Function at 0x1002bdf1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
test edi, edi
jne 0x10051127
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
cmp word [eax], bx
je 0x1002be2d
add eax, 2
cmp word [eax], bx
jne 0x1002be14
cmp word [eax + 2], bx
je 0x1002be0f
push 0x20
pop edx
mov word [eax], dx
add eax, 2
jmp 0x1002be0f
push esi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call sym.MSVCR110.dll_memset
mov dword [ebp - 0x68], esi
mov esi, dword [0x100c8d4c]
add esp, 0xc
test esi, esi
je 0x1002be6f
lea edx, [esi - 1]
mov eax, edx
sar eax, 5
mov ecx, edx
mov eax, dword [eax*4 + sym.MSVCR110.dll___pioinfo]
and ecx, 0x1f
shl ecx, 6
cmp byte [eax + ecx + 4], bl
jne 0x1002be6d
dec edx
dec esi
jne 0x1002be4f
test esi, esi
js 0x1002bfa4
cmp esi, 0x3332
jae 0x1002bfa4
mov eax, esi
imul eax, eax, 5
add eax, 4
mov word [ebp - 0x36], ax
movzx eax, ax
push 1
push eax
call sym.MSVCR110.dll__calloc_crt
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1002bfa4
mov dword [eax], esi
mov eax, dword [ebp - 0x34]
mov edx, ebx
lea ecx, [eax + 4]
mov dword [ebp - 0xc], ecx
lea ecx, [eax + 4]
add ecx, esi
mov dword [ebp - 8], ecx
test esi, esi
jle 0x1002befd
mov edi, dword [ebp - 0xc]
mov ecx, edx
and ecx, 0x1f
mov eax, edx
sar eax, 5
shl ecx, 6
add ecx, dword [eax*4 + sym.MSVCR110.dll___pioinfo]
mov al, byte [ecx + 4]
test al, 0x10
jne 0x1002bf8d
mov byte [edi], al
mov eax, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, ecx
inc edx
add eax, 4
inc edi
mov dword [ebp - 8], eax
cmp edx, esi
jl 0x1002bec1
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp + 8]
cmp byte [ebp - 1], bl
jne 0x10051168
mov esi, ebx
call sym.MSVCR110.dll___doserrno
mov dword [eax], ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp + 0x14]
or esi, 0x400
push esi
push 1
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x34]
mov dword [ebp + 8], eax
call sym.MSVCR110.dll_free
pop ecx
test esi, esi
je 0x1005119a
cmp edi, 2
je 0x100511bb
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1002bf9a
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x14]
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret
mov eax, dword [ebp - 8]
mov byte [edi], bl
or dword [eax], 0xffffffff
jmp 0x1002beeb
cmp edi, 4
je 0x1002bf7c
jmp 0x100511a5
call sym.MSVCR110.dll__errno
jmp 0x100511ad
cmp edi, 1
je 0x1002be09
jle 0x10051149
cmp edi, 3
jle 0x1002be09
cmp edi, 4
jne 0x10051149
mov byte [ebp - 1], 1
jmp 0x1002be09
call sym.MSVCR110.dll___doserrno
mov dword [eax], ebx
call sym.MSVCR110.dll__errno
mov dword [eax], 0x16
call sym.MSVCR110.dll__invalid_parameter_noinfo
or eax, 0xffffffff
jmp 0x1002bf89
lea edx, [eax + 4]
add eax, 4
mov ecx, ebx
add eax, esi
mov dword [ebp + 8], esi
cmp esi, 3
jl 0x10051181
mov dword [ebp + 8], 3
cmp ecx, dword [ebp + 8]
jge 0x10051192
mov byte [edx], bl
or dword [eax], 0xffffffff
inc ecx
inc edx
add eax, 4
jmp 0x10051172
push 8
pop esi
jmp 0x1002bf08
push dword [ebp + 8]
call sym.MSVCR110.dll__dosmaperr
pop ecx
jmp 0x100511b3
mov ebx, dword [ebp - 0x24]
jmp 0x1002bf81
mov dword [eax], 0xc
or eax, 0xffffffff
jmp 0x1002bf88
push ebx
call sym.MSVCR110.dll__exit
int3