Function at 0x101affa0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x101e6ddf
mov eax, dword fs:[0]
push eax
sub esp, 0x334
mov eax, dword [0x10293044]
xor eax, esp
mov dword [esp + 0x330], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x348]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x358]
lea eax, [esp + 0x118]
push eax
call fcn.101a0c40
xor ebx, ebx
mov dword [esp + 0x350], ebx
lea edi, [esp + 0x118]
call fcn.101afe10
test al, al
jne 0x101b0022
mov dword [esp + 0x350], 0xffffffff
mov ecx, edi
push ecx
call fcn.101a0d70
xor al, al
jmp 0x101b0642
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], ebx
mov word [esp + 0xac], bx
mov byte [esp + 0x350], 1
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x128]
lea ecx, [esp + 0xb0]
call fcn.10007880
push 0x3f
mov eax, 1
lea edi, [esp + 0xac]
call fcn.10031c10
cmp byte [esp + 0x35c], bl
push 1
mov ecx, edi
je 0x101b0081
push 0x10232534
jmp 0x101b0086
push 0x10238ea8
call fcn.1000c810
push 0x3f
mov eax, 1
lea edi, [esp + 0xac]
call fcn.10031c10
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.10056be0
test eax, eax
jbe 0x101b011d
mov dword [esp + 0x1c], ebx
mov eax, dword [ebp + 4]
cmp eax, ebx
je 0x101b00d6
mov ecx, dword [ebp + 8]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x20], eax
jb 0x101b00dc
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [ebp + 4]
add eax, dword [esp + 0x1c]
push ebx
push eax
or eax, 0xffffffff
lea esi, [esp + 0xb0]
call fcn.1000c700
push 0x3f
mov eax, 1
mov edi, esi
call fcn.10031c10
mov esi, dword [esp + 0x20]
add dword [esp + 0x1c], 0x1c
add esi, 1
mov ecx, ebp
mov dword [esp + 0x20], esi
call fcn.10056be0
cmp esi, eax
jb 0x101b00b1
mov ebp, dword [esp + 0xbc]
xor edi, edi
mov dword [esp + 0x24], edi
lea ebp, [ebp + ebp + 0x20]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x350], 2
mov dword [esp + 0xdc], 7
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], bx
mov byte [esp + 0x350], 3
mov dword [esp + 0x1c], ebx
cmp edi, ebx
je 0x101b0173
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], ebx
push 0xe
push str.Coral.Cleanup.
lea esi, [esp + 0xcc]
call fcn.10007a00
lea ecx, [esp + 0x40]
call fcn.101cdbd0
mov byte [esp + 0x350], 4
push ebx
push eax
or eax, 0xffffffff
call fcn.1000c700
mov byte [esp + 0x350], 3
mov esi, 8
cmp dword [esp + 0x58], esi
jb 0x101b01c1
mov edx, dword [esp + 0x44]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [esp + 0xdc], esi
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
jae 0x101b01e9
lea eax, [esp + 0xc8]
push eax
push ebp
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
mov dword [esp + 0x2c], eax
je 0x101b0212
cmp eax, 0xb7
jne 0x101b0226
mov eax, dword [esp + 0x1c]
add eax, 1
cmp eax, 0x20
mov dword [esp + 0x1c], eax
jl 0x101b0164
cmp edi, ebx
je 0x101b024c
push ebx
push ebx
push ebx
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x28], esi
jne 0x101b02f4
mov esi, 8
mov byte [esp + 0x350], 2
cmp dword [esp + 0xdc], esi
jb 0x101b026d
mov eax, dword [esp + 0xc8]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ebp, 7
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], bx
mov byte [esp + 0x350], 1
cmp edi, ebx
je 0x101b029f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], ebx
mov byte [esp + 0x350], bl
cmp dword [esp + 0xc0], esi
jb 0x101b02bf
mov ecx, dword [esp + 0xac]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], ebx
mov word [esp + 0xac], bx
mov dword [esp + 0x350], 0xffffffff
lea edx, [esp + 0x118]
push edx
call fcn.101a0d70
xor al, al
jmp 0x101b0642
push ebp
push ebx
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0xb8]
add esp, 0xc
cmp dword [esp + 0xc0], 8
jae 0x101b0317
lea eax, [esp + 0xac]
mov ecx, dword [esp + 0xbc]
lea edx, [ecx + ecx]
push edx
push eax
push esi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 8
mov ebp, 7
push str.__helper
lea esi, [esp + 0xe8]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x100], ebp
mov dword [esp + 0xfc], ebx
mov word [esp + 0xec], bx
call fcn.10007a00
mov byte [esp + 0x350], 5
push 1
push 0x1023355c
mov ecx, esi
call fcn.1000c810
push ebp
push str.cleanup
mov ecx, esi
call fcn.1000c810
push 1
push 0x10233890
mov ecx, esi
call fcn.1000c810
push 5
push str.__shm
mov ecx, esi
call fcn.1000c810
push 1
push 0x1023355c
mov ecx, esi
call fcn.1000c810
push ebx
lea eax, [esp + 0xc8]
push eax
or eax, 0xffffffff
call fcn.1000c700
push 0x44
lea ecx, [esp + 0x60]
push ebx
push ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x206
lea edx, [esp + 0x142]
push ebx
push edx
mov dword [esp + 0x68], 0x44
mov word [esp + 0x148], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x103
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x13c]
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov word [esp + 0x100], bx
lea ecx, [eax + 2]
lea ecx, [ecx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x101b0440
sub eax, ecx
sar eax, 1
push eax
lea ecx, [esp + 0x140]
push ecx
lea esi, [esp + 0x104]
call fcn.10007a00
mov byte [esp + 0x350], 6
push 1
push 0x10233890
mov ecx, esi
call fcn.1000c810
push ebx
lea edx, [esp + 0xe4]
push edx
or eax, 0xffffffff
call fcn.1000c700
mov eax, dword [esp + 0x118]
cmp eax, ebx
je 0x101b049d
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [esp + 0x114], 8
mov eax, dword [esp + 0x100]
jae 0x101b04b5
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.MSVCR80.dll__wcsdup]
add esp, 4
mov esi, eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x60]
push ecx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
cmp ebp, ebx
je 0x101b051d
mov eax, dword [esp + 0x118]
cmp eax, ebx
je 0x101b04f7
push 0x1770
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x101b050a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x101b051d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x30], ebx
push esi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
cmp ebp, ebx
setne byte [esp + 0x1b]
mov byte [esp + 0x350], 5
mov esi, 8
cmp dword [esp + 0x114], esi
jb 0x101b0554
mov edx, dword [esp + 0x100]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ebp, 7
mov dword [esp + 0x114], ebp
mov dword [esp + 0x110], ebx
mov word [esp + 0x100], bx
mov byte [esp + 0x350], 3
cmp dword [esp + 0xf8], esi
jb 0x101b0590
mov eax, dword [esp + 0xe4]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0xf8], ebp
mov dword [esp + 0xf4], ebx
mov word [esp + 0xe4], bx
mov byte [esp + 0x350], 2
cmp dword [esp + 0xdc], esi
jb 0x101b05c7
mov ecx, dword [esp + 0xc8]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xd8], ebx
mov word [esp + 0xc8], bx
mov byte [esp + 0x350], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], ebx
mov byte [esp + 0x350], bl
cmp dword [esp + 0xc0], esi
jb 0x101b0610
mov edx, dword [esp + 0xac]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0xc0], ebp
mov dword [esp + 0xbc], ebx
mov word [esp + 0xac], bx
mov dword [esp + 0x350], 0xffffffff
lea eax, [esp + 0x118]
push eax
call fcn.101a0d70
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x348]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x330]
xor ecx, esp
call fcn.101d19cc
add esp, 0x340
ret 8