Function at 0x10012bc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x10087004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.10015230
cmp eax, 4
jne 0x10012bf8
pop edi
mov eax, 0xc
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x10012c0d
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
push esi
call fcn.10015230
mov dword [ebp - 0x10c], eax
cmp eax, 4
je 0x10012c66
cmp eax, 3
je 0x10012c66
lea ecx, [ebp - 0x10c]
call fcn.10017f40
test eax, eax
je 0x10012c3b
cmp dword [ebp - 0x10c], 0
jne 0x10012c66
push 0
push 4
lea edx, [ebp - 0x110]
mov ecx, str.K7SystemMonitor
call fcn.1000e480
add esp, 8
test eax, eax
je 0x10012c9e
mov eax, dword [ebp - 0x110]
cmp eax, 0xfffffffd
ja 0x10012c94
je 0x10012c66
sub eax, 1
push ebx
mov ecx, 0x3ed
call fcn.1000dcc0
add esp, 4
push str.wndClassK7SysMonVer1
push str.wndClassK7SysMonVer1
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x10012da3
or eax, 0xffffffff
jmp 0x10012dbb
cmp eax, 0xfffffffe
je 0x10012c66
cmp eax, 0xffffffff
jne 0x10012c66
push 0
push str.SoftwareK7_ComputingK7TotalSecurity
push 0x80000002
mov byte [ebp - 0x108], 0
call fcn.10028a20
mov esi, eax
test esi, esi
je 0x10012cda
push 0x104
lea eax, [ebp - 0x108]
push eax
push str.DirProductBase
push esi
call fcn.10028f10
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.K7SysMon.Exe
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x120]
mov dword [ebp - 0x164], 0x44
push eax
lea eax, [ebp - 0x164]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x108]
movlpd qword [ebp - 0x160], xmm0
push eax
push 0
movlpd qword [ebp - 0x158], xmm0
movlpd qword [ebp - 0x150], xmm0
movlpd qword [ebp - 0x148], xmm0
movlpd qword [ebp - 0x140], xmm0
movlpd qword [ebp - 0x138], xmm0
movlpd qword [ebp - 0x130], xmm0
movlpd qword [ebp - 0x128], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10012d8d
push 0x1d4c0
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x120]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10012c66
pop esi
pop edi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
not edi
and edi, 1
push 0
add edi, 0x601
push edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, eax
shr ecx, 0x10
cmp ecx, 0x4b37
je 0x10012dcc
xor eax, eax
jmp 0x10012dcf
movzx eax, ax
add eax, 3
cmp eax, 5
ja case.0x10012dd7.0
jmp dword [eax*4 + 0x10012e64]
pop esi
pop edi
mov eax, 5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029e88
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 9
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.10029e88
mov esp, ebp
pop ebp
ret