Function at 0x10060dd0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1012fd08
mov eax, dword fs:[0]
push eax
sub esp, 0x5d4
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x5d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x5e8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5fc]
mov ebp, dword [esp + 0x5f8]
mov esi, ecx
mov dword [esp + 0x24], eax
mov ebx, edx
call fcn.100680e0
cmp byte [eax + 0xb72], 0
je 0x1006103b
cmp byte [0x1016c4b0], 0
jne 0x1006103b
test ebx, ebx
je 0x10060efd
mov ecx, ebx
mov eax, 0x10144048
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10060e76
test dx, dx
je 0x10060e72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10060e76
add eax, 4
add ecx, 4
test dx, dx
jne 0x10060e50
xor eax, eax
jmp 0x10060e7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10060efd
lea ecx, [esp + 0x274]
call fcn.1005f360
push esi
lea ebx, [esp + 0x278]
mov dword [esp + 0x5f4], 0
call fcn.10060ca0
cmp dword [esp + 0x278], 0
mov cl, byte [esp + 0x390]
mov edx, dword [esp + 0x27c]
jne 0x10060ebf
xor ebx, ebx
jmp 0x10060ecf
lea eax, [esp + 0x280]
test cl, cl
jne 0x10060ecc
mov eax, edx
lea ebx, [eax + 4]
mov dword [esp + 0x5f0], 0xffffffff
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
test cl, cl
jne 0x10060efd
lea ecx, [esp + 0x280]
cmp edx, ecx
je 0x10060efd
push edx
call fcn.100cf89b
add esp, 4
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x10060f0c
mov eax, dword [esi + 8]
add eax, 4
mov dword [esp + 0x18], eax
call fcn.1005ef50
mov dword [esp + 0x1c], 0xffffffff
mov byte [esp + 0x20], 1
mov edi, 1
mov ecx, esi
mov dword [esp + 0x5f0], edi
call fcn.1005fc30
test al, al
je 0x10060f46
mov byte [esp + 0x20], 0
jmp 0x1006107a
call fcn.100680e0
cmp byte [eax + 1], 0
mov ecx, esi
je 0x10061067
call fcn.1005fc30
test al, al
jne 0x10060fc5
mov ecx, esi
call fcn.1005fc00
test al, al
jne 0x10060fc5
mov eax, esi
mov dword [esp + 0x1c], edi
call fcn.10062c60
lea edi, [esp + 0x150]
mov esi, eax
call fcn.10062500
mov eax, esi
mov edx, edi
call fcn.10062710
push 0x101452e0
mov ecx, ebp
mov byte [esp + 0x5f4], 3
call fcn.100619a0
mov esi, eax
mov eax, edi
call fcn.10062310
mov ecx, edi
call fcn.1005f910
mov dword [esp + 0x5f0], 0xffffffff
call fcn.1005ef50
xor al, al
jmp 0x1006103d
cmp byte [esi + 0x11c], 0
je 0x10060fd3
add esi, 0xc
jmp 0x10060fd6
mov esi, dword [esi + 8]
add esi, 4
push esi
lea ecx, [esp + 0x3a0]
call fcn.1006d0a0
mov edx, dword [esp + 0x24]
push 5
push ebx
push edx
push 0
mov edx, ebp
lea ecx, [esp + 0x3ac]
mov byte [esp + 0x600], 4
call fcn.1006d3e0
test al, al
jne 0x10061013
mov ecx, ebp
call fcn.100619f0
jmp 0x10061018
mov byte [esp + 0x20], 0
lea eax, [esp + 0x39c]
call fcn.100611d0
mov dword [esp + 0x5f0], 0xffffffff
cmp byte [esp + 0x20], 0
je 0x1006103b
call fcn.1005ef50
mov al, 1
mov ecx, dword [esp + 0x5e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5d0]
xor ecx, esp
call fcn.100cf604
add esp, 0x5e0
ret 8
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.10061790
test al, al
je 0x10060fb1
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x10061089
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x24]
push 5
push ebx
push ecx
add eax, 4
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp ebx, 0x20
jg 0x10061024
cmp byte [esi + 0x11c], 0
mov dword [esp + 0x1c], 0
je 0x100610c3
add esi, 0xc
jmp 0x100610c6
mov esi, dword [esi + 8]
lea edi, [esp + 0x274]
call fcn.10062500
lea eax, [esi + 4]
mov edx, edi
call fcn.10062710
push 0x10145300
lea edi, [esp + 0x30]
call fcn.10062630
mov esi, eax
push ebx
push 0x1013f9d8
mov edx, esi
mov byte [esp + 0x5f8], 7
call fcn.10062cd0
push 0x10145290
push 0x1013c7e4
mov edx, esi
call fcn.10062cd0
add esp, 0x10
cmp byte [esi + 0x11c], 0
je 0x10061123
add esi, 0xc
jmp 0x10061126
mov esi, dword [esi + 8]
add esi, 4
push esi
mov ecx, ebp
call fcn.100619a0
mov esi, eax
lea eax, [esp + 0x278]
call fcn.10062310
cmp byte [esp + 0x148], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x2c], esi
jne 0x10061167
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x38]
cmp eax, edx
je 0x10061167
push eax
call fcn.100cf89b
add esp, 4
mov byte [esp + 0x5f0], 1
cmp byte [esp + 0x390], 0
mov dword [esp + 0x274], esi
jne 0x1006119b
mov eax, dword [esp + 0x27c]
lea ecx, [esp + 0x280]
cmp eax, ecx
je 0x1006119b
push eax
call fcn.100cf89b
add esp, 4
mov eax, ebx
mov esi, ebp
call fcn.1006cee0
mov dword [esp + 0x5f0], 0xffffffff
cmp byte [esp + 0x20], 0
je 0x100611bb
call fcn.1005ef50
xor al, al
jmp 0x1006103d