Function at 0x10005458
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x28
mov al, byte [0x100c6638]
test al, al
je 0x10005645
mov ecx, 0x100c6610
call fcn.1002b02c
cmp dword [0x100c5004], 0x537
jne 0x10005488
mov dword [0x100c5004], 0x551
cmp dword [0x100c5008], 0x1bd4
jne 0x100054ae
mov dword [0x100c5008], 0x1bd5
cmp dword [0x100c500c], 0xad2
je 0x10005639
mov al, byte [0x100c6660]
test al, al
je 0x100056a3
mov ecx, 0x100c6640
call fcn.1002b076
cmp dword [0x100c5004], 0x537
jne 0x100054db
mov dword [0x100c5004], 0x551
cmp dword [0x100c5008], 0x1bd4
jne 0x10005501
mov dword [0x100c5008], 0x1bd5
cmp dword [0x100c500c], 0xad2
je 0x10005639
mov al, byte [0x100c6698]
test al, al
je 0x100056f9
mov ecx, 0x100c6670
call fcn.1002b02c
cmp dword [0x100c5004], 0x537
jne 0x1000552e
mov dword [0x100c5004], 0x551
cmp dword [0x100c5008], 0x1bd4
jne 0x10005554
mov dword [0x100c5008], 0x1bd5
cmp dword [0x100c500c], 0xad2
je 0x10005639
mov al, byte [0x100c66c0]
test al, al
je 0x10005757
mov ecx, 0x100c66a0
call fcn.1002b076
cmp dword [0x100c5004], 0x537
jne 0x10005581
mov dword [0x100c5004], 0x551
cmp dword [0x100c5008], 0x1bd4
jne 0x100055a7
mov dword [0x100c5008], 0x1bd5
cmp dword [0x100c500c], 0xad2
je 0x10005639
mov al, byte [0x100c6700]
test al, al
je 0x100057ad
mov ecx, 0x100c66d0
call fcn.1002b0c0
cmp dword [0x100c5004], 0x537
jne 0x100055d4
mov dword [0x100c5004], 0x551
cmp dword [0x100c5008], 0x1bd4
jne 0x100055f6
mov dword [0x100c5008], 0x1bd5
cmp dword [0x100c500c], 0xad2
je 0x10005639
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], edx
mov dword [esp + 0x14], 4
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
setne al
add esp, 0x28
ret
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov dword [esp], 0x100c6638
call fcn.1002b68c
test eax, eax
je 0x10005468
mov byte [0x100c6634], 1
movaps xmm0, xmmword [0x100b6110]
movaps xmmword [0x100c6610], xmm0
movaps xmm0, xmmword [0x100b6120]
movaps xmmword [0x100c6620], xmm0
mov dword [0x100c6630], 0x22391bf9
mov dword [esp], 0x10024c72
call fcn.100013b0
mov dword [esp], 0x100c6638
call fcn.1002b733
jmp 0x10005468
mov dword [esp], 0x100c6660
call fcn.1002b68c
test eax, eax
je 0x100054bb
mov byte [0x100c6658], 1
movaps xmm0, xmmword [0x100b6130]
movaps xmmword [0x100c6640], xmm0
movsd xmm0, qword [0x100b6140]
movsd qword [0x100c6650], xmm0
mov dword [esp], 0x10024c8e
call fcn.100013b0
mov dword [esp], 0x100c6660
call fcn.1002b733
jmp 0x100054bb
mov dword [esp], 0x100c6698
call fcn.1002b68c
test eax, eax
je 0x1000550e
mov byte [0x100c6694], 1
movaps xmm0, xmmword [0x100b6110]
movaps xmmword [0x100c6670], xmm0
movaps xmm0, xmmword [0x100b6120]
movaps xmmword [0x100c6680], xmm0
mov dword [0x100c6690], 0x22391bf9
mov dword [esp], 0x10024ca4
call fcn.100013b0
mov dword [esp], 0x100c6698
call fcn.1002b733
jmp 0x1000550e
mov dword [esp], 0x100c66c0
call fcn.1002b68c
test eax, eax
je 0x10005561
mov byte [0x100c66b8], 1
movaps xmm0, xmmword [0x100b6130]
movaps xmmword [0x100c66a0], xmm0
movsd xmm0, qword [0x100b6140]
movsd qword [0x100c66b0], xmm0
mov dword [esp], 0x10024cc0
call fcn.100013b0
mov dword [esp], 0x100c66c0
call fcn.1002b733
jmp 0x10005561
mov dword [esp], 0x100c6700
call fcn.1002b68c
test eax, eax
je 0x100055b4
mov byte [0x100c66fe], 1
movaps xmm0, xmmword [0x100b6150]
movaps xmmword [0x100c66d0], xmm0
movaps xmm0, xmmword [0x100b6160]
movaps xmmword [0x100c66e0], xmm0
movsd xmm0, qword [0x100b6170]
movsd qword [0x100c66f0], xmm0
mov dword [0x100c66f8], 0x680504a0
mov word [0x100c66fc], 0x6ad8
mov dword [esp], 0x10024cd6
call fcn.100013b0
mov dword [esp], 0x100c6700
call fcn.1002b733
jmp 0x100055b4