Function at 0x1010c9fa
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x48
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x8c]
push 0
push eax
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xac], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov dword [ebp - 0x20], 0xc
lea edi, [ebp - 0x40]
xor ecx, ecx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ecx
mov dword [ebp - 0x9c], edi
test esi, esi
jne 0x1010caa6
push 0x1004238c
push 0x71
pop edx
mov ecx, 0x1004239c
call fcn.100e970f
test ebx, ebx
jne 0x1010cabc
push 0x100423c4
push 0x72
pop edx
mov ecx, 0x1004239c
call fcn.100e970f
xor ecx, ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
mov dword [esi], ecx
push 4
mov dword [ebx], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetKernelObjectSecurity]
test eax, eax
jne 0x1010cd68
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x1010cd68
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb4]
call fcn.1010c2d4
mov ebx, dword [ebp - 0xb4]
test eax, eax
jne 0x1010cb27
mov eax, 0x8007000e
mov esi, eax
push 0x1004240c
push 1
push eax
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x1010cd41
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push ebx
push 4
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetKernelObjectSecurity]
test eax, eax
jne 0x1010cb68
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x1010cb54
movzx eax, ax
or eax, 0x80070000
mov esi, eax
test eax, eax
js 0x1010cb61
mov esi, 0x80004005
mov eax, esi
push 0x10042444
jmp 0x1010cb12
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
push eax
push 0
push 1
push 0
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x1010cbb5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x1010cbb5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1010cba1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1010cba8
mov esi, 0x80004005
push 0x1004246c
push 1
push esi
jmp 0x1010cb15
push dword [ebp - 0x14]
lea ecx, [ebp - 0x9c]
call fcn.1010c297
test eax, eax
jne 0x1010cbee
push 0x1004240c
mov eax, 0x8007000e
push 1
push eax
push 0x4000000
mov esi, eax
call fcn.100ab973
mov edi, dword [ebp - 0x9c]
add esp, 0x10
jmp 0x1010cd41
mov edi, dword [ebp - 0x9c]
lea eax, [ebp - 0x14]
push eax
push 0
push 1
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x1010cb8a
mov eax, dword [ebp - 0xa0]
xor ecx, ecx
push ecx
push ecx
push 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0x20009
push ecx
push edi
mov dword [ebp - 0x24], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x1010cc66
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1010cc45
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1010cc4c
mov esi, 0x80004005
push 0x100424a4
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x1010cd3a
mov eax, dword [ebp - 0x90]
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x8c], 0x48
mov dword [ebp - 0x84], 0x100424cc
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x94], eax
mov byte [ebp - 0x90], 0
call fcn.10099234
mov esi, eax
test esi, esi
jns 0x1010ccc6
push 0x100424ec
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp byte [ebp - 0x90], 0
je 0x1010cd3a
call fcn.100edd2d
jmp 0x1010cd3a
lea eax, [ebp - 0x40]
xor ecx, ecx
push eax
lea eax, [ebp - 0x8c]
push eax
push ecx
push ecx
push 0x80004
push ecx
push ecx
lea eax, [ebp - 0x20]
push eax
push ecx
push dword [ebp - 0xa4]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x1010cd16
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1010cd08
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1010cd0f
mov esi, 0x80004005
push 0x10042504
jmp 0x1010cca6
cmp byte [ebp - 0x90], 0
je 0x1010cd24
call fcn.100edd2d
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x3c]
mov dword [ecx], eax
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
test ebx, ebx
je 0x1010cd9b
mov eax, dword fs:[0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test eax, eax
jne 0x1010cd60
push 7
pop ecx
int 0x29
mov edi, dword [ebp - 0x9c]
jmp 0x1010cd9b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1010cd7f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1010cd86
mov esi, 0x80004005
push 0x100423e0
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
test edi, edi
je 0x1010cdba
mov eax, dword fs:[0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test eax, eax
jne 0x1010cdba
push 7
pop ecx
int 0x29
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc