Function at 0x1001b4e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov dword [ebp - 0x48], ecx
cmp dword [ebp + 8], 0
je 0x1001b505
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx]
test eax, eax
jne 0x1001b50f
mov eax, 0x57
jmp 0x1001b75b
cmp dword [ebp + 0xc], 0
je 0x1001b528
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx]
test ecx, ecx
jne 0x1001b532
mov eax, 0x57
jmp 0x1001b75b
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx]
mov word [ebp - 0x16], dx
add dword [ebp - 0xc], 2
cmp word [ebp - 0x16], 0
jne 0x1001b541
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x20]
sar eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
mov cx, word [eax]
mov word [ebp - 0x18], cx
add dword [ebp - 0x10], 2
cmp word [ebp - 0x18], 0
jne 0x1001b570
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x24]
sar edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
lea edx, [ecx + eax + 0x208]
mov dword [ebp - 8], edx
xor ecx, ecx
mov eax, dword [ebp - 8]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004d28b
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x80000002
push str.SYSTEMCurrentControlSetServicesRfSbieSvc
push 0x10077590
call fcn.1001b260
add esp, 0x14
movzx eax, al
test eax, eax
jne 0x1001b5fe
mov dword [ebp - 0x1c], 3
jmp 0x1001b740
push 0x5c
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001ba10
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1001b621
mov dword [ebp - 0x1c], 3
jmp 0x1001b740
mov edx, 2
imul eax, edx, 0
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + eax]
cmp edx, 0x22
jne 0x1001b656
push str.start.exe_
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
sar eax, 1
mov ecx, dword [ebp - 8]
sub ecx, eax
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.1005759f
add esp, 0xc
jmp 0x1001b675
push str.start.exe
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 4]
sar eax, 1
mov ecx, dword [ebp - 8]
sub ecx, eax
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.1005759f
add esp, 0xc
push str._box:
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1005752a
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1005752a
add esp, 0xc
push 0x100775e0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.1005752a
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.1005752a
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x90]
push ecx
call fcn.1004ee40
add esp, 0xc
mov dword [ebp - 0x90], 0x44
xor edx, edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x90]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1001b72f
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001b738
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
xor edx, edx
jne 0x1001b5cc
cmp dword [ebp - 4], 0
je 0x1001b758
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.1004cf32
add esp, 4
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0xc