Function at 0x10058aa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov ecx, dword [0x100c5328]
xor ecx, ebp
mov dword [ebp - 4], ecx
and al, 1
mov byte [ebp - 0x59], al
lea eax, [ebp - 0x48]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100709f0
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0
mov edx, dword [ebp + 8]
xor eax, eax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x58]
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10038630
test byte [ebp - 0x59], 1
je 0x10058ef3
mov eax, dword [0x100c4c60]
imul eax, dword [0x100c4c64]
or eax, 0xd67e75c9
add eax, 0x3236d158
imul eax, eax, 0xd9a7ea06
sub eax, 0xf6e9535b
and eax, 0xa612dda4
xor eax, 0x59395065
or eax, 0xb8a4b4a7
xor eax, 0xced4bca0
and eax, 0x2c8fe51b
imul eax, eax, 0x9186b371
xor eax, 0x33bdbedb
mov ecx, 0x4bf100e5
xor edx, edx
div ecx
imul eax, eax, 0xd6f894fb
mov ecx, 0xd4f5541
xor edx, edx
div ecx
mov ecx, 0x8bd3b66a
xor edx, edx
div ecx
xor eax, 0xe97f28b4
xor eax, 0x4d94487b
or eax, 0xdcc8b284
imul eax, eax, 0xb69ceb95
and eax, 0xe19c2115
xor eax, 0xca15b207
xor eax, 0x70cbd234
imul eax, eax, 0xddda78c8
mov ecx, 0x8e502ce3
xor edx, edx
div ecx
sub eax, 0xfa81e54b
mov ecx, 0x510e4bdd
xor edx, edx
div ecx
or eax, 0x52e7aebc
sub eax, 0x718965b0
and eax, 0xd7ec05f4
xor eax, 0x6567cf3d
and eax, 0x804875e0
imul eax, eax, 0x5e5e90fc
and eax, 0x41150642
add eax, 0x8ad1bbc8
add eax, 0x3f62d505
sub eax, 0x32589cdd
sub eax, 0x904739c2
and eax, 0xd9f9e9fc
imul eax, eax, 0x43d8bf94
sub eax, 0xb064a10f
or eax, 0x1406db34
sub eax, 0x1058e791
xor eax, 0x90ed5f3e
add eax, 0x7d245aa1
and eax, 0x4d56a1ee
imul eax, eax, 0xebc598c4
imul eax, eax, 0x65c92855
and eax, 0xca559136
imul eax, eax, 0x6ad355fa
or eax, 0xc43915b6
mov ecx, 0xf2ef2c68
xor edx, edx
div ecx
imul eax, eax, 0x27e924d9
imul eax, eax, 0xcf840352
imul eax, eax, 0x5b47c5c5
xor eax, 0xa1661553
mov ecx, 0x9256f28
xor edx, edx
div ecx
and eax, 0xd0601d2e
add eax, 0xeb022b94
mov ecx, 0x5c22d8d2
xor edx, edx
div ecx
sub eax, 0x12a34255
and eax, 0xd0726225
add eax, 0xd66f17e5
sub eax, 0xa7b7b3bd
and eax, 0xd48eddf
imul eax, eax, 0xff492676
add eax, 0xb7ce7bc4
imul eax, eax, 0x3c394d79
imul eax, eax, 0x4b769205
sub eax, 0x7b659ede
sub eax, 0xdd6d84a0
imul eax, eax, 0xc3b3f7ff
sub eax, 0xc4630066
cmp eax, 0x469597d6
jb 0x10058f2c
mov eax, dword [0x100c4c68]
xor edx, edx
div dword [0x100c4c6c]
xor eax, 0x84ec26a
imul eax, eax, 0xaaa04c7c
or eax, 0x894d92ca
mov ecx, 0xaf46ae73
xor edx, edx
div ecx
and eax, 0x21ebc10b
add eax, 0xe17d59d
mov ecx, 0x42256ade
xor edx, edx
div ecx
or eax, 0x43e3ed9d
mov ecx, 0x5edafef5
xor edx, edx
div ecx
add eax, 0x8eba8770
sub eax, 0xdfc75aec
add eax, 0x28d7f17e
mov ecx, 0x6541e165
xor edx, edx
div ecx
or eax, 0x73b16b4d
or eax, 0xcd34b27a
or eax, 0x9a94462d
and eax, 0x9665cdf3
and eax, 0x56177adb
imul eax, eax, 0xd7c38249
xor eax, 0xcc2146dc
and eax, 0x4797b363
imul eax, eax, 0x68e197a4
add eax, 0xa8020f2b
and eax, 0x139fa87c
and eax, 0x2dc115d
mov ecx, 0xde7b8422
xor edx, edx
div ecx
and eax, 0x1513151a
xor eax, 0xb4b0a972
sub eax, 0x59bd34f4
xor eax, 0x1a4a8eee
sub eax, 0x14218a84
mov ecx, 0x59bf76fe
xor edx, edx
div ecx
xor eax, 0x386cccde
mov ecx, 0x6952bc03
xor edx, edx
div ecx
mov ecx, 0x25266bfd
xor edx, edx
div ecx
or eax, 0x36e7d041
sub eax, 0x66a0a2af
add eax, 0x741c2e0a
add eax, 0x80794d02
mov ecx, 0xa0e73a2e
xor edx, edx
div ecx
add eax, 0x7f992254
imul eax, eax, 0x4857cb50
or eax, 0x1cd0db0c
mov ecx, 0x32af75c5
xor edx, edx
div ecx
imul eax, eax, 0x998a9ea0
imul eax, eax, 0x282750fc
xor eax, 0x72f6183b
or eax, 0x93d660c2
add eax, 0xca91b2b3
or eax, 0x7d210e02
sub eax, 0xa18049a8
sub eax, 0x73e5a009
xor eax, 0xaa5be716
xor eax, 0x5e4d962f
add eax, 0x41100ea1
sub eax, 0xc574db5b
mov ecx, 0xee9a641d
xor edx, edx
div ecx
xor eax, 0x94063f0d
add eax, 0xc8f2d54b
add eax, 0xdfe4d2f4
add eax, 0xd54ba26c
and eax, 0x8d50a53
or eax, 0x5864f452
and eax, 0x4854a964
and eax, 0xbd88a00
sub eax, 0x8ffd63fb
and eax, 0x102efd7a
xor eax, 0xa46ebcce
or eax, 0xeb7c13a
or eax, 0xfe41dc35
imul eax, eax, 0xc3baba21
imul eax, eax, 0x27e17fbc
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [ebp - 0x60]
cmp eax, 0xca86d810
je 0x10058d1d
jmp 0x10058ef3
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d02f
mov eax, dword [ebp - 0x64]
add esp, 0x8c
pop ebp
ret
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
jmp 0x10058d1d