Function at 0x10044053
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x10], ebx
jmp 0x10044073
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x44], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10044065
push 2
mov dword [ebp - 0x3c], 5
pop edi
jmp 0x100440e6
mov dword [ebp - 0xc], 0xf4a8b108
mov dword [ebp - 0x10], ebx
jmp 0x1004409f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x34], 0x4b13281d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10044091
mov dword [ebp - 0xc], ebx
jmp 0x100440dd
mov dword [ebp - 8], 0xfffffffc
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
jge 0x100440da
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], ebx
jl 0x100440d5
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x34], ebx
jne 0x100440d5
dec dword [ebp - 0x10]
jns 0x100440c7
inc dword [ebp - 8]
js 0x100440b8
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe6
jg 0x100440a9
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xf
jg 0x10044085
lea eax, [ebp - 1]
mov byte [ebp - 1], bl
push eax
push ebx
call fcn.100445d7
pop ecx
pop ecx
cmp dword [esi], ebx
je 0x10044332
push dword [esi]
push ebx
push dword [esi + 4]
call fcn.10026bde
mov dword [ebp - 8], 5
add esp, 0xc
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x18], 0xa7ab5bf7
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 8], ebx
jmp 0x10044208
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
jmp 0x1004414e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x24], 0x997736ea
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x10044140
mov dword [ebp - 0xc], ebx
jmp 0x10044162
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2c], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x10044158
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
imul eax, eax, 0xfffb
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xffff
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, 0x7d3709e8
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x1c]
add eax, ecx
je 0x100441fa
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0x4c3dc4d7
setne cl
cmp ecx, edi
jb 0x100441fa
xor ecx, ecx
inc ecx
jmp 0x100441fc
mov ecx, ebx
mov eax, dword [ebp - 0xc]
imul eax, ecx
mov dword [ebp - 0xc], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 6
jl 0x10044135
push dword [esi + 4]
call fcn.1006f252
mov dword [ebp - 8], 1
mov eax, 0x66c93ee3
mov dword [ebp - 0x54], eax
xor edx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
pop ecx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, ecx
push 3
setge dl
imul edx, dword [ebp - 8]
pop edi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 8], ebx
jmp 0x100442d6
mov dword [ebp - 0x18], 0xb1c03809
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x100442ca
mov dword [ebp - 0xc], 0xd7540573
mov dword [ebp - 0xc], ebx
jmp 0x100442c0
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x10], ebx
jmp 0x100442a9
cmp byte [ebp - 2], bl
je 0x100442a6
push ebx
push 0x42b
push 0x7f21
push 0x4597
push 0xc8b
push 0x1d4f
call fcn.100484fb
add esp, 0x18
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
mov byte [ebp - 2], bl
jle 0x1004427f
cmp byte [ebp - 2], bl
je 0x100442bd
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x10044273
dec dword [ebp - 0x18]
jns 0x10044267
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x54], ebx
jne 0x100442df
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x10044258
mov dword [esi + 4], ebx
mov dword [ebp - 0x14], 0x24ec2e0c
mov dword [ebp - 0x14], 0xffffffeb
jmp 0x10044313
mov byte [ebp - 2], bl
cmp byte [ebp - 2], bl
je 0x10044310
push 0x184b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff5
je 0x100442f2
push 0x73ab
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x3a09
call fcn.10047e0f
add esp, 0x10
mov dword [esi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret