Function at 0x1009f864
Capabilities:
Create process on windows

Disassembly:
push 0xac
mov eax, 0x1014c4da
call fcn.101439f3
mov eax, dword [ebp + 0x18]
xor ebx, ebx
test eax, eax
je 0x1009f87e
mov dword [eax], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp dword [esi + 8], ebx
je 0x1009fb61
push 0xffffffffffffffff
push str.https:__
lea ecx, [ebp - 0x44]
call fcn.100988e0
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.100988a3
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.10103939
push dword [ebp - 0x40]
lea ecx, [ebp - 0x34]
call fcn.10103939
test eax, eax
jne 0x1009f939
push esi
lea ecx, [ebp - 0x54]
call fcn.100988a3
push ebx
mov byte [ebp - 4], 3
call fcn.10103939
pop ecx
lea ecx, [ebp - 0xb8]
push ecx
mov ecx, eax
call fcn.10103939
mov esi, eax
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 4
push str._sender
push eax
call fcn.10103939
pop ecx
pop ecx
push esi
push eax
call fcn.10103939
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
call fcn.10103939
push 1
push ebx
push ebx
push dword [ebp - 0x50]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
lea ecx, [ebp - 0x54]
setge bl
call fcn.10103939
jmp 0x1009fb33
mov eax, dword [esi + 8]
inc eax
add eax, eax
push eax
call fcn.10103939
pop ecx
push dword [esi + 8]
mov edi, eax
mov ecx, esi
push edi
mov dword [ebp - 0x1c], edi
call fcn.10103939
mov eax, dword [esi + 8]
xor ecx, ecx
push 0x44
pop esi
push esi
mov word [edi + eax*2], cx
lea eax, [ebp - 0xa8]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x7c], 1
push 0xfffffffffffffff6
call dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x70], eax
call dword [sym.imp.kernel32.dll_GetStdHandle]
push 0xfffffffffffffff4
mov dword [ebp - 0x6c], eax
call dword [sym.imp.kernel32.dll_GetStdHandle]
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xa4], ebx
jne 0x1009f9b1
push 5
jmp 0x1009f9b3
push 7
pop eax
push edi
mov word [ebp - 0x78], ax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
mov dword [ebp - 0x14], eax
add eax, eax
push eax
call fcn.10103939
pop ecx
pop ecx
push edi
push dword [ebp - 0x14]
mov esi, eax
push esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add esp, 0x10
dec eax
movzx ecx, word [esi + eax*2]
cmp ecx, 0x5c
je 0x1009f9f6
cmp ecx, 0x2f
jne 0x1009f9e7
xor ecx, ecx
push edi
mov word [esi + eax*2], cx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
lea esi, [eax + 0xa]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1009fa16
mov eax, dword [eax + 8]
add eax, 2
add esi, eax
lea eax, [esi + esi]
push eax
call fcn.10103939
pop ecx
mov edi, eax
xor eax, eax
push 0x22
pop ecx
push 0x20
mov word [edi], ax
mov word [ebp - 0x16], ax
pop eax
mov word [ebp - 0x24], ax
xor eax, eax
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x1c]
mov word [ebp - 0x18], cx
cmp word [eax], cx
je 0x1009fa59
lea eax, [ebp - 0x18]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov ax, word [eax]
cmp ax, word [ebp - 0x18]
je 0x1009fa80
lea eax, [ebp - 0x18]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1009fad8
mov eax, dword [eax + 8]
inc eax
add eax, eax
push eax
call fcn.10103939
pop ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
push dword [eax + 8]
push ecx
mov ecx, eax
call fcn.10103939
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov word [ecx + eax*2], dx
lea eax, [ebp - 0x24]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x14]
push esi
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push dword [ebp - 0x14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x1c
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xa8]
push eax
push esi
push ebx
push 8
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x1009fb1b
mov eax, dword [ebp - 0x5c]
mov dword [ecx], eax
push dword [ebp - 0x64]
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x60]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x20], 0
jne 0x1009fb47
lea ecx, [ebp - 0x34]
call fcn.10103939
lea ecx, [ebp - 0x44]
call fcn.10103939
mov al, bl
jmp 0x1009fb63
lea ecx, [ebp - 0x34]
call fcn.10103939
lea ecx, [ebp - 0x44]
call fcn.10103939
mov al, 1
jmp 0x1009fb63
xor al, al
call fcn.10143951
ret