Function at 0x100048a1
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebx
push edi
push esi
mov al, byte [0x100c0508]
test al, al
je 0x100049d7
mov ecx, 0x100c04f0
call fcn.10024c86
push 0x40
push 0x21d481f6
push 0xca8
push 0x100c04f0
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c0548]
test al, al
je 0x10004a2c
mov ecx, 0x100c0510
call fcn.10024cd0
push 0x3a
push 0x5fcf50
push 0x97e27a
push 0x100c0510
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c0568]
test al, al
je 0x10004a94
mov ecx, 0x100c0550
call fcn.10024c86
push 0x40
push 0x2234780e
push 0xccc
push 0x100c0550
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c05a8]
test al, al
je 0x10004ae9
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, 0x100c0570
call fcn.10024cd0
push 0x3a
push 0x60dd96
push 0x99901e
push 0x100c0570
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c05d0]
test al, al
je 0x10004b51
mov ecx, 0x100c05b0
call fcn.10024d1a
push 0x3fc
push 0x9e8e
push 0xfaef0
push 0x100c05b0
call fcn.10004243
sub esp, 0x18
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x14], 4
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
pop esi
pop edi
pop ebx
ret
push 0x100c0508
call fcn.100252dc
add esp, 4
test eax, eax
je 0x100048b1
movaps xmm0, xmmword [0x100b00f0]
movaps xmmword [0x100c04f0], xmm0
mov dword [0x100c0500], 0x4f1e79c6
mov word [0x100c0504], 0x182
push 0x1001e5b0
call fcn.100013b0
add esp, 4
push 0x100c0508
call fcn.10025383
add esp, 4
jmp 0x100048b1
push 0x100c0548
call fcn.100252dc
add esp, 4
test eax, eax
je 0x100048e1
movaps xmm0, xmmword [0x100b0100]
movaps xmmword [0x100c0510], xmm0
movaps xmm0, xmmword [0x100b0110]
movaps xmmword [0x100c0520], xmm0
movaps xmm0, xmmword [0x100b0120]
movaps xmmword [0x100c0530], xmm0
mov dword [0x100c0540], 0x16c04e5
push 0x1001e5c6
call fcn.100013b0
add esp, 4
push 0x100c0548
call fcn.10025383
add esp, 4
jmp 0x100048e1
push 0x100c0568
call fcn.100252dc
add esp, 4
test eax, eax
je 0x10004911
movaps xmm0, xmmword [0x100b00f0]
movaps xmmword [0x100c0550], xmm0
mov dword [0x100c0560], 0x4f1e79c6
mov word [0x100c0564], 0x182
push 0x1001e5e9
call fcn.100013b0
add esp, 4
push 0x100c0568
call fcn.10025383
add esp, 4
jmp 0x10004911
push 0x100c05a8
call fcn.100252dc
add esp, 4
test eax, eax
je 0x10004941
movaps xmm0, xmmword [0x100b0100]
movaps xmmword [0x100c0570], xmm0
movaps xmm0, xmmword [0x100b0110]
movaps xmmword [0x100c0580], xmm0
movaps xmm0, xmmword [0x100b0120]
movaps xmmword [0x100c0590], xmm0
mov dword [0x100c05a0], 0x16c04e5
push 0x1001e5ff
call fcn.100013b0
add esp, 4
push 0x100c05a8
call fcn.10025383
add esp, 4
jmp 0x10004941
push 0x100c05d0
call fcn.100252dc
add esp, 4
test eax, eax
je 0x1000497d
mov byte [0x100c05ce], 1
movaps xmm0, xmmword [0x100b0130]
movaps xmmword [0x100c05b0], xmm0
movsd xmm0, qword [0x100b0140]
movsd qword [0x100c05c0], xmm0
mov dword [0x100c05c8], 0x41287bdb
mov word [0x100c05cc], 0x6ad3
push 0x1001e622
call fcn.100013b0
add esp, 4
push 0x100c05d0
call fcn.10025383
add esp, 4
jmp 0x1000497d