Function at 0x100063d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053c2e
mov eax, dword fs:[0]
push eax
sub esp, 0x37c
mov eax, dword [0x100735cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
mov ecx, eax
lea eax, [esi - 4]
jl 0x10006428
cmp ecx, dword [esi - 0x10]
jne 0x10006428
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x10006480
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x100068e3
mov eax, dword [esi - 0xc]
lea ecx, [edi + 0x10]
mov dword [edi + 4], eax
mov eax, dword [esi - 0xc]
inc eax
add eax, eax
je 0x10006480
test ecx, ecx
je 0x10006470
push eax
test esi, esi
je 0x10006461
push esi
push ecx
call fcn.10030240
add esp, 0xc
jmp 0x10006480
push 0
push ecx
call fcn.10030d40
add esp, 0xc
test esi, esi
jne 0x10006480
call fcn.10036abf
mov dword [eax], 0x16
call fcn.10034029
lea esi, [edi + 0x10]
mov dword [ebp - 0x308], esi
cmp dword [esi - 0xc], 0
mov byte [ebp - 4], 1
jne 0x1000649d
mov edi, 1
jmp 0x10006888
lea eax, [ebp - 0x300]
mov dword [ebp - 0x300], 0x168
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0x10057898
push str.http
push 1
push 0
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x10006869
xor eax, eax
mov dword [ebp - 0x2e8], 0
lea edi, [ebp - 0x2e0]
mov dword [ebp - 0x2e4], 7
mov word [ebp - 0x2f8], ax
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x100064f7
sub edi, ecx
sar edi, 1
cmp edi, 7
ja 0x1000653f
mov dword [ebp - 0x2e8], edi
lea eax, [ebp - 0x2e0]
add edi, edi
push edi
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.100307c0
add esp, 0xc
xor eax, eax
mov word [ebp + edi - 0x2f8], ax
mov eax, dword [ebp - 0x2f8]
jmp 0x10006615
mov dword [ebp - 0x30c], SysStringLen
mov dword [ebp - 0x310], 8
mov dword [ebp - 0x314], SysStringLen
mov dword [ebp - 0x318], SysStringLen
cmp edi, 0x7ffffffe
ja 0x100068e8
mov ebx, edi
mov dword [ebp - 0x31c], SysStringLen
or ebx, 7
mov dword [ebp - 0x320], 8
mov dword [ebp - 0x324], SysStringLen
mov dword [ebp - 0x328], SysStringLen
mov dword [ebp - 0x32c], ebx
cmp ebx, 0x7ffffffe
jbe 0x100065b5
mov ebx, 0x7ffffffe
jmp 0x100065c9
mov eax, 0xa
mov dword [ebp - 0x330], 0xa
cmp ebx, eax
cmovb ebx, eax
lea eax, [ebx + 1]
push eax
lea ecx, [ebp - 0x2f8]
call fcn.100047b0
mov dword [ebp - 0x2e8], edi
lea ecx, [ebp - 0x2e0]
add edi, edi
mov dword [ebp - 0x2fc], eax
push edi
push ecx
push eax
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x2e4], ebx
call fcn.10030240
mov eax, dword [ebp - 0x2fc]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2e4], 8
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 4], 2
cmovae ecx, eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x304], ecx
cmp eax, 2
jb 0x10006662
dec eax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x2fc], eax
sub eax, ecx
sar eax, 1
je 0x10006662
nop word [eax + eax]
cmp word [ecx], 0x25
je 0x10006766
add ecx, 2
sub eax, 1
jne 0x10006650
push 1
push 0x100578b8
lea ecx, [ebp - 0x2f8]
call fcn.10006af0
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006680
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x2f8]
call fcn.10006af0
mov ecx, 0x44
lea eax, [ebp - 0x388]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100066a7
mov ecx, 0x10
lea eax, [ebp - 0x344]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100066c0
cmp dword [ebp - 0x2e4], 8
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x388]
mov dword [ebp - 0x388], 0x44
push ecx
lea eax, [ebp - 0x2f8]
cmovae eax, dword [ebp - 0x2f8]
push 0
push eax
push 0
call fcn.10006900
add esp, 0x14
test eax, eax
je 0x10006808
push dword [ebp - 0x344]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x340]
call edi
mov edx, dword [ebp - 0x2e4]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x100067e3
mov ecx, dword [ebp - 0x2f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100067d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100068ed
jmp 0x100067d9
test ecx, ecx
je 0x10006662
mov edx, 0x100578b0
mov ebx, ecx
mov edi, 2
sub ebx, edx
nop dword [eax]
mov ax, word [ebx + edx]
cmp ax, word [edx]
jne 0x100067cb
add edx, 2
sub edi, 1
jne 0x10006780
sub ecx, dword [ebp - 0x304]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x10006662
mov edx, esi
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100067a7
sub edx, edi
sar edx, 1
push edx
push esi
push 2
push ecx
lea ecx, [ebp - 0x2f8]
call fcn.10006c70
jmp 0x1000669c
mov eax, dword [ebp - 0x2fc]
add ecx, 2
jmp 0x10006644
push edx
push ecx
call fcn.10028072
add esp, 8
xor eax, eax
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 7
mov word [ebp - 0x2f8], ax
lea edi, [eax + 1]
jmp 0x10006888
mov edx, dword [ebp - 0x2e4]
mov byte [ebp - 4], 1
cmp edx, 8
jb 0x1000684c
mov ecx, dword [ebp - 0x2f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006842
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100068f2
push edx
push ecx
call fcn.10028072
add esp, 8
xor eax, eax
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 7
mov word [ebp - 0x2f8], ax
push 0xa
push 0
push 0
push esi
push 0x10057898
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb edi, edi
neg edi
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100068a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x100068c5
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10028080
mov esp, ebp
pop ebp
ret
call fcn.10006ae0
call fcn.10004730
call fcn.10034039
call fcn.10034039
int3