Function at 0x1000347d
Capabilities:
Create process on windows

Disassembly:
push 0x40
mov eax, 0x1004621d
call fcn.10044ac9
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x48], edi
mov esi, dword [edi + 8]
push esi
call fcn.10003215
inc esi
movzx eax, al
mov dword [edi + 8], esi
sub eax, 0xa3
je 0x100036b3
sub eax, 3
je 0x100036aa
sub eax, 4
jne 0x10003719
and dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
push esi
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.10003238
movzx ecx, ax
mov edx, 0x3e8
lea eax, [esi + 2]
cmp cx, dx
mov dword [edi + 8], eax
mov eax, ecx
cmova eax, edx
xor ecx, ecx
cmp cx, ax
jae 0x100036a6
movzx eax, ax
mov dword [ebp - 0x44], eax
mov esi, dword [edi + 8]
mov ecx, edi
push esi
call fcn.10003238
add esi, 2
movzx eax, ax
push esi
mov ecx, edi
mov dword [ebp - 0x34], eax
mov dword [edi + 8], esi
call fcn.10003215
mov bl, al
lea ecx, [esi + 1]
lea eax, [ebp - 0x28]
mov dword [edi + 8], ecx
push eax
mov ecx, edi
call fcn.10003360
mov edi, eax
mov ecx, edi
mov esi, dword [edi + 8]
push esi
call fcn.10003215
inc esi
mov byte [ebp - 0x40], al
push esi
mov ecx, edi
mov dword [edi + 8], esi
call fcn.10003215
inc esi
mov byte [ebp - 0x3c], al
push esi
mov ecx, edi
mov dword [edi + 8], esi
call fcn.10003215
mov byte [ebp - 0x38], al
lea eax, [esi + 1]
mov esi, dword [ebp - 0x34]
mov dword [edi + 8], eax
cmp bl, 1
jne 0x10003632
movzx ebx, si
mov ecx, 0x1005b2bc
mov edx, ebx
call fcn.1000371f
test eax, eax
jne 0x10003699
push 0x1c
call fcn.10044a2b
mov esi, eax
pop ecx
mov dword [ebp - 0x4c], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x100035c1
push dword [ebp - 0x38]
lea eax, [ebp - 0x28]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.1000325c
mov ecx, esi
call fcn.100032ab
mov esi, eax
jmp 0x100035c3
xor esi, esi
push 0x1c
mov byte [ebp - 4], 1
call fcn.10044a2b
mov edi, eax
pop ecx
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x100035fc
push dword [ebp - 0x38]
lea eax, [ebp - 0x28]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.1000325c
mov ecx, edi
call fcn.100032ab
jmp 0x100035fe
xor eax, eax
push eax
mov edx, ebx
mov byte [ebp - 4], 1
mov ecx, 0x1005b2bc
call fcn.100037a4
test al, al
jne 0x10003699
test esi, esi
je 0x10003699
push 0
push 1
mov ecx, esi
call fcn.10001cd4
push 0x1c
push esi
call fcn.10044bbe
pop ecx
pop ecx
jmp 0x10003699
movzx edi, si
mov ebx, 0x1005b2bc
mov edx, edi
mov ecx, ebx
call fcn.1000371f
test eax, eax
je 0x10003699
mov ecx, eax
call fcn.10003786
mov edx, edi
mov ecx, ebx
call fcn.100033f2
push 1
push esi
call fcn.10015e9d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10003699
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10003699
cmp dword [esi + 0x760], eax
je 0x10003699
and dword [esi + 0x760], eax
mov ecx, dword [esi + 0x3a8]
test ecx, ecx
je 0x10003699
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [esi + 0x3a8], 0
sub dword [ebp - 0x44], 1
mov edi, dword [ebp - 0x48]
jne 0x10003501
push 0
jmp 0x1000370f
push edi
call fcn.100038e3
pop ecx
jmp 0x10003719
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
call fcn.10003360
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov cl, 0xc
mov dword [ebp - 0x30], 0x697c630c
cmovae edx, dword [ebp - 0x28]
mov eax, ebx
mov word [ebp - 0x2c], 0x62
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 4
jae 0x100036fb
mov cl, byte [ebp - 0x30]
jmp 0x100036ec
push 1
push ebx
push ebx
push edx
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x2b], bl
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10001cd4
call fcn.10044a84
ret