Function at 0x1010c930
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017859f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push 0
push 0
lea ecx, [ebp - 0x88]
call fcn.10002cf0
mov eax, dword [0x1018c500]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x88]
call fcn.100034b0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0xb0]
call fcn.1003ad20
jmp 0x1010c99e
lea ecx, [ebp - 0xb0]
call fcn.10039a40
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ecx
lea ecx, [ebp - 0xb8]
call fcn.1003ad20
lea edx, [ebp - 0xb8]
push edx
lea ecx, [ebp - 0xb0]
call fcn.10039a70
movzx eax, al
neg eax
sbb eax, eax
add eax, 1
movzx ecx, al
test ecx, ecx
je 0x1010ca92
mov dword [ebp - 0x1a0], 0x101813a4
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a4], edx
mov eax, dword [ebp - 0x1a0]
mov cl, byte [eax]
mov byte [ebp - 0x1a5], cl
add dword [ebp - 0x1a0], 1
cmp byte [ebp - 0x1a5], 0
jne 0x1010c9f4
mov edx, dword [ebp - 0x1a0]
sub edx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ac], edx
mov eax, dword [ebp - 0x1ac]
push eax
push 0x101813a4
lea ecx, [ebp - 0x88]
call fcn.10008ee0
cmp dword [ebp - 0xb0], 0
jne 0x1010ca49
call fcn.100bcb20
xor ecx, ecx
jne 0x1010ca49
mov edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xac]
cmp eax, dword [edx + 8]
jb 0x1010ca63
call fcn.100bcb20
xor ecx, ecx
jne 0x1010ca63
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x114], edx
mov eax, dword [0x1018c500]
push eax
push 0
mov ecx, dword [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x88]
call fcn.10008ce0
jmp 0x1010c993
lea edx, [ebp - 0x11d]
mov dword [ebp - 0x11c], edx
push 0
push 0
lea ecx, [ebp - 0xa8]
call fcn.10002d50
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.100e5e80
add esp, 8
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x30], 0x180
mov word [ebp - 0x2a], 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x8c], eax
cmp dword [ebp + 0x10], 0
je 0x1010cb48
push 2
push 1
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
call fcn.1012b660
push eax
mov eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 1
mov ecx, dword [ebp + 0x10]
call fcn.1012b860
jmp 0x1010cb6f
push 2
push 1
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp dword [ebp + 0x14], 0
je 0x1010cba0
push 2
push 1
push 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
call fcn.1012b680
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x1010cbc7
push 2
push 1
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x8c]
push eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp dword [ebp + 0x18], 0
je 0x1010cbf8
push 2
push 1
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [ebp + 0x18]
mov ecx, dword [ecx]
call fcn.1012b680
push eax
mov edx, dword [ebp - 0x8c]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x1010cc1f
push 2
push 1
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
mov edx, dword [ebp - 0x8c]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp dword [ebp + 0x14], 0
je 0x1010cc2f
push 2
mov ecx, dword [ebp + 0x14]
call fcn.1012b860
cmp dword [ebp + 0x18], 0
je 0x1010cc3f
push 2
mov ecx, dword [ebp + 0x18]
call fcn.1012b860
cmp dword [ebp - 0x90], 8
jb 0x1010cc56
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x1b0], eax
jmp 0x1010cc62
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x1b0], ecx
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
mov ecx, dword [ebp - 0x1b0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0
je 0x1010cd51
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
call fcn.100bbdb6
add esp, 4
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0xc4], 0
je 0x1010ccf2
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.1010c590
mov dword [ebp - 0x1b4], eax
jmp 0x1010ccfc
mov dword [ebp - 0x1b4], 0
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0xc0], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.10002d50
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x88]
call fcn.10002cf0
mov eax, dword [ebp - 0xbc]
jmp 0x1010ce35
lea ecx, [ebp - 0x14d]
mov dword [ebp - 0x14c], ecx
push 0
push 0
lea ecx, [ebp - 0x110]
call fcn.10002cf0
mov dword [ebp - 0x1b8], str.Cannot_launch_process
mov edx, dword [ebp - 0x1b8]
add edx, 1
mov dword [ebp - 0x1bc], edx
mov eax, dword [ebp - 0x1b8]
mov cl, byte [eax]
mov byte [ebp - 0x1bd], cl
add dword [ebp - 0x1b8], 1
cmp byte [ebp - 0x1bd], 0
jne 0x1010cd85
mov edx, dword [ebp - 0x1b8]
sub edx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c4], edx
mov eax, dword [ebp - 0x1c4]
push eax
push str.Cannot_launch_process
lea ecx, [ebp - 0x110]
call fcn.10003590
mov byte [ebp - 4], 3
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0xf4]
call fcn.100fcc00
push 0x101aa74c
lea eax, [ebp - 0xf4]
push eax
call fcn.100bcb39
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x110]
call fcn.10002cf0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.10002d50
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x88]
call fcn.10002cf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret