Function at 0x10002c90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x204
mov eax, dword [0x10022018]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push esi
mov esi, dword [0x1002288c]
xor ebx, ebx
push 0x31
lea eax, [esp + 0x11]
push ebx
push eax
mov byte [esp + 0x18], bl
call sub.MSVCR90.dll_memset
push 0x95
lea ecx, [esp + 0x51]
push ebx
push ecx
mov byte [esp + 0x58], bl
call sub.MSVCR90.dll_memset
push 0x95
lea edx, [esp + 0x18d]
push ebx
push edx
mov byte [esp + 0x194], bl
call sub.MSVCR90.dll_memset
push 0x1001bf08
push esi
mov esi, dword [sym.imp.MSVCR90.dll__mbstok]
call esi
add esp, 0x2c
cmp eax, ebx
je 0x10002d7c
lea edx, [esp + 0xd8]
sub edx, eax
jmp 0x10002d10
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10002d10
push 0x1001bf08
push ebx
call esi
add esp, 8
cmp eax, ebx
je 0x10002d7c
lea edx, [esp + 0xc]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10002d30
push 0x1001bf08
push ebx
call esi
add esp, 8
cmp eax, ebx
je 0x10002d7c
lea edx, [esp + 0x40]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10002d50
push 0x1001bf08
push ebx
call esi
add esp, 8
cmp eax, ebx
je 0x10002d7c
lea edx, [esp + 0x170]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10002d72
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 4
cmp eax, ebx
je 0x10002f04
push ebp
push edi
push eax
push ebx
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov ebp, dword [sym.imp.MSVCR90.dll__stricmp]
lea ecx, [esp + 0x48]
push str.BELOW_NORMAL
push ecx
mov dword [esp + 0x18], eax
xor edi, edi
call ebp
add esp, 8
test eax, eax
jne 0x10002dde
push 0x4000
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, eax
jmp 0x10002edb
lea edx, [esp + 0x48]
push str.NORMAL
push edx
call ebp
add esp, 8
test eax, eax
jne 0x10002e01
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, eax
jmp 0x10002edb
lea eax, [esp + 0x48]
push str.HIGH
push eax
call ebp
add esp, 8
test eax, eax
jne 0x10002e27
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, eax
jmp 0x10002edb
lea ecx, [esp + 0x48]
push str.ABOVE_NORMAL
push ecx
call ebp
add esp, 8
test eax, eax
jne 0x10002e4d
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, eax
jmp 0x10002edb
lea edx, [esp + 0x48]
push str.REALTIME
push edx
call ebp
add esp, 8
test eax, eax
jne 0x10002e70
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, eax
jmp 0x10002edb
lea eax, [esp + 0x48]
push 0x1001c2a0
push eax
call ebp
add esp, 8
test eax, eax
jne 0x10002edb
push 0x95
lea ecx, [esp + 0xe5]
push ebx
push ecx
mov byte [esp + 0xec], bl
call sub.MSVCR90.dll_memset
lea edx, [esp + 0x184]
push edx
lea eax, [esp + 0xf0]
push str.process_where_name__s__call_setpriority_64
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
push ebx
push ebx
lea ecx, [esp + 0xe8]
push ecx
push str.wmic.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, 1
cmp dword [esp + 0x10], ebx
je 0x10002ef7
cmp edi, ebx
je 0x10002ef7
mov edx, dword [esp + 0x218]
push edx
mov ecx, 0x10022890
call fcn.100019c0
pop edi
pop ebp
cmp esi, ebx
je 0x10002f04
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x208]
pop esi
pop ebx
xor ecx, esp
call fcn.100190a2
add esp, 0x204
ret 4