Function at 0x10106eb7
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, edx
push edi
mov dword [ebp - 0x320], ecx
push ecx
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x310], ebx
mov dword [ebp - 0x31c], eax
mov dword [ebp - 0x318], esi
call fcn.100ae82a
xor edi, edi
lea eax, [ebp - 0x2f4]
push 0x44
push edi
push eax
mov dword [ebp - 0x314], edi
mov dword [ebp - 0x2f8], edi
mov dword [ebp - 0x2fc], edi
mov dword [ebp - 0x300], edi
mov dword [ebp - 0x2a0], edi
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x298], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x308], edi
lea eax, [ebp - 0x54]
mov dword [ebp - 0x304], edi
mov dword [ebp - 0x30c], edi
push 0x42
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebx], edi
mov ecx, esi
call fcn.100b707f
push edi
inc edi
lea ecx, [ebp - 0x2fc]
mov edx, edi
call fcn.101066ef
mov esi, dword [ebp - 0x2fc]
mov ebx, eax
test esi, esi
jne 0x10106fa3
xor eax, eax
lea ecx, [ebp - 0x300]
push eax
push edi
call fcn.10107710
mov esi, dword [ebp - 0x300]
mov ebx, eax
jmp 0x10106fc4
xor edx, edx
mov ecx, edi
call fcn.1010622d
test eax, eax
jns 0x10106fc4
push 0x1003e00c
push edi
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
xor ecx, ecx
call fcn.100b707f
test esi, esi
jne 0x10107028
cmp ebx, 0x80070003
je 0x1010700b
cmp ebx, 0x80070002
je 0x1010700b
cmp ebx, 0x80070490
je 0x1010700b
test ebx, ebx
js 0x10106ff0
mov ebx, 0x80004005
push 0x1003e044
push edi
push ebx
push 0x2000000
call fcn.100ab973
add esp, 0x10
xor esi, esi
jmp 0x10107454
push 0x1003e078
push edi
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
xor esi, esi
mov ebx, esi
jmp 0x10107454
cmp dword [ebp + 0xc], 0
je 0x1010705d
lea eax, [ebp - 0x304]
mov edx, 0x10008b40
push eax
push 0x1003e0d4
push edi
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.100ae0e0
test eax, eax
js 0x1010705d
cmp dword [ebp - 0x304], 0
je 0x1010705d
mov dword [ebp - 0x308], edi
push 0x1003e0e8
push esi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
mov edx, eax
pop ecx
sub edx, esi
pop ecx
sar edx, 1
mov ecx, esi
add edx, 7
xor eax, eax
mov edi, eax
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x314]
jne 0x1010707d
sub ecx, ebx
sar ecx, 1
cmp edx, ecx
ja 0x101070fb
lea eax, [esi + edx*2]
push 0x20
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x101070fb
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x101070af
mov eax, edi
sub ecx, edx
sub eax, esi
sar ecx, 1
sar eax, 1
cmp eax, ecx
ja 0x101070fb
push eax
push esi
mov edx, 0x104
lea ecx, [ebp - 0x25c]
call fcn.100af27e
mov ebx, eax
test ebx, ebx
jns 0x1010710e
push esi
push 0x1003e0f8
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x10107004
push esi
mov edx, 0x104
lea ecx, [ebp - 0x25c]
call fcn.100ad7c7
jmp 0x101070da
push 0x1003e140
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x2f8]
call fcn.100a9500
mov ebx, eax
test ebx, ebx
jns 0x10107132
push esi
push 0x1003e158
jmp 0x101070e6
cmp dword [ebp + 0xc], 0
je 0x10107160
mov edx, 0x1003e188
lea ecx, [ebp - 0x2f8]
call fcn.100a8220
mov ebx, eax
test ebx, ebx
jns 0x10107160
push 0x1003e1b4
push 1
push ebx
push 0x4000000
jmp 0x10106ffc
cmp dword [ebp - 0x308], 0
je 0x10107186
mov edx, 0x1003e1dc
lea ecx, [ebp - 0x2f8]
call fcn.100a8220
mov ebx, eax
test ebx, ebx
jns 0x10107186
push 0x1003e20c
jmp 0x10107153
mov eax, dword [ebp - 0x318]
test eax, eax
je 0x101071e9
cmp eax, 0xffffffff
je 0x101071e9
push 0xa
push 0x21
lea ecx, [ebp - 0x54]
cdq
push ecx
push edx
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__ui64tow_s]
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x101071c1
jle 0x101071ba
movzx ebx, bx
or ebx, 0x80070000
push 0x1003e234
jmp 0x10107153
lea eax, [ebp - 0x54]
mov edx, 0x1003e270
push eax
lea ecx, [ebp - 0x2f8]
call fcn.100a9500
mov ebx, eax
test ebx, ebx
jns 0x101071e9
lea eax, [ebp - 0x54]
push eax
push 0x1003e290
jmp 0x101070e6
test edi, edi
je 0x1010720a
mov edx, edi
lea ecx, [ebp - 0x2f8]
call fcn.100a8220
mov ebx, eax
test ebx, ebx
jns 0x1010720a
push 0x1003e2b4
jmp 0x10107153
xor esi, esi
lea eax, [ebp - 0x2a0]
push esi
push esi
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x1010724c
lea eax, [ebp - 0x25c]
mov ebx, 0x8007000e
push eax
push 0x1003e2e8
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x10107454
mov esi, dword [ebp - 0x2f8]
lea eax, [ebp - 0x2a8]
push esi
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
push 0x1003e324
xor eax, eax
push eax
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x14
push esi
push 0x1003e340
sub esp, 0x10
mov esi, 0x1002f100
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100ea948
add esp, 0x18
lea eax, [ebp - 0x2a8]
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
push esi
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ntdll.dll_RtlCreateProcessParameters]
test eax, eax
jns 0x101072e9
push dword [ebp - 0x2a4]
push dword [ebp - 0x29c]
push 0x1003e378
push 1
mov ebx, eax
or ebx, 0x10000000
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x18
jmp 0x10107454
lea eax, [ebp - 0x2f4]
xor edi, edi
push eax
push esi
push esi
inc edi
lea eax, [ebp - 0x2a0]
push edi
push esi
push esi
push esi
push dword [ebp - 0x298]
push 0x40
push eax
call dword [sym.imp.ntdll.dll_RtlCreateUserProcess]
test eax, eax
jns 0x10107326
push dword [ebp - 0x2a4]
push dword [ebp - 0x29c]
push 0x1003e3c0
push edi
jmp 0x101072ce
push esi
push dword [ebp - 0x2ec]
call dword [sym.imp.ntdll.dll_NtResumeThread]
test eax, eax
jns 0x1010734a
push dword [ebp - 0x2a4]
push dword [ebp - 0x29c]
push 0x1003e3f8
jmp 0x10107323
mov dword [ebp - 0x30c], edi
cmp dword [ebp - 0x2ec], esi
je 0x10107454
push 0x1003e438
push esi
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
push edi
push 0x1388
push dword [ebp - 0x2ec]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObjectEx]
cmp eax, 0x102
je 0x10107350
cmp eax, 0xc0
je 0x10107350
test eax, eax
jne 0x10107454
push 6
pop ecx
push esi
lea edi, [ebp - 0x274]
push 0x18
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x274]
push eax
push esi
push dword [ebp - 0x2f0]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1010743a
mov eax, dword [ebp - 0x274]
xor edi, edi
inc edi
test eax, 0x10000
je 0x101073d6
mov ecx, dword [ebp - 0x310]
mov dword [ecx], edi
movzx ebx, ax
test ebx, ebx
je 0x101073e3
or ebx, 0x80070000
cmp ebx, 0x80070bc2
jne 0x101073f9
mov eax, dword [ebp - 0x31c]
test eax, eax
je 0x101073f7
mov dword [eax], edi
mov ebx, esi
test ebx, ebx
js 0x10107432
push 0x1003e494
push edi
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
mov esi, 0x1002f248
push ebx
push 0x1003e4b0
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100ea948
add esp, 0x18
jmp 0x10107004
push 0x1003e460
push edi
jmp 0x10107446
push 0x1003e500
mov ebx, 0x80004005
push 1
push ebx
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp dword [ebp - 0x298], 0
mov ecx, dword [ebp - 0x320]
mov eax, dword [ebp - 0x30c]
mov dword [ecx], eax
je 0x10107477
push dword [ebp - 0x298]
call dword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
cmp dword [ebp - 0x29c], 0
je 0x10107496
push dword [ebp - 0x29c]
mov eax, dword fs:[0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [ebp - 0x2fc]
test edi, edi
je 0x101074d0
test ebx, ebx
jns 0x101074d0
mov eax, dword [ebp - 0x310]
cmp dword [eax], esi
jne 0x101074d0
xor edx, edx
xor ecx, ecx
call fcn.1010622d
test eax, eax
jns 0x101074d0
push 0x1002a8a0
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
mov esi, dword [ebp - 0x2f8]
test esi, esi
je 0x101074e4
lea eax, [esi - 4]
push eax
call fcn.100b84f9
pop ecx
test edi, edi
je 0x101074f2
lea eax, [edi - 4]
push eax
call fcn.100b84f9
pop ecx
mov eax, dword [ebp - 0x300]
test eax, eax
je 0x10107506
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
lea ecx, [ebp - 0x294]
call fcn.100a58a2
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc