Function at 0x100bda74
Capabilities:
Create process on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x31c], edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x340], ebx
lea edi, [ebp - 0x33c]
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x3a0]
push ebx
push eax
mov dword [ebp - 0x3a4], 0x44
call sub.MSVCR100.dll_memset
xor eax, eax
mov dword [ebp - 0x354], ebx
lea edi, [ebp - 0x350]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x103
stosd dword es:[edi], eax
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.MSVCR100.dll_memset
xor esi, esi
inc esi
push 0x100be1f4
mov dword [ebp - 0x334], esi
call fcn.10038a9d
mov edi, dword [ebp - 0x31c]
add esp, 0x1c
test edi, edi
je 0x100be154
call fcn.1002368c
test eax, eax
je 0x100bdb33
call fcn.10024772
test eax, eax
je 0x100be154
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
mov dword [ebp - 0x338], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [ebp - 0x340], 0xc
call esi
mov dword [ebp - 0x328], eax
test eax, eax
je 0x100be154
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call esi
mov dword [ebp - 0x320], eax
test eax, eax
je 0x100be12a
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call esi
mov dword [ebp - 0x344], eax
test eax, eax
je 0x100be12a
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
mov dword [ebp - 0x314], esi
test esi, esi
je 0x100be12c
xor eax, eax
push eax
push 0x9c9c
push eax
push 4
lea eax, [ebp - 0x340]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x330], eax
test eax, eax
je 0x100be12c
xor ecx, ecx
push ecx
push ecx
push ecx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x324], esi
test esi, esi
je 0x100be116
push 0x9c9c
xor eax, eax
push eax
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [esi], 0x9c9c
mov dword [esi + 4], 0x20000
mov eax, dword [edi]
push edi
call dword [eax]
mov dword [esi + 0x28], eax
test eax, eax
je 0x100be10f
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov dword [esi + 8], eax
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov dword [esi + 0xc], eax
mov eax, dword [edi]
push edi
call dword [eax + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [edi]
lea eax, [esi + 0x8470]
push eax
push edi
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x328]
mov ecx, dword [ebp - 0x318]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x320]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x314]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x344]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x4c], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x14]
xor ecx, ecx
mov dword [esi + 0x44], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 0xc
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], 0x21
mov dword [esi + 0x3c], 2
mov eax, dword [edi]
push edi
call dword [eax + 0x20]
test eax, eax
lea eax, [esi + 0x2c]
jne 0x100bdccf
or dword [eax], 0x80
mov ecx, dword [ebp - 0x318]
xor edx, edx
cmp dword [ecx + 0x20], edx
je 0x100bdce0
or dword [esi + 0x38], 4
mov edx, dword [ebp - 0x32c]
test edx, edx
je 0x100bdd12
xor edi, edi
cmp word [edx], di
mov edi, dword [ebp - 0x31c]
je 0x100bdd12
or dword [eax], 1
push edx
push 0x400
lea eax, [esi + 0x9ac]
push eax
call fcn.100bf15e
mov ecx, dword [ebp - 0x318]
xor eax, eax
cmp dword [ecx + 0xc], eax
je 0x100bdd31
or dword [esi + 0x2c], 1
push dword [ecx + 0xc]
lea eax, [esi + 0x9ac]
push 0x400
push eax
call fcn.100bf15e
mov ecx, dword [edi]
push 0x400
lea eax, [esi + 0x9ac]
push eax
push edi
call dword [ecx + 0x18]
test eax, eax
je 0x100bdd4b
or dword [esi + 0x2c], 1
mov ecx, dword [ebp - 0x318]
cmp dword [ecx + 0x10], ebx
je 0x100bdd6d
push 0x400
lea eax, [esi + 0x19ac]
push eax
push dword [ecx + 0x10]
call fcn.100b88c6
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x40], eax
call fcn.100be71c
push eax
push 0x100be210
lea eax, [esi + 0x59c]
push 0xffffffffffffffff
push eax
call fcn.100be2a8
push 0x104
lea eax, [esi + 0x50]
push eax
push 0x100be21c
call fcn.100b88c6
add esp, 0x1c
lea edi, [esi + 0x7a4]
push 0x1f
pop ecx
mov esi, 0x100be178
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x318]
mov esi, dword [ebp - 0x324]
cmp dword [edi + 4], ebx
je 0x100bddd7
push 0x38
lea eax, [esi + 0x21ac]
push eax
push dword [edi + 4]
call fcn.100b88c6
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x100bddf3
push 0x104
lea eax, [esi + 0x3d1c]
push eax
push dword [edi + 8]
call fcn.100b88c6
add esp, 0xc
mov edi, dword [ebp - 0x31c]
mov eax, dword [edi]
push 0x104
lea ecx, [esi + 0x258]
push ecx
push edi
call dword [eax + 0x1c]
test eax, eax
jne 0x100bde39
call fcn.100c6e44
xor edx, edx
push 0x104
lea ecx, [esi + 0x258]
push ecx
cmp word [eax], dx
je 0x100bde32
push eax
call fcn.100b88c6
add esp, 0xc
jmp 0x100bde39
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.100bc0e8
pop ecx
pop ecx
test eax, eax
je 0x100be10f
push dword [ebp - 0x330]
lea eax, [ebp - 0x108]
push eax
push 0x100be244
lea eax, [ebp - 0x310]
push 0xffffffffffffffff
push eax
call fcn.100be2c8
lea eax, [ebp - 0x310]
push eax
push 0x100be254
call fcn.10038a9d
add esp, 0x1c
lea eax, [ebp - 0x354]
push eax
xor ecx, ecx
lea eax, [ebp - 0x3a4]
push eax
push ecx
push ecx
push 0x4000020
push 1
push ecx
push ecx
lea eax, [ebp - 0x310]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100be10f
lea eax, [ebp - 0x310]
push eax
push 0x100be270
call fcn.10038a9d
mov eax, dword [edi]
pop ecx
pop ecx
push dword [ebp - 0x34c]
push edi
call dword [eax + 0x2c]
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x354]
xor ecx, ecx
inc ecx
xor eax, eax
test edx, edx
setne al
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x31c], ecx
add eax, 2
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x328]
mov dword [ebp - 0x360], ecx
mov ecx, dword [ebp - 0x320]
mov dword [ebp - 0x35c], ecx
xor ecx, ecx
push ecx
push 0x4e20
push ecx
lea ecx, [ebp - 0x360]
push ecx
push eax
mov dword [ebp - 0x358