Function at 0x10001f60
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10185996
push eax
mov eax, dword [0x101f1d98]
mov dword fs:[0], esp
sub esp, 0xc9c
push esi
xor esi, esi
cmp eax, esi
je 0x10001fa0
push str.CreateRunPro32A_______
push str.GetTxt
push 0xffffffffffffffff
push 0x101f1d2c
call fcn.100066b0
add esp, 0x10
push ebx
mov ebx, dword [esp + 0xcb4]
push ebp
cmp ebx, esi
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], esi
je 0x10002301
mov ebp, dword [esp + 0xcc0]
cmp ebp, esi
je 0x10002301
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x38], 0x44
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], eax
mov ecx, 0x103
mov dword [esp + 0x28], eax
lea edi, [esp + 0x48e]
mov dword [esp + 0x2c], eax
mov word [esp + 0x48c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x89e]
mov word [esp + 0x89c], si
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], esi
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea ecx, [esp + 0x89c]
push esi
push ebp
push ebx
push str._s___s___d___s___t___lu_
push ecx
call fcn.1005474c
add esp, 0x14
call fcn.10069d80
mov ebp, eax
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x7e]
mov word [esp + 0x7c], bx
rep stosd dword es:[edi], eax
push esi
push str.TEC_OCULAR__AGENT_V3_EVENT_NO_MEMORY_NOTIFY
lea edx, [esp + 0x84]
push str._s__lu
push edx
stosw word es:[edi], ax
call fcn.1005474c
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x296]
mov word [esp + 0x294], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x294]
push 0x104
lea ecx, [esp + 0x90]
push eax
push ecx
call fcn.10013160
add esp, 0x1c
lea edx, [esp + 0x284]
push edx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
test ebx, ebx
je 0x100022e3
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x7c]
push esi
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x288]
rep stosd dword es:[edi], eax
push 0x101ae500
lea eax, [esp + 0x84]
push str._s__lu
push eax
call fcn.1005474c
lea ecx, [esp + 0x294]
push 0x104
lea edx, [esp + 0x90]
push ecx
push edx
call fcn.10013160
add esp, 0x1c
lea eax, [esp + 0x284]
xor edi, edi
push eax
push edi
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
cmp esi, edi
je 0x100022ed
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.10010030
push eax
lea ecx, [esp + 0x18]
call fcn.10032fc0
push 0x101ae4fc
lea ecx, [esp + 0x18]
mov dword [esp + 0xcb8], edi
call fcn.10036fd0
push 0x101ae4fc
lea ecx, [esp + 0x18]
call fcn.100343b0
push str.winrdlv3.exe
lea ecx, [esp + 0x18]
call fcn.100343b0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x89c]
push ecx
push str.TksRunProcW
push str.TksFrame32.dll
push edx
lea eax, [esp + 0x49c]
push str._s__s__s__s
push eax
call fcn.1005474c
add esp, 0x18
lea ecx, [esp + 0x48c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.10032fc0
mov eax, dword [0x101f1d98]
mov byte [esp + 0xcb4], 1
cmp eax, edi
je 0x100021f3
mov edx, dword [esp + 0x18]
or ebp, 0xffffffff
push edx
push str.CreateRunPro32A__cmd___s_
push str.GetTxt
push ebp
push 0x101f1d2c
call fcn.100066b0
add esp, 0x14
jmp 0x100021f6
or ebp, 0xffffffff
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push eax
push ecx
push edi
push edi
push edi
push edi
push edi
lea edx, [esp + 0x4a8]
push edi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
je 0x100022f7
mov eax, dword [esp + 0x20]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov eax, dword [esp + 0xcc4]
mov ecx, dword [esp + 0x20]
cmp eax, edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ebx
jne 0x10002246
mov eax, 0x1b7740
push eax
lea edx, [esp + 0x34]
push edi
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
dec eax
je 0x1000228a
sub eax, 0x101
jne 0x10002273
mov eax, dword [esp + 0x20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0x10], 9
push 1
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100022a0
mov dword [esp + 0x1c], 1
jmp 0x100022ac
mov ecx, dword [esp + 0x20]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esp + 0x10], 0xa
jmp 0x100022c0
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x1c], edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebp
je 0x100022b9
push esi
call edi
cmp ebx, ebp
je 0x100022c0
push ebx
call edi
lea ecx, [esp + 0x18]
mov byte [esp + 0xcb4], 0
call fcn.10033760
lea ecx, [esp + 0x14]
mov dword [esp + 0xcb4], ebp
call fcn.10033760
jmp 0x10002309
mov dword [esp + 0x10], 2
jmp 0x10002309
mov dword [esp + 0x10], 3
jmp 0x10002309
mov dword [esp + 0x10], 4
jmp 0x100022c0
mov dword [esp + 0x10], 1
mov eax, dword [0x101f1d98]
pop edi
pop ebp
pop ebx
test eax, eax
je 0x10002350
mov edx, dword [esp + 4]
mov esi, dword [esp + 0x10]
push edx
push esi
push str.CreateRunPro32A______d_____d_
push str.GetTxt
push 0xffffffffffffffff
push 0x101f1d2c
call fcn.100066b0
add esp, 0x18
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc9c]
mov dword fs:[0], ecx
add esp, 0xca8
ret
mov ecx, dword [esp + 0xca0]
mov eax, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0xca8
ret