Function at 0x1003b2f0
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov esi, ecx
mov eax, dword [0x10070040]
xor eax, esp
mov dword [esp + 0x8c], eax
cmp dword [ecx + 0x10], 0
sete byte [esp + 0x2f]
mov ecx, 0x954899f7
mov eax, 0x75586b54
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [esp + 0x48]
lea ebp, [esp + 0x38]
jmp 0x1003b340
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, 0xa8458ea9
mov eax, 0xe0129730
nop
cmp ecx, 0x1386f849
jle 0x1003b3a0
cmp ecx, 0x3b73698d
jle 0x1003b3f0
cmp ecx, 0x5b09faeb
jle 0x1003b4e2
cmp ecx, 0x5b09faec
je 0x1003b58e
cmp ecx, 0x73f252ed
je 0x1003b5aa
cmp ecx, 0x7b78a4fe
jne 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0xe0129730
mov ecx, 0x3b73698e
mov edx, 0xf9f0f712
cmove ecx, edx
jmp 0x1003b340
cmp ecx, 0xca1b9f1e
jle 0x1003b4b0
cmp ecx, 0xf9f0f711
jle 0x1003b504
cmp ecx, 0xffad4e84
je 0x1003b5c6
cmp ecx, 0xbba3c8e
jne 0x1003b67f
cmp byte [esp + 0x2f], 0
mov eax, 0x58a4fa48
mov ecx, 0xe0129730
cmovne eax, ecx
mov ecx, 0xa8458ea9
jmp 0x1003b340
cmp ecx, 0x33ba4297
jg 0x1003b538
cmp ecx, 0x1386f84a
je 0x1003b5e2
cmp ecx, 0x20d446d2
jne 0x1003b340
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x40], 0
mov dword [esp + 0x34], ebp
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
movups xmmword [eax], xmm0
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1003b452
mov eax, dword [esi]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebx
movaps xmm0, xmmword [0x1006c970]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
mov eax, 0xde95a5c8
mov ecx, 0x7d14e60f
cmove eax, ecx
mov ecx, 0xa8458ea9
jmp 0x1003b340
cmp ecx, 0x9963df09
jg 0x1003b56c
cmp ecx, 0x9476bb86
je 0x1003b5fe
cmp ecx, 0x954899f7
jne 0x1003b340
mov dword [esp + 0x28], eax
mov ecx, 0x73f252ed
jmp 0x1003b340
cmp ecx, 0x3b73698e
je 0x1003b61a
cmp ecx, 0x4b8c3e1b
jne 0x1003b340
mov ecx, 0xa8458ea9
jmp 0x1003b340
cmp ecx, 0xca1b9f1f
je 0x1003b624
cmp ecx, 0xf2514594
jne 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0x7d14e60f
mov ecx, 0x3b73698e
mov edx, 0x33ba4298
cmove ecx, edx
jmp 0x1003b340
cmp ecx, 0x33ba4298
je 0x1003b32d
cmp ecx, 0x39adc792
jne 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0x75586b54
mov ecx, 0x1386f84a
mov edx, 0x9963df0a
cmovl ecx, edx
jmp 0x1003b340
cmp ecx, 0x9963df0a
je 0x1003b663
cmp ecx, 0xa8458ea9
jne 0x1003b340
mov ecx, 0x954899f7
jmp 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0x75586b54
mov ecx, 0x3b73698e
mov edx, 0xbba3c8e
cmove ecx, edx
jmp 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0x58a4fa48
mov ecx, 0x39adc792
mov edx, 0x9476bb86
cmovl ecx, edx
jmp 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0xde95a5c8
mov ecx, 0x3b73698e
mov edx, 0xca1b9f1f
cmove ecx, edx
jmp 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0x7d14e60f
mov ecx, 0xf2514594
mov edx, 0x5b09faec
cmovl ecx, edx
jmp 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0xe0129730
mov ecx, 0x7b78a4fe
mov edx, 0xffad4e84
cmovl ecx, edx
jmp 0x1003b340
mov ecx, 0x4b8c3e1b
jmp 0x1003b340
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call edi
sub esp, 4
mov ecx, 0xa8458ea9
mov eax, 0x7d14e60f
jmp 0x1003b340
mov ecx, dword [esp + 0x28]
cmp ecx, 0x58a4fa48
mov ecx, 0x3b73698e
mov edx, 0x20d446d2
cmove ecx, edx
jmp 0x1003b340
cmp ecx, 0xf9f0f712
jne 0x1003b340
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.1005d66a
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret