Function at 0x106fe71
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10860
call fcn.01027cdf
mov eax, dword [0x10f52d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
mov esi, ecx
mov edi, dword [esi + 0x74]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x24]
add esp, 0xc
sub eax, 0
mov ebx, 0x10f52cc
je 0x106ff07
dec eax
je 0x106fef2
mov eax, dword [0x10f52cc]
cmp eax, ebx
je 0x106fee6
cmp byte [eax + 0x19], 2
jb 0x106fee6
push 0x106b628
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f7c2
mov eax, dword [0x10f52cc]
mov dword [ebp - 0x10808], 0x80070057
jmp 0x106ff2e
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x106b654
push 0x29
jmp 0x106ff1a
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0x106b654
push 0x25
call fcn.01070247
mov dword [ebp - 0x10808], eax
test eax, eax
jge 0x106ff5d
mov eax, dword [0x10f52cc]
cmp eax, ebx
je 0x10701b8
cmp byte [eax + 0x19], 2
jb 0x10701b8
push dword [ebp - 0x10808]
push 0x106b628
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010a4e26
jmp 0x10701b8
cmp dword [esi + 0x24], 1
jne 0x106ffe2
cmp byte [esi + 0x6c], 0
jne 0x106ffc8
cmp byte [esi + 0x6e], 0
jne 0x106ffc8
push 0x25
mov ecx, esi
call fcn.0106f9e9
mov dword [ebp - 0x10808], eax
test eax, eax
jge 0x106ffc8
mov eax, dword [0x10f52cc]
cmp eax, 0x10f52cc
je 0x10701b8
cmp byte [eax + 0x19], 2
jb 0x10701b8
push dword [ebp - 0x10808]
mov esi, dword [esi + 0x14]
call fcn.01040209
push eax
mov eax, dword [0x10f52cc]
push esi
push 0x106b628
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f91c
jmp 0x10701b8
call fcn.01040209
push eax
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x106fffa
call fcn.0103f0ba
jmp 0x106fffa
call fcn.0103f0ba
push eax
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x106fffa
call fcn.01040209
xor eax, eax
push 0xfffe
mov word [ebp - 0x10804], ax
xor edi, edi
lea eax, [ebp - 0x10802]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x7fff
lea eax, [ebp - 0x10804]
push eax
mov ecx, esi
call fcn.0106fbd6
cmp eax, edi
mov dword [ebp - 0x10808], eax
jge 0x1070063
mov eax, dword [0x10f52cc]
cmp eax, 0x10f52cc
je 0x10701b8
cmp byte [eax + 0x19], 2
jb 0x10701b8
push dword [ebp - 0x10808]
push 0x106b628
push 0x2a
jmp 0x106ff4d
mov eax, dword [0x10f52cc]
mov ebx, 0x10f52cc
cmp eax, ebx
je 0x107009a
cmp byte [eax + 0x19], 4
jb 0x107009a
lea ecx, [ebp - 0x10804]
push ecx
lea ecx, [ebp - 0x804]
push ecx
mov esi, 0x106b628
push esi
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f855
jmp 0x107009f
mov esi, 0x106b628
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x10809]
call fcn.0102f8c7
push 0x40
lea eax, [ebp - 0x1085c]
push edi
push eax
call sub.msvcrt.dll_memset
mov ax, word [ebp + 8]
mov word [ebp - 0x10830], ax
mov dword [ebp - 0x1081c], edi
xor eax, eax
lea edi, [ebp - 0x10818]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x1081c]
push eax
xor edi, edi
lea eax, [ebp - 0x10860]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x10804]
push eax
lea eax, [ebp - 0x804]
push eax
mov dword [ebp - 0x10860], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x107015a
mov eax, dword [0x10f52cc]
cmp eax, ebx
je 0x1070142
cmp byte [eax + 0x19], 4
jb 0x1070142
lea ecx, [ebp - 0x10804]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push esi
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f855
push dword [ebp - 0x10818]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1081c]
call esi
jmp 0x10701a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x107016e
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
mov dword [ebp - 0x10808], eax
jge 0x10701a9
mov eax, dword [0x10f52cc]
cmp eax, ebx
je 0x10701a9
cmp byte [eax + 0x19], 2
jb 0x10701a9
push dword [ebp - 0x10808]
lea ecx, [ebp - 0x10804]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push esi
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0106f91c
cmp byte [ebp - 0x10809], 0
je 0x10701b8
push edi
call fcn.0102f8ea
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10808]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002492
leave
ret 4