmp eax, edi
je 0x1032b19
push 0x1002c3c
lea ecx, [ebp - 0x14]
call fcn.01031508
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x14]
push 0x1002c20
push eax
call fcn.01031549
add esp, 0xc
push 0x1068880
lea ecx, [ebp - 0x18]
call fcn.01031394
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.0103145e
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 0x1002c00
push eax
call fcn.01031549
add esp, 0xc
push 0x44
pop esi
push esi
lea eax, [ebp - 0x84]
push edi
push eax
call sub.msvcrt.dll_memset
push dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x48], edi
xor eax, eax
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx]
push eax
mov edi, 0x1002678
push edi
mov dword [ebp - 0x84], esi
push 0x1002bd8
mov esi, 0x4000000
push esi
mov dword [ebp - 0x58], 0x100
call fcn.0104a7da
mov eax, dword [ebx]
add esp, 0x20
lea ecx, [ebp - 0x14]
mov dword [ebp + 0xc], eax
call fcn.0103080d
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x84]
push ecx
xor ecx, ecx
push ecx
push ecx
push 0x8000000
push ecx
push ecx
push ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov dword [ebp + 0xc], eax
call fcn.010309b9
cmp dword [ebp + 0xc], 0
jne 0x1032c47
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x1032bfd
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x1032c0b
mov dword [ebp - 0x1c], 0x80004005
push dword [ebp - 0x14]
mov ebx, dword [ebx]
push ebx
push 0x1002b58
push 0x1002b40
call esi
push eax
call fcn.0104a5f6
add esp, 0x14
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.010303ce
mov eax, dword [ebp - 0x1c]
call fcn.0104f3d4
ret 0xc
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
push 0xffffffffffffffff
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1032cc9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x1032c83
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x1032c91
mov dword [ebp - 0x1c], 0x80004005
push 0x1002ae8
push 0x1002ad0
call esi
push eax
call fcn.0104a5f6
add esp, 0xc
test ebx, ebx
je 0x1032cb2
lea ecx, [ebp - 0x24]
call fcn.010303b2
cmp dword [ebp - 0x20], 0
je 0x1032c26
lea ecx, [ebp - 0x20]
call fcn.010303b2
jmp 0x1032c26
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
push eax
push edi
push 0x1002aa8
push esi
mov dword [ecx], eax
call fcn.0104a7da
add esp, 0x10
jmp 0x1032ca6