Function at 0x10010db0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2913
mov eax, dword fs:[0]
push eax
sub esp, 0x410
mov eax, dword [0x100d00b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x390], 0xf
mov dword [ebp - 0x394], 0
mov byte [ebp - 0x3a4], 0
push 0x11
push str.c:Program_Files_
lea ecx, [ebp - 0x3a4]
mov dword [ebp - 4], 0
call fcn.100017d0
call fcn.1000e710
mov edx, eax
cmp byte [edx], 0
jne 0x10010e27
xor ecx, ecx
jmp 0x10010e39
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10010e30
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x3a4]
call fcn.10001a00
push 1
push 0x100bb1b8
lea ecx, [ebp - 0x3a4]
call fcn.10001a00
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100ff5d4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10105828]
cmp eax, dword [ecx + 4]
jle 0x10010eb6
push 0x10105828
call fcn.1006c45f
add esp, 4
cmp dword [0x10105828], 0xffffffff
jne 0x10010eb6
push 0x1c
lea eax, [ebp - 0x3c0]
push eax
push fcn.1000f3f0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x3bc]
push 0x10105828
mov dword [0x1010582c], eax
call fcn.1006c420
add esp, 4
push 0x104
lea eax, [ebp - 0x224]
push eax
push dword [0x1010582c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.10077157
add esp, 8
cmp eax, 0xffffffff
je 0x100110e4
push 0x40
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], 0x44
push 0
push eax
call fcn.1006fa30
add esp, 0xc
mov dword [ebp - 0x348], 0xf
lea ecx, [ebp - 0x35c]
mov dword [ebp - 0x34c], 0
mov byte [ebp - 0x35c], 0
push 0xc
push str.rundll32.exe
call fcn.100017d0
push 0x100bb684
lea edx, [ebp - 0x35c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3bc]
call fcn.10013cc0
add esp, 4
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x38c]
call fcn.1000e020
add esp, 4
push str.___Monitor
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x374]
call fcn.1000e020
add esp, 4
push ebx
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x344]
call fcn.1000e020
mov eax, dword [ebp - 0x360]
add esp, 4
cmp eax, 0x10
jb 0x10010fb6
inc eax
lea ecx, [ebp - 0x374]
push eax
push dword [ebp - 0x374]
call fcn.10001ca0
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x360], 0xf
mov dword [ebp - 0x364], 0
mov byte [ebp - 0x374], 0
cmp eax, 0x10
jb 0x10010fef
inc eax
lea ecx, [ebp - 0x38c]
push eax
push dword [ebp - 0x38c]
call fcn.10001ca0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x378], 0xf
mov dword [ebp - 0x37c], 0
mov byte [ebp - 0x38c], 0
cmp eax, 0x10
jb 0x10011028
inc eax
lea ecx, [ebp - 0x3bc]
push eax
push dword [ebp - 0x3bc]
call fcn.10001ca0
cmp dword [edi + 0x5c], 0x10
lea ecx, [edi + 0x48]
mov eax, 1
mov dword [ebp - 0x3e0], 1
mov word [ebp - 0x3dc], ax
jb 0x10011049
mov ecx, dword [ecx]
cmp dword [ebp - 0x330], 0x10
lea edx, [ebp - 0x41c]
push edx
lea edx, [ebp - 0x40c]
push edx
push ecx
push 0
push 0x10
push 0
push 0
lea eax, [ebp - 0x344]
cmovae eax, dword [ebp - 0x344]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [ebp - 0x330]
setne bl
cmp eax, 0x10
jb 0x100110a2
inc eax
lea ecx, [ebp - 0x344]
push eax
push dword [ebp - 0x344]
call fcn.10001ca0
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x330], 0xf
mov dword [ebp - 0x334], 0
mov byte [ebp - 0x344], 0
cmp eax, 0x10
jb 0x10011357
inc eax
lea ecx, [ebp - 0x35c]
push eax
push dword [ebp - 0x35c]
call fcn.10001ca0
jmp 0x10011357
lea ecx, [ebp - 0x32c]
call fcn.1000f460
xor ecx, ecx
mov al, byte [ebp + ecx - 0x32c]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x11d], al
test al, al
jne 0x100110f1
lea ecx, [ebp - 0x11c]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10011110
mov eax, dword [0x100bb688]
mov dword [ecx], eax
mov eax, dword [0x100bb68c]
mov dword [ecx + 4], eax
mov al, byte [0x100bb690]
mov byte [ecx + 8], al
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.10077157
add esp, 8
cmp eax, 0xffffffff
je 0x1001133b
push 0x40
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], 0x44
push 0
push eax
call fcn.1006fa30
add esp, 0xc
mov dword [ebp - 0x348], 0xf
lea ecx, [ebp - 0x35c]
mov dword [ebp - 0x34c], 0
mov byte [ebp - 0x35c], 0
push 0xc
push str.rundll32.exe
call fcn.100017d0
push 0x100bb4d4
lea edx, [ebp - 0x35c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3bc]
call fcn.10013cc0
add esp, 4
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0x374]
call fcn.1000e020
add esp, 4
push str.__Monitor
mov edx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x38c]
call fcn.1000e020
add esp, 4
push ebx
mov edx, eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x344]
call fcn.1000e020
mov eax, dword [ebp - 0x378]
add esp, 4
cmp eax, 0x10
jb 0x10011219
inc eax
lea ecx, [ebp - 0x38c]
push eax
push dword [ebp - 0x38c]
call fcn.10001ca0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x378], 0xf
mov dword [ebp - 0x37c], 0
mov byte [ebp - 0x38c], 0
cmp eax, 0x10
jb 0x10011252
inc eax
lea ecx, [ebp - 0x374]
push eax
push dword [ebp - 0x374]
call fcn.10001ca0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x360], 0xf
mov dword [ebp - 0x364], 0
mov byte [ebp - 0x374], 0
cmp eax, 0x10
jb 0x1001128b
inc eax
lea ecx, [ebp - 0x3bc]
push eax
push dword [ebp - 0x3bc]
call fcn.10001ca0
cmp dword [ebp - 0x330], 0x10
lea ecx, [ebp - 0x41c]
push ecx
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x3e0], 1
push ecx
lea ecx, [ebp - 0x32c]
mov eax, 1
push ecx
push 0
push 0x10
push 0
mov word [ebp - 0x3dc], ax
lea eax, [ebp - 0x344]
cmovae eax, dword [ebp - 0x344]
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov eax, dword [ebp - 0x330]
setne bl
cmp eax, 0x10
jb 0x10011300
inc eax
lea ecx, [ebp - 0x344]
push eax
push dword [ebp - 0x344]
call fcn.10001ca0
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x330], 0xf
mov dword [ebp - 0x334], 0
mov byte [ebp - 0x344], 0
cmp eax, 0x10
jb 0x10011357
inc eax
lea ecx, [ebp - 0x35c]
push eax
push dword [ebp - 0x35c]
call fcn.10001ca0
jmp 0x10011357
lea eax, [ebp - 0x11c]
push eax
push str.cant_find_core.dll__s__n
call fcn.1000e190
push eax
call fcn.1000b0b0
add esp, 0xc
xor bl, bl
mov ecx, dword [ebp - 0x390]
cmp ecx, 0x10
jb 0x10011375
inc ecx
push ecx
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x3a4]
call fcn.10001ca0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006c2b1
mov esp, ebp
pop ebp
ret 4