Function at 0x1001b58b
Capabilities:
Create process on windows

Disassembly:
push 0x17c
mov eax, 0x10064dd1
call fcn.1004adf3
mov byte [ebp - 0xd1], dl
xor ebx, ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.1001dfc6
test al, al
jne 0x1001b5d2
xor esi, esi
jmp 0x1001b8a3
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xa0]
call fcn.10008070
push str.Ym_sPgPa
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10002e3f
push 3
pop ebx
lea edx, [ebp - 0x28]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x40]
call fcn.1000c43d
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 4
call fcn.10003705
xor esi, esi
lea ecx, [ebp - 0x40]
xor edi, edi
push esi
inc edi
push edi
call fcn.10003109
push esi
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10003109
cmp byte [ebp - 0xd1], 0
je 0x1001b65d
push str.82LTbb
lea ecx, [ebp - 0x40]
call fcn.10002e3f
mov byte [ebp - 4], 5
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0xd8], edi
call fcn.1000c43d
jmp 0x1001b68c
push str._.Pa
lea ecx, [ebp - 0x28]
call fcn.10002e3f
mov dword [ebp - 4], 7
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xd8], 4
call fcn.1000c43d
push 0xc
pop ebx
push eax
lea ecx, [ebp - 0xb8]
call fcn.10002e70
mov dword [ebp - 4], 8
test bl, 8
je 0x1001b6b4
push esi
push edi
lea ecx, [ebp - 0x88]
and ebx, 0xfffffff7
call fcn.10003109
test bl, 4
je 0x1001b6c6
push esi
push edi
lea ecx, [ebp - 0x28]
and ebx, 0xfffffffb
call fcn.10003109
test bl, 2
je 0x1001b6d8
push esi
push edi
lea ecx, [ebp - 0x70]
and ebx, 0xfffffffd
call fcn.10003109
mov byte [ebp - 4], 0xb
test bl, 1
je 0x1001b6ef
xor ebx, ebx
lea ecx, [ebp - 0x40]
push ebx
push edi
call fcn.10003109
jmp 0x1001b6f1
xor ebx, ebx
push ecx
push ecx
lea ecx, [ebp - 0x188]
call fcn.100132e4
push str._1N___Ym______Y_Ym______Y_Ym______Y_Ym______Y_Ym______Y_d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.10002e3f
push str.____Y_08HZDA0_a
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xd
call fcn.10002e3f
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x88]
call fcn.1000c43d
mov esi, eax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x70]
call fcn.1000c43d
push 5
push ecx
mov edx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x178]
call fcn.1001d5e5
pop ecx
mov ecx, eax
call fcn.1001321b
mov edx, esi
mov ecx, eax
call fcn.1001d5e5
lea edx, [ebp + 8]
mov ecx, eax
call fcn.1001d5e5
push ebx
push edi
lea ecx, [ebp - 0x70]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x88]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x40]
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
call fcn.10003109
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x188]
call fcn.10013423
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x11
push eax
lea ecx, [ebp - 0xa0]
call fcn.10002ef7
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.10002ec4
mov edi, eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x188]
call fcn.10013423
mov esi, eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0xa0]
call fcn.1000811f
push 8
pop edx
mov ecx, eax
cmp dword [edi + 0x14], edx
jb 0x1001b80e
mov edi, dword [edi]
cmp dword [esi + 0x14], edx
jb 0x1001b815
mov esi, dword [esi]
cmp dword [ecx + 0x14], edx
jb 0x1001b81c
mov ecx, dword [ecx]
cmp dword [ebp - 0xa4], edx
lea eax, [ebp - 0xb8]
push ebx
cmovae eax, dword [ebp - 0xb8]
push edi
push esi
push ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.10003109
push ebx
push 1
lea ecx, [ebp - 0x88]
call fcn.10003109
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10003109
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10003109
xor esi, esi
lea ecx, [ebp - 0xd0]
push esi
push 1
mov bl, 1
call fcn.10003109
lea ecx, [ebp - 0x188]
call fcn.10011ba2
push esi
push 1
lea ecx, [ebp - 0xb8]
call fcn.10003109
push esi
push 1
lea ecx, [ebp - 0xa0]
call fcn.10003109
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.10003109
push esi
push 1
lea ecx, [ebp + 8]
call fcn.10003109
mov al, bl
call fcn.1004ada2
ret