Function at 0x10005bb4
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
lea esi, [esp + 0x1c]
push 0x44
push esi
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
mov dword [esp], esi
mov ecx, 0x7a10ac70
cmp ecx, 0xf9cce9c3
jle 0x10005c6d
cmp ecx, 0x435561aa
jle 0x10005d25
cmp ecx, 0x6477d8f0
jg 0x10005db1
cmp ecx, 0x49a3403f
jle 0x10005f67
cmp ecx, 0x49a34040
je 0x100062f3
cmp ecx, 0x56649545
je 0x100062fd
cmp ecx, 0x5aa76fa4
jne 0x10005bd0
mov ecx, dword [0x10098dc4]
lea eax, [ecx - 1]
imul eax, ecx
not al
or al, 0xfe
cmp al, 0xff
sete bl
cmp dword [0x10098dc8], 0xa
setl ah
xor bl, ah
mov edx, 0xd1165520
mov ecx, 0xc0ea4efa
mov esi, 0xd1165520
jne 0x10005c57
mov esi, 0xc0ea4efa
mov al, bl
not al
test al, ah
cmovne ecx, esi
cmovne ecx, edx
test bl, bl
cmovne ecx, edx
jmp 0x10005bd0
cmp ecx, 0xc4caa4ee
jle 0x10005d6b
cmp ecx, 0xd2e2d7d9
jg 0x10005e4e
cmp ecx, 0xca2057f8
jle 0x10005fda
cmp ecx, 0xca2057f9
je 0x1000634d
cmp ecx, 0xcd3f3654
je 0x10006369
cmp ecx, 0xd1165520
jne 0x10005bd0
mov ecx, dword [0x10098dc4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne ah
cmp dword [0x10098dc8], 0xa
setge al
setl dl
and ah, dl
and al, cl
or al, ah
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ah, dl
xor ah, al
mov esi, 0x49a34040
mov ecx, 0xf13c42a8
mov ebp, 0x49a34040
test dl, dl
jne 0x10005d16
mov ebp, 0xf13c42a8
test al, al
cmovne esi, ebp
test ah, ah
cmovne ecx, esi
jmp 0x10005bd0
cmp ecx, 0x15ee69ee
jle 0x10005ec5
cmp ecx, 0x1b1448ea
jle 0x10006039
cmp ecx, 0x1b1448eb
je 0x10006382
cmp ecx, 0x372b5d85
je 0x1000638e
cmp ecx, 0x3c800870
jne 0x10005bd0
mov ecx, 0xc571f781
jmp 0x10005bd0
cmp ecx, 0xac4a19fa
jle 0x10005eee
cmp ecx, 0xb8d64bc9
jle 0x100060bb
cmp ecx, 0xb8d64bca
je 0x100063f2
cmp ecx, 0xbf24ef92
je 0x100063fc
cmp ecx, 0xc0ea4efa
jne 0x10005bd0
mov ecx, 0x5aa76fa4
jmp 0x10005bd0
cmp ecx, 0x68690da0
jle 0x100060e6
cmp ecx, 0x68690da1
je 0x10006458
cmp ecx, 0x70d4fce8
je 0x10006462
cmp ecx, 0x7a10ac70
jne 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x20b83351
mov edx, eax
and edx, 0xdf47ccae
or edx, ecx
xor edx, 0xdf47ccaf
and eax, 0xfffffffe
or eax, edx
xor eax, 0xbaacd3ba
xor eax, 0x45532c45
setne ah
sete al
cmp dword [0x10098dc8], 0xa
setge cl
xor al, cl
or ah, cl
mov edx, eax
xor dl, ah
mov ebp, 0x15ee69ef
mov esi, 0xbf24ef92
mov ecx, 0x15ee69ef
test ah, ah
jne 0x10006343
mov ecx, 0xbf24ef92
jmp 0x10006343
cmp ecx, 0xf92620fa
jg 0x10006108
cmp ecx, 0xd6bed70a
je 0x100064b2
cmp ecx, 0xf13c42a8
jne 0x100065d2
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x10098dc8], 0xa
setge ah
setl dl
and dl, cl
and al, ah
or al, dl
or ah, cl
mov dl, ah
xor dl, al
mov esi, 0x49a34040
mov ecx, 0xb8d64bca
mov ebp, 0x49a34040
test ah, 1
jne 0x10005eb5
mov ebp, 0xb8d64bca
test al, al
cmovne esi, ebp
test dl, 1
cmovne ecx, esi
jmp 0x10005bd0
cmp ecx, 0x10b7e4f3
jg 0x1000612a
cmp ecx, 0xf9cce9c4
je 0x10006224
cmp ecx, 0xa332a74
je 0x1000621a
jmp 0x10005bd0
cmp ecx, 0xa19ab59b
jg 0x1000619d
cmp ecx, 0x84c23455
je 0x1000622e
cmp ecx, 0x9ed53e6e
jne 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
setne cl
cmp dword [0x10098dc8], 0xa
setge ah
mov al, cl
xor al, ah
or ah, cl
mov edx, eax
xor dl, ah
mov esi, 0xc0ea4efa
mov ecx, 0x5aa76fa4
