Function at 0x10018fa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
mov esi, edx
test cl, cl
je 0x10018fc2
push 0x1d0e
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10019552
mov dword [ebp - 0x18], 0x789328a
mov eax, 0x44b1310f
mov dword [ebp - 4], 0xc1da7bc9
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
push ebx
mov dword [ebp - 0x50], eax
xor ebx, ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], ebx
jmp 0x10018ff7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x20], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jl 0x10018fe9
mov dword [ebp - 4], ebx
jmp 0x10019010
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x68], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019002
push edi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x44], 0xffffffff
jmp 0x10019177
mov dword [ebp - 8], 7
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0xc], 8
cmp dword [ebp - 0x18], 0xffff
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x2b00
mov eax, dword [ebp - 8]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jne 0x10019078
cmp dword [ebp - 0x20], ebx
jne 0x10019078
mov edx, ebx
jmp 0x1001907b
xor edx, edx
inc edx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
setne cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 8]
jl 0x100190ce
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x100190b6
push 0x196e
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10019174
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x10019174
mov dword [ebp - 0xc], 0x1c250287
mov dword [ebp - 0xc], 0xe2be8ca4
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], ebx
jmp 0x100190f9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa0], 0xf8b4
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x100190e8
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 4
jge 0x1001911e
or ecx, 0xffffffff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x88], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001910b
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0x94]
sub eax, dword [ebp - 0x14]
jne 0x10019150
cmp dword [ebp - 0x1c], ebx
jne 0x10019150
mov ecx, ebx
jmp 0x10019153
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
imul eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001916e
mov dword [ebp - 0x1c], 9
dec dword [ebp - 0x1c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10019161
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffd
jne 0x1001902c
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10019203
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp + eax*4 - 0x20], 0x654
sub eax, 0x1ac6
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0x1800d466
mov dword [ebp - 0x4c], eax
jne 0x100191b7
cmp dword [ebp - 0x18], ebx
jne 0x100191b7
mov edx, ebx
jmp 0x100191ba
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x5126
setl al
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x20], ecx
dec dword [ebp - 0x18]
jns 0x10019189
mov dword [ebp - 4], 8
or eax, 0xffffffff
mov dword [ebp - 8], ebx
push 3
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], ebx
pop edx
jmp 0x10019229
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x78], 0xe91b76e1
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001921b
mov dword [ebp - 4], 0xffffffef
cmp dword [ebp - 4], 0xfffffffc
jne 0x10019311
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x48], 0x941c
mov dword [ebp - 0xc], 5
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x18
je 0x10019301
or ebx, 0xffffffff
mov dword [ebp - 0x1c], 0x6c19
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xb5af
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
sub eax, edx
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp eax, ecx
setg dl
mov dword [ebp - 0x70], edx
xor edx, edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
add ecx, 0x4fbdfbf1
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
jne 0x10019269
xor eax, eax
xor ebx, ebx
inc eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffc
je 0x10019242
push 3
pop edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 8], ebx
jmp 0x10019333
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x90], 9
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10019322
xor ecx, ecx
mov dword [ebp - 0x40], 0xfffffff2
inc ecx
cmp dword [ebp - 0x40], 0xfffffff7
jle 0x1001941c
or edi, 0xffffffff
mov dword [ebp - 0xc], edi
mov dword [ebp - 0xc], 0xab593421
mov dword [ebp - 0xc], 0x8f21009d
mov dword [ebp - 0xc], edi
mov dword [ebp - 0xc], 0x552bf338
mov dword [ebp - 0xc], 0x71013923
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], 0x4dbf0cf8
mov dword [ebp - 0xc], 0x63069be5
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], 0xfffffffa
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], 0x5e0e2bf3
mov dword [ebp - 0xc], 0xba8d7d2a
mov dword [ebp - 0xc], 0xc9b6cd04
mov dword [ebp - 0xc], 0x83afd470
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], 0x69376522
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0xc], 0xfffffff9
mov dword [ebp - 0xc], 8
mov dword [ebp - 0xc], 9
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
jmp 0x100193ed
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100193e3
mov dword [ebp - 4], ebx
jmp 0x10019401
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5c], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100193f7
inc dword [ebp - 0x1c]
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffff7
jg 0x10019350
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp byte [esi], 0
je 0x10019550
mov dword [ebp - 0x14], 0xf36f6dd8
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 4], ebx
jmp 0x10019446
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 0x198a8f93
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019438
mov dword [ebp - 4], ebx
jmp 0x1001945e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x24], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019450
mov esi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jg 0x1001948c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001947e
push ebx
push ebx
call esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x10019471
xor ecx, ecx
push 3
inc ecx
pop edx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001954c
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
jmp 0x100194b5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x30], 0xbca9d692
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100194a7
mov dword [ebp - 0x28], ebx
jmp 0x1001951d
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x24], ebx
je 0x100194cb
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x24]
cmp dword [ebp - 0x44], eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], eax
jne 0x1001950b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x100194bf
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019543
push 0xe4
push ebx
push ebx
push ebx
push ebx
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
push 3
inc ecx
pop edx
dec dword [ebp - 0x14]
jns 0x10019498
push ebx
push ebx
call esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret