Function at 0x100526f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100bf198]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x100bea44]
imul eax, dword [0x100bea48]
xor eax, 0x88baca1e
mov ecx, 0x5f2e1f82
xor edx, edx
div ecx
add eax, 0xf56d6599
mov ecx, 0xc747443a
xor edx, edx
div ecx
or eax, 0x51bf6f62
imul eax, eax, 0x4bee830
xor eax, 0x1cb507f3
add eax, 0x8e0adc53
add eax, 0x2c4f5002
mov ecx, 0x1b27eec4
xor edx, edx
div ecx
or eax, 0xaabe72c8
imul eax, eax, 0x824b47e
or eax, 0xcad09543
or eax, 0x13bbf5fd
add eax, 0xec3b757e
sub eax, 0xbae4b20f
or eax, 0x25e7929b
and eax, 0xbceca987
and eax, 0x67f6a69a
sub eax, 0xe4e8e050
sub eax, 0x612a346
or eax, 0x8923dcb1
imul eax, eax, 0x9507f794
sub eax, 0x23d3f548
imul eax, eax, 0x5b8bf123
or eax, 0x7286009e
xor eax, 0xc1ed8f18
or eax, 0x85532e06
imul eax, eax, 0x774dd2e3
mov ecx, 0x4a6a947d
xor edx, edx
div ecx
xor eax, 0xf20675c7
mov ecx, 0x879804e1
xor edx, edx
div ecx
imul eax, eax, 0x4679f636
imul eax, eax, 0x57e2ad95
mov ecx, 0xd94702f8
xor edx, edx
div ecx
and eax, 0xafbe39b6
or eax, 0xb528c9d5
mov ecx, 0x65e172de
xor edx, edx
div ecx
add eax, 0x674ae110
imul eax, eax, 0xb7105fe9
and eax, 0x1eb612cc
add eax, 0xb5e5556e
or eax, 0x616a2383
imul eax, eax, 0x24977652
mov ecx, 0x3f3ea938
xor edx, edx
div ecx
and eax, 0xc9cbeb94
xor eax, 0xcaa3035c
xor eax, 0xc280ab8c
sub eax, 0x3d16c72c
mov ecx, 0xd07ad679
xor edx, edx
div ecx
sub eax, 0xf5506097
imul eax, eax, 0xbc9cbbd1
xor eax, 0x19799d55
or eax, 0xe7de7452
add eax, 0x73908570
xor eax, 0x69ed2f3d
mov ecx, 0xd4aef14b
xor edx, edx
div ecx
or eax, 0x579271cb
sub eax, 0xc52c775
imul eax, eax, 0xc3184078
and eax, 0x17fd0ef7
mov ecx, 0x1376c88
xor edx, edx
div ecx
xor eax, 0xe0ebfa9d
imul eax, eax, 0x12c4447a
add eax, 0x257a774
mov ecx, 0x6098cbc0
xor edx, edx
div ecx
xor eax, 0xc2c8103b
and eax, 0xc17d958f
and eax, 0x33a64e1f
sub eax, 0xe6c4e3b0
add eax, 0xf16ec0e2
sub eax, 0x1f2bb8fb
cmp eax, 0x15c90dd9
jbe 0x10052db4
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0x67135fe5
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1006a950
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10036500
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0xd71c6a8a
ja 0x100528ca
mov al, byte [ebp - 0x16]
test al, 1
jne 0x100529cf
jmp 0x10052d73
mov eax, dword [0x100bea54]
and eax, dword [0x100bea58]
or eax, 0x3c524731
or eax, 0x5cc066d5
sub eax, 0x837c453f
and eax, 0x532f55b2
xor eax, 0x524cdcba
sub eax, 0xb297df6c
sub eax, 0x7a13182a
imul eax, eax, 0x7350d2d8
and eax, 0x65d40781
or eax, 0x9f068cea
mov ecx, 0x4c280ed2
xor edx, edx
div ecx
and eax, 0x7d3da76e
sub eax, 0x6066c0cc
sub eax, 0xd0b61a3d
and eax, 0x392277d8
sub eax, 0xdfd9a71c
and eax, 0x6d0ef023
imul eax, eax, 0x5aaa005
sub eax, 0xa312b67d
or eax, 0x830056af
sub eax, 0x6d41ab60
and eax, 0xfc8cb8d3
and eax, 0x991b9d69
mov ecx, 0x4713b216
xor edx, edx
div ecx
mov ecx, 0x1d604b98
xor edx, edx
div ecx
sub eax, 0xd05a1e3c
and eax, 0x234e762d
and eax, 0xe7708491
xor eax, 0x2e31e63e
imul eax, eax, 0xee58a85d
add eax, 0x1b558852
xor eax, 0x57b01c32
add eax, 0x9b6fcd1e
mov ecx, 0xa5d227cf
xor edx, edx
div ecx
mov ecx, 0x45fddc42
xor edx, edx
div ecx
xor eax, 0x782cb369
sub eax, 0x812c6fb3
mov ecx, 0xe30c810a
xor edx, edx
div ecx
mov ecx, 0x8b950591
xor edx, edx
div ecx
or eax, 0x2dc3c141
and eax, 0x6c40754d
add eax, 0xe48f0f53
and eax, 0xb6d9f88a
or eax, 0x2415996e
mov ecx, 0xe34bafa7
xor edx, edx
div ecx
mov ecx, 0x702dad58
xor edx, edx
div ecx
imul eax, eax, 0x5b357479
mov ecx, 0x8c1893fa
xor edx, edx
div ecx
add eax, 0x570f2b14
mov ecx, 0x41d67bd0
xor edx, edx
div ecx
mov ecx, 0x5f7b5ce0
xor edx, edx
div ecx
mov ecx, 0xb3f9c4dc
xor edx, edx
div ecx
sub eax, 0x350e168c
or eax, 0xe078a3ca
xor eax, 0x2dcae7f7
imul eax, eax, 0xa97773a7
add eax, 0xe52a6b79
sub eax, 0xfe6f6d82
xor eax, 0x9fedd573
and eax, 0xe7c2e504
xor eax, 0x9213828b
add eax, 0x385f7f44
and eax, 0x486580f5
and eax, 0xba9f9c14
xor eax, 0xa077232f
mov ecx, 0x3a217bdf
xor edx, edx
div ecx
mov ecx, 0xd4c003c4
xor edx, edx
div ecx
or eax, 0x98e04e0d
add eax, 0x767e6c6d
imul eax, eax, 0xb5a871b0
sub eax, 0x73027385
and eax, 0x29f9a0d7
cmp eax, 0xa1d5a170
jae 0x10052e8d
mov eax, dword [0x100bea5c]
xor eax, dword [0x100bea60]
mov ecx, 0x73212bbb
xor edx, edx
div ecx
or eax, 0x915f53a4
xor eax, 0x45076c57
xor eax, 0xa161d883
or eax, 0xc6abda48
add eax, 0x3f968656
imul eax, eax, 0xfb94120e
add eax, 0x9978541c
xor eax, 0xadcf513b
xor eax, 0xea9fede7
imul eax, eax, 0xc309549d
or eax, 0x8412410e
sub eax, 0x3eea4ffc
mov ecx, 0x4592c545
xor edx, edx
div ecx
or eax, 0xa16ec76a
and eax, 0x64cc7d42
imul eax, eax, 0xffb68165
sub eax, 0xbe322122
add eax, 0x8bd04277
imul eax, eax, 0x7eec57ff
xor eax, 0x1f84b249
sub eax, 0x2c4a5aa
mov ecx, 0x6a0c0a03
xor edx, edx
div ecx
and eax, 0xbf655caa
sub eax, 0xb41225af
add eax, 0x3ffc5783
xor eax, 0x11ddaf8c
sub eax, 0x1063322e
mov ecx, 0xfb6029cf
xor edx, edx
div ecx
and eax, 0x176aa40e
or eax, 0xffb883e0
imul eax, eax, 0xc0bef059
sub eax, 0xdb3f7c30
mov ecx, 0x53492d62
xor edx, edx
div ecx
xor eax, 0xa809d7d5
xor eax, 0x46105742
xor eax, 0xe3e7d45f
imul eax, eax, 0xa8004ef6
sub eax, 0x2c28d019
mov ecx, 0x422d977e
xor edx, edx
div ecx
and eax, 0x615b6eba
mov ecx, 0xac4a93dc
xor edx, edx
div ecx
mov ecx, 0x20e1f0a3
xor edx, edx
div ecx
xor eax, 0xc0b12b88
sub eax, 0xed1469e
sub eax, 0x172e5e84
imul eax, eax, 0x33614d80
sub eax, 0xffe38299
xor eax, 0x71935c02
imul eax, eax, 0x7f40afb7
mov ecx, 0x8546f668
xor edx, edx
div ecx
mov ecx, 0x346c221a
xor edx, edx
div ecx
sub eax, 0xfe0acefc
xor eax, 0xaba68d53
mov ecx, 0x99aade44
xor edx, edx
div ecx
or eax, 0x7290ab8e
sub eax, 0x98e913eb
and eax, 0xfa6f3ad5
sub eax, 0xa9eb648f
add eax, 0xefc80c0a
or eax, 0x5a964d73
imul eax, eax, 0xd7f14e73
or eax, 0xca035516
sub eax, 0x4bb9738a
mov ecx, 0x1d7582ce
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
xor ecx, 0xf1023e1d
add ecx, 0xd10f48f7
add ecx, 0x784c89c7
and ecx, 0x586e0045
and ecx, 0xfb8e8eb5
xor ecx, 0x41ac3d65
sub ecx, 0xbbbf0ae
mov dword [ebp - 0x30], ecx
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x30]
cmp eax, 0xf66f314
jbe 0x10052e8d
jmp 0x10052d73
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066f8f
mov eax, dword [ebp - 0x34]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [ebp - 0x40], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x3c], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x38], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1006a950
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10036500
add esp, 0xc
jmp 0x100528ca
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10052b8f