Function at 0x10099c7
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x100d608]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x890], esi
cmp dword [ebx + 0x350], esi
jne 0x1009a7f
push dword [0x100d908]
lea ecx, [ebp - 0x114]
push 0x112
call fcn.01006328
push dword [0x100d908]
mov edi, dword [eax + 0x104]
push 0x113
lea ecx, [ebp - 0x9c4]
call fcn.01006328
push esi
push 0xfffd
push 0x20
push esi
push edi
push dword [eax + 0x104]
push dword [0x100d908]
push esi
call dword [fcn.01001cfc]
mov esi, 0x10017c8
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x9c4], esi
call fcn.01004813
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], esi
call fcn.01004813
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100a24f
leave
ret 4
lea eax, [ebp - 0x444]
push eax
mov ecx, ebx
call fcn.010095c6
mov dword [ebp - 0x898], esi
mov esi, ebx
lea edi, [ebp - 0x8b4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x898]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x8b4]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, 0x10017c8
test eax, eax
jl 0x1009aff
cmp dword [ebp - 0x898], 0
je 0x1009aff
push dword [ebp - 0x898]
lea ecx, [ebp - 0x9c4]
call fcn.01005d94
push eax
lea ecx, [ebp - 0x444]
call fcn.01006371
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x9c4], esi
call fcn.01004813
push dword [ebp - 0x898]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edi, edi
inc edi
push edi
push 0
lea ecx, [ebp - 0x8a4]
call fcn.01007eb7
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x114]
call fcn.01005dda
push eax
lea eax, [ebp - 0x9c4]
push eax
call fcn.01007757
mov eax, dword [eax + 0x104]
push edi
push eax
lea ecx, [ebp - 0x8a4]
call fcn.01007432
cmp eax, 2
lea ecx, [ebp - 0x9c4]
sete byte [ebp - 0x891]
mov dword [ebp - 0x9c4], esi
call fcn.01004813
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], esi
call fcn.01004813
cmp byte [ebp - 0x891], 0
je 0x1009bc3
lea ecx, [ebp - 0x8a4]
call fcn.01003a8e
mov edi, eax
test edi, edi
je 0x1009f1c
mov eax, dword [edi]
test eax, eax
je 0x1009ba5
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009ba5
push dword [edi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [ebp - 0x89c], 0
je 0x1009f1c
push dword [ebp - 0x8a4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x1009f1c
lea ecx, [ebp - 0x664]
call fcn.01005f64
cmp dword [ebx + 0x350], edi
jne 0x1009bec
push dword [ebx + 0x35c]
lea ecx, [ebp - 0x664]
call fcn.01006943
jmp 0x1009cbd
lea ecx, [ebp - 0x888]
call fcn.01005f64
lea eax, [ebp - 0x8a4]
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x88c]
push eax
push 0x100990f
mov dword [ebp - 0x88c], ebx
xor ebx, ebx
push ebx
push 0x67
push dword [0x100d908]
call fcn.0100b0cc
cmp eax, edi
jne 0x1009c3d
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x664]
call fcn.01006943
jmp 0x1009ca6
cmp eax, 2
jne 0x1009c7b
lea ecx, [ebp - 0x888]
call fcn.010057fc
lea ecx, [ebp - 0x664]
call fcn.010057fc
lea ecx, [ebp - 0x8a4]
call fcn.010039d0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x444], esi
call fcn.01004813
mov eax, edi
jmp 0x1009a6e
cmp eax, 0xffffffff
jne 0x1009c9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1009c94
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x890], eax
jmp 0x1009ca6
mov dword [ebp - 0x890], 0x80004005
lea ecx, [ebp - 0x888]
call fcn.010057fc
cmp dword [ebp - 0x890], ebx
jl 0x1009dce
lea ecx, [ebp - 0x664]
call fcn.0100959b
test al, al
je 0x1009db6
push 0x40
lea eax, [ebp - 0xa04]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9c4]
push eax
lea ecx, [ebp - 0x664]
mov dword [ebp - 0xa08], 0x44
call fcn.01005fac
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.01007757
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x9c4], esi
call fcn.01004813
lea ecx, [ebp - 0x224]
call fcn.010046ed
test eax, eax
je 0x1009d99
and dword [ebp - 0x8b4], 0
xor eax, eax
lea edi, [ebp - 0x8b0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x8b4]
push eax
xor edi, edi
lea eax, [ebp - 0xa08]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x120]
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1009d7d
push dword [ebp - 0x8b4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x8b0]
call edi
jmp 0x1009da3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1009d91
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x890], eax
jmp 0x1009da3
mov dword [ebp - 0x890], 0x8007000e
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], esi
call fcn.01004813
jmp 0x1009dc0
mov dword [ebp - 0x890], 0x80004005
xor ebx, ebx
cmp dword [ebp - 0x890], ebx
jge 0x1009f11
lea ecx, [ebp - 0x224]
call fcn.01005e26
push dword [ebp - 0x890]
lea eax, [ebp - 0x114]
push eax
call fcn.0100a889
lea eax, [ebp - 0x664]
push eax
lea ecx, [ebp - 0x9c4]
call fcn.01005dda
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x334]
push eax
call fcn.01007757
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x9c4], esi
call fcn.01004813
lea ecx, [ebp - 0x334]
call fcn.010046ed
test eax, eax
jne 0x1009e46
push dword [0x100d908]
lea ecx, [ebp - 0x334]
push 0x111
call fcn.01005cec
lea ecx, [ebp - 0x114]
call fcn.010046ed
test eax, eax
lea eax, [ebp - 0x224]
je 0x1009e7a
push dword [ebp - 0x10]
push dword [ebp - 0x230]
push dword [0x100d908]
push 0x10f
push eax
call fcn.010095e6
add esp, 0x14
jmp 0x1009e94
push dword [ebp - 0x230]
push dword [0x100d908]
push 0x110
push eax
call fcn.010095e6
add esp, 0x10
push dword [0x100d908]
mov edi, dword [ebp - 0x120]
push 0x10e
lea ecx, [ebp - 0x9c4]
call fcn.01006328
push ebx
push 0xfffe
push 0x20
push ebx
push edi
push dword [eax + 0x104]
push dword [0x100d908]
push ebx
call dword [fcn.01001cfc]
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x9c4], esi
call fcn.01004813
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x334], esi
call fcn.01004813
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], esi
call fcn.01004813
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], esi
call fcn.01004813
lea ecx, [ebp - 0x664]
call fcn.010057fc
mov edi, dword [ebp - 0x890]
jmp 0x1009c58