Function at 0x1001a5da
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1007b4e3
call fcn.1007ac40
sub esp, 0xe0
mov dword [ebp - 0x50], edx
push ebx
mov dword [ebp - 0x1c], 0xfffffffd
xor ebx, ebx
mov dword [ebp - 0x20], 0xfa147b80
push esi
mov dword [ebp - 0x20], 0xfffffff9
push edi
mov dword [ebp - 0x20], 4
mov edi, ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001a626
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8], 0x624039b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1001a615
mov dword [ebp - 0x1c], ebx
jmp 0x1001a6a9
mov dword [ebp - 0x24], 0x976ff55e
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0xd1f2e966
mov dword [ebp - 0x24], ebx
jmp 0x1001a6a1
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x10], ebx
jmp 0x1001a665
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x80], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1001a657
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1001a687
push 0x2432
push ebx
push ebx
push ebx
push 0x213
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x10], ebx
jmp 0x1001a699
mov dword [ebp - 0x2c], 0x27f7b6fe
dec dword [ebp - 0x2c]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001a68c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1001a64b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1001a631
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1001a6ca
push ebx
push ebx
push ebx
push ebx
push 0x1e5f
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x80]
movdqa xmm0, xmmword [0x10007a40]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xec]
mov dword [ebp - 0x70], ebx
push eax
push ebx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], ebx
movdqu xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0x68], ebx
call fcn.100180c2
push 1
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], ebx
call fcn.10016a6e
push ebx
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x2c], 1
push eax
call fcn.1001daeb
add esp, 0xc
mov dword [ebp - 0x34], ebx
jmp 0x1001a742
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xd4], 1
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x1001a731
mov esi, dword [ebp - 0x70]
xor eax, eax
cmp dword [esi], eax
setg al
xor ecx, ecx
cmp dword [esi], eax
mov eax, dword [esi + 0xc]
setl cl
dec eax
add eax, ecx
xor ecx, ecx
cmp dword [esi], eax
mov eax, dword [ebp - 0x94]
setne cl
mov dword [eax], ecx
xor eax, eax
cmp ecx, dword [esi]
setg al
cmp eax, dword [esi]
jne 0x1001a788
mov eax, dword [ebp - 0x94]
cmp dword [eax], ebx
je 0x1001a788
xor eax, eax
inc eax
jmp 0x1001a78a
mov eax, ebx
imul eax, dword [esi]
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x94]
cmp dword [eax], ebx
mov eax, dword [ebp - 0x70]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
imul ecx, dword [esi + 0xc]
mov dword [ebp - 0xd0], ecx
lea ecx, [ebp - 0x94]
call fcn.1001732e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1001732e
cmp dword [edi + 0x10], ebx
jne 0x1001a7d7
xor al, al
jmp 0x1001ae44
push 0xe42
push 0xa50
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.1001ae93
mov dword [ebp - 0x10], 0xdb3ae355
add esp, 0x10
mov dword [ebp - 0x10], ebx
jmp 0x1001a80b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0x38ab659d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001a7fa
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0x16
je 0x1001a9c0
push 2
pop esi
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x1001a9a3
mov dword [ebp - 0x1c], 0x2e8588d0
mov dword [ebp - 0x14], 0x1fbc9fa8
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1001a986
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfaf07207
mov ecx, dword [ebp - 0x24]
sbb edx, edx
inc edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, ecx
setle al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xa0]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
je 0x1001a8ee
mov dword [ebp - 0x20], 0x77d6446b
mov dword [ebp - 0x14], 0x18
jmp 0x1001a8e6
mov dword [ebp - 0x28], 0xe7504ed0
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xa0], ebx
je 0x1001a8c0
cmp dword [ebp - 0x28], ebx
je 0x1001a8c0
xor edx, edx
inc edx
jmp 0x1001a8c2
mov edx, ebx
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setne cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jle 0x1001a897
jmp 0x1001a90c
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1001a90c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a907
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
dec dword [ebp - 0x14]
jns 0x1001a8f6
mov dword [ebp - 0x14], 0xfffffff5
jmp 0x1001a977
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x28], 0xaecaa70
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
sub ecx, 0xfff9
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, 0x461d0ee3
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xfffb
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
add edx, 0xffffb8d1
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0x2c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jl 0x1001a915
dec dword [ebp - 0x1c]
jns 0x1001a854
mov dword [ebp - 0x1c], 0x10
jmp 0x1001a99a
cmp dword [ebp - 0x2c], ebx
jne 0x1001a9a0
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe7
jle 0x1001a98f
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
jl 0x1001a837
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x16
jne 0x1001a821
push 1
lea ecx, [ebp - 0x48]
call fcn.10016a6e
push 2
pop esi
push 1
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], esi
call fcn.10016a6e
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], 0x635290ce
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x2c], 0xcd3624b6
mov dword [ebp - 0x30], ebx
jmp 0x1001aa10
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x5c], 0x1b3c692b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jl 0x1001aa02
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
push 0x3efa
call fcn.1001d4b8
add esp, 0x10
mov dword [ebp - 0x30], ebx
jmp 0x1001aa41
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 1
jl 0x1001aa31
mov eax, dword [ebp - 0x48]
mov dword [eax], ebx
jmp 0x1001ab05
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x5c], ebx
jne 0x1001ab10
mov eax, dword [ebp - 0x48]
xor edx, edx
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5c]
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0xc4]
setge cl
mov dword [eax], ecx
neg ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5c]
cmp ecx, eax
jg 0x1001aaa6
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x5c], ebx
jne 0x1001aaa6
mov eax, ebx
jmp 0x1001aaa9
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor edx, edx
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5c]
mov ecx, dword [ebp - 0x48]
cmp dword [ecx], eax
mov eax, dword [ebp - 0x28]
setg dl
mov dword [ebp - 0x20], edx
mov edx, dword [ecx]
xor ecx, ecx
imul eax, edx
add eax, dword [ebp - 0x20]
cmp eax, 0x89ec
mov eax, dword [ebp + edx*4 - 0x5c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x48]
setle dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x5c]
cmp dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x48]
setl dl
xor eax, eax
cmp edx, dword [ecx]
setg al
inc dword [ecx]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x48]
cmp dword [eax], esi
jle 0x1001aa51
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0xc4]
call fcn.1001732e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.1001732e
cmp dword [edi + 0x14], 0x10
jb 0x1001ab34
mov ecx, dword [edi]
jmp 0x1001ab36
mov ecx, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x4c], ecx
jb 0x1001ab43
mov edx, dword [edi]
jmp 0x1001ab45
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001ad1c
mov dword [ebp - 0x3c], 0xbac64a68
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x10], 5
xor cl, cl
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x20], 0xdef906d8
call fcn.10019cbc
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setne dl
mov dword [ebp - 0x3c], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
neg ecx
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x10]
dec edx
jne 0x1001abb4
cmp dword [ebp - 0x10], ebx
jne 0x1001abb4
mov edx, ebx
jmp 0x1001abb7
xor edx, edx
inc edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
neg ecx
mov al, byte [eax]
mov dword [ebp - 0x20], ecx
cmp al, 0x30
jl 0x1001ac9a
cmp al, 0x39
jg 0x1001ac9a
mov dword [ebp - 0x38], 0xbac64a68
mov dword [ebp - 0x78], 5
mov dword [ebp - 0x74], 0xfffffffe
mov dword [ebp - 0x84], 0xdef906d8
mov dword [ebp - 0x38], 0x15
jmp 0x1001ac39
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0xfffffff9
push eax
push ebx
push 0x5f4c
call fcn.1001c3cf
add esp, 0xc
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xffffffeb
jle 0x1001ac17
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push 0x6674
push 0x278e
call fcn.1001dc6b
push 0x3df9
push 0x1196
push 0x72c3
push 0x53aa
push ebx
lea eax, [ebp - 0x4c]
push eax
push 0x5a9d
lea eax, [ebp - 0x50]
push eax
push 0x38e9
call fcn.1001c865
mov ecx, dword [ebp - 0x4c]
add esp, 0x40
inc ecx
jmp 0x1001ab36
push esi
lea ecx, [ebp - 0xac]
call fcn.10016a6e
lea eax, [ebp - 0xcc]
mov dword [ebp - 4], 4
push eax
push ebx
lea eax, [ebp - 0xac]
mov dword [ebp - 0x10], 0x13638ecf
push 0x1575
push eax
call fcn.1001d8f7
add esp, 0x10
mov dword [ebp - 0x10], ebx
jmp 0x1001ad01
lea eax, [ebp - 0xac]
mov dword [ebp - 0x7c], 0x82eac453
push eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.1001af79
mov ecx, dword [ebp - 0x10]
add esp, 0xc
mov eax, dword [ebp - 0xac]
cmp dword [eax + ecx*4], ebx
jne 0x1001ad07
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x1001acd5
lea ecx, [ebp - 0xac]
call fcn.1001732e
mov eax, dword [ebp - 0x50]
mov dword [eax], ebx
jmp 0x1001a7d0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x10], 0xd
jmp 0x1001ad58
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x28], 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001ad4f
mov edx, 0x1e82
mov cl, 1
call fcn.10019cbc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jle 0x1001ad2c
xor eax, eax
lea ecx, [ebp - 0xb8]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0xcb13638e
mov dword [ebp - 0x28], 0x3423637b
push eax
call fcn.10016a6e
mov dword [ebp - 0x20], 0x137d3709
mov dword [ebp - 0x14], ebx
jmp 0x1001ad9b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ad8a
mov dword [ebp - 0x14], ebx
jmp 0x1001adaf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001ada5
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1001adcb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001adbc
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
je 0x1001ae30
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x28]
sub ecx, eax
je 0x1001adfc
mov ebx, edx
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setne cl
neg eax
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x60]
setne dl
mov ecx, dword [ebp - 0x60]
mov dword [eax], edx
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x20], 0xe41b0ce7
call fcn.1001732e
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret