Function at 0x10018674
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x100840c3
call fcn.1005825d
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax + 0x10], ebx
jne 0x10018691
xor al, al
jmp 0x1001898b
push eax
lea ecx, [ebp - 0x40]
call fcn.10002112
xor eax, eax
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], bl
mov byte [ebp - 4], 1
jmp 0x100186f5
cmp ecx, edi
lea eax, [ebp - 0x40]
cmova eax, edx
cmp byte [eax], 0x20
jne 0x10018702
lea eax, [ebp - 0x59]
push eax
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002149
lea ecx, [ebp - 0x40]
call fcn.10002eed
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002e58
lea ecx, [ebp - 0x58]
call fcn.10002eed
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x40]
test esi, esi
jne 0x100186b8
push 0x22
cmp ecx, edi
lea eax, [ebp - 0x40]
push ebx
cmova eax, edx
push esi
push eax
call fcn.10001d82
test eax, eax
lea eax, [ebp - 0x40]
jne 0x100187b4
cmp dword [ebp - 0x2c], edi
push 0x22
cmova eax, dword [ebp - 0x40]
push 1
push dword [ebp - 0x30]
push eax
call fcn.10001d82
mov esi, eax
cmp esi, 0xffffffff
je 0x10018867
lea eax, [ebp - 0x59]
push eax
push 0xffffffffffffffff
lea ecx, [esi + 1]
push ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002149
mov eax, dword [ebp - 0x14]
cmp eax, edi
jbe 0x10018788
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ecx
cmp eax, 0x1000
jb 0x1001877f
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.10002a92
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
push eax
push ecx
call fcn.10057b5a
pop ecx
pop ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x18], ebx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], bl
call fcn.10002e58
lea ecx, [ebp - 0x58]
call fcn.10002eed
lea eax, [ebp - 0x59]
push eax
lea eax, [esi - 1]
push eax
push 1
jmp 0x1001883f
cmp dword [ebp - 0x2c], edi
push 0x20
cmova eax, dword [ebp - 0x40]
push ebx
push dword [ebp - 0x30]
push eax
call fcn.10001d82
mov esi, eax
cmp esi, 0xffffffff
je 0x10018867
lea eax, [ebp - 0x59]
push eax
push 0xffffffffffffffff
lea ecx, [esi + 1]
push ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002149
mov eax, dword [ebp - 0x14]
cmp eax, edi
jbe 0x1001881c
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
cmp eax, 0x1000
jb 0x10018813
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.10002a92
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
push eax
push ecx
call fcn.10057b5a
pop ecx
pop ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x18], ebx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], bl
call fcn.10002e58
lea ecx, [ebp - 0x58]
call fcn.10002eed
lea eax, [ebp - 0x59]
push eax
push esi
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002149
lea ecx, [ebp - 0x40]
call fcn.10002eed
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002e58
lea ecx, [ebp - 0x58]
call fcn.10002eed
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10018900
cmp dword [ebp - 0x14], edi
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
cmp byte [eax], 0x20
jne 0x100188fc
lea eax, [ebp - 0x59]
push eax
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002149
lea ecx, [ebp - 0x28]
call fcn.10002eed
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002e58
lea ecx, [ebp - 0x58]
call fcn.10002eed
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x10018872
jmp 0x100188fc
dec ecx
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], edi
cmova eax, dword [ebp - 0x28]
cmp byte [eax + ecx], 0x20
jne 0x10018900
lea eax, [ebp - 0x59]
push eax
push ecx
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002149
lea ecx, [ebp - 0x28]
call fcn.10002eed
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002e58
lea ecx, [ebp - 0x58]
call fcn.10002eed
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x100188ba
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call esi
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [ebp - 0x18], 0
je 0x10018921
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x28]
cmova ecx, dword [ebp - 0x28]
jmp 0x10018923
mov ecx, ebx
cmp dword [ebp - 0x2c], edi
lea eax, [ebp - 0x40]
push 5
cmova eax, dword [ebp - 0x40]
push ebx
push ecx
push eax
push ebx
call esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov eax, dword [ebp - 0x14]
setg bl
cmp eax, edi
jbe 0x10018976
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
cmp eax, 0x1000
jb 0x1001896d
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.10002a92
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
push eax
push ecx
call fcn.10057b5a
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], 0
call fcn.10002eed
mov al, bl
call fcn.1005820c
ret 4