mov ebp, 0xc0ea4efa
test ah, ah
jne 0x100064f9
mov ebp, 0x5aa76fa4
jmp 0x100064f9
cmp ecx, 0x435561ab
je 0x10006508
cmp ecx, 0x47b733e9
jne 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x15087cad
mov edx, eax
and edx, 0xeaf78352
or edx, ecx
xor edx, 0xeaf78353
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete dl
cmp dword [0x10098dc8], 0xa
setl al
xor dl, al
mov esi, 0xa332a74
mov ecx, 0xa2c2d936
mov ebp, 0xa332a74
jne 0x1000649a
mov ebp, 0xa2c2d936
jmp 0x1000649a
cmp ecx, 0xc4caa4ef
je 0x10006516
cmp ecx, 0xc571f781
jne 0x10005bd0
mov ecx, dword [0x10098dc4]
mov eax, 0x53106d5b
sub eax, ecx
imul eax, ecx
not al
or al, 0xfe
cmp al, 0xff
setne cl
cmp dword [0x10098dc8], 0xa
setge dl
mov eax, ecx
xor al, dl
or dl, cl
mov ecx, edx
xor cl, al
mov esi, 0x648e85e1
mov ecx, 0xa19ab59c
jne 0x10006284
mov esi, 0xa19ab59c
jmp 0x10006284
cmp ecx, 0x15ee69ef
je 0x10006560
cmp ecx, 0x16f98625
jne 0x10005bd0
mov ecx, dword [0x10098dc4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xeb494257
and eax, 0x14b6bda8
or eax, edx
xor eax, 0x14b6bda9
xor ecx, eax
test ecx, eax
setne al
sete cl
cmp dword [0x10098dc8], 0xa
setl dl
setge ah
and ah, cl
and al, dl
or al, ah
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ecx, edx
xor cl, al
mov esi, 0x6477d8f1
mov ecx, 0xd6bed70a
jne 0x10006284
mov esi, 0xd6bed70a
jmp 0x10006284
cmp ecx, 0xac4a19fb
je 0x1000656a
cmp ecx, 0xb4681e95
jne 0x10005bd0
mov eax, dword [esp]
mov dword [eax], 0x44
mov ecx, 0x16f98625
jmp 0x10005bd0
cmp ecx, 0x6477d8f1
je 0x100065bf
cmp ecx, 0x648e85e1
jne 0x10005bd0
mov ecx, 0xa19ab59c
jmp 0x10005bd0
cmp ecx, 0xf92620fb
je 0x1000621a
cmp ecx, 0xf9ac8c09
jne 0x10005bd0
mov ecx, 0x56649545
jmp 0x10005bd0
cmp ecx, 0x10b7e4f4
je 0x1000628e
cmp ecx, 0x13c44ff6
jne 0x10005bd0
mov ecx, dword [0x10098dc4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xff9ca68c
and eax, 0x635973
or eax, edx
xor eax, 0x635972
xor ecx, eax
test ecx, eax
setne dl
sete al
cmp dword [0x10098dc8], 0xa
setge cl
xor al, cl
or dl, cl
mov ecx, eax
xor cl, dl
mov ecx, 0x16f98625
mov esi, 0x16f98625
jne 0x10006193
mov esi, 0xb4681e95
test dl, dl
cmovne ecx, esi
jmp 0x1000644e
cmp ecx, 0xa19ab59c
je 0x10006298
cmp ecx, 0xa2c2d936
jne 0x10005bd0
mov ecx, dword [0x10098dc4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098dc8], 0xa
setge ah
setl dh
mov al, dh
xor al, dl
and al, dh
and ah, cl
and dh, dl
or dh, ah
mov dl, dh
xor dl, al
mov esi, 0x372b5d85
mov ecx, 0x10b7e4f4
mov ebp, 0x372b5d85
test dh, dh
jne 0x10006343
mov ebp, 0x10b7e4f4
jmp 0x10006343
mov ecx, 0xf9cce9c4
jmp 0x10005bd0
mov ecx, 0x435561ab
jmp 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete cl
setne ah
cmp dword [0x10098dc8], 0xa
setge ch
setl dl
mov al, ch
xor ch, ah
and ah, dl
and al, cl
or al, ah
or dl, cl
xor dl, 1
or dl, ch
mov ecx, edx
xor cl, al
mov esi, 0xa2c2d936
mov ecx, 0xc571f781
jne 0x10006284
mov esi, 0xc571f781
test dl, dl
cmovne ecx, esi
jmp 0x100065b5
mov ecx, 0x372b5d85
jmp 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x4ab0c87f
mov edx, eax
and edx, 0xb54f3780
or edx, ecx
xor edx, 0xb54f3781
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098dc8], 0xa
setl ah
xor al, ah
mov edx, 0x47b733e9
mov ecx, 0x648e85e1
mov esi, 0x47b733e9
jne 0x100063dc
mov esi, 0x648e85e1
jmp 0x100063dc
mov ecx, 0xf13c42a8
jmp 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete dl
cmp dword [0x10098dc8], 0xa
setge ah
setl dh
mov al, dh
xor al, cl
and al, dh
and ah, dl
and dh, cl
or dh, ah
mov dl, al
xor dl, dh
mov esi, 0xd2e2d7da
mov ecx, 0xf9ac8c09
mov ebp, 0xd2e2d7da
test dh, dh
jne 0x10006343
mov ebp, 0xf9ac8c09
test al, al
cmovne ecx, ebp
jmp 0x100064fe
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xc]
mov dword [esp + 4], eax
mov ecx, 0xcd3f3654
jmp 0x10005bd0
mov eax, dword [esp + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xf92620fb
xor edi, edi
inc edi
jmp 0x10005bd0
mov ecx, 0x9ed53e6e
xor edi, edi
jmp 0x10005bd0
mov ecx, dword [0x10098dc4]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xbcc4ca50
and eax, 0x433b35af
or eax, edx
xor eax, 0xbcc4ca51
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098dc8], 0xa
setl ah
xor al, ah
mov edx, 0x3c800870
mov ecx, 0x10b7e4f4
mov esi, 0x3c800870
jne 0x100063dc
mov esi, 0x10b7e4f4
mov ebx, eax
not bl
test bl, ah
cmovne ecx, esi
cmovne ecx, edx
test al, al
cmovne ecx, edx
jmp 0x10005bd0
mov ecx, 0x84c23455
jmp 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete cl
setne ah
cmp dword [0x10098dc8], 0xa
setl dl
setge al
and cl, al
or al, ah
and dl, ah
or dl, cl
mov ecx, eax
xor cl, dl
mov esi, 0x15ee69ef
mov ecx, 0x13c44ff6
jne 0x10006449
mov esi, 0x13c44ff6
test dl, dl
cmove ecx, esi
test al, al
cmovne ecx, esi
jmp 0x10005bd0
mov ecx, 0xc4caa4ef
jmp 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete dl
cmp dword [0x10098dc8], 0xa
setl al
xor dl, al
mov esi, 0x56649545
mov ecx, 0xf9ac8c09
mov ebp, 0x56649545
jne 0x1000649a
mov ebp, 0xf9ac8c09
mov ah, dl
not ah
test ah, al
cmovne ecx, ebp
test dl, dl
cmovne ecx, esi
test ah, al
cmovne ecx, esi
jmp 0x10005bd0
mov eax, dword [esp]
mov dword [eax], 0x44
mov eax, dword [0x10098dc4]
lea ecx, [eax - 1]
imul ecx, eax
and ecx, 1
sete dl
cmp dword [0x10098dc8], 0xa
setl ah
setge al
or al, cl
xor ah, dl
mov edx, eax
xor dl, ah
mov ecx, 0xac4a19fb
mov ebp, 0x6477d8f1
mov esi, 0xac4a19fb
test ah, ah
jne 0x100064f9
mov esi, 0x6477d8f1
test al, al
cmovne esi, ebp
test dl, dl
cmovne ecx, esi
jmp 0x10005bd0
mov dword [esp + 8], edi
mov ecx, 0x70d4fce8
jmp 0x10005bd0
push 0x10
lea esi, [esp + 0x10]
push esi
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
push esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x80]
xor eax, eax
push eax
push 0x8000000
push eax
push eax
push eax
push dword [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, 0x1b1448eb
test eax, eax
je 0x10005bd0
mov ecx, 0xca2057f9
jmp 0x10005bd0
mov ecx, 0xbf24ef92
jmp 0x10005bd0
mov eax, dword [0x10098dc4]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete dl
cmp dword [0x10098dc8], 0xa
setl al
xor dl, al
mov ecx, edx
xor cl, 1
and al, cl
xor cl, al
mov esi, 0xb4681e95
mov ecx, 0x68690da1
jne 0x100065b0
mov esi, 0x68690da1
test dl, dl
cmove ecx, esi
test al, al
cmove ecx, esi
jmp 0x10005bd0
mov eax, dword [esp]
mov dword [eax], 0x44
mov ecx, 0xd6bed70a
jmp 0x10005bd0
cmp ecx, 0xd2e2d7da
jne 0x10005bd0
mov eax, dword [esp + 8]
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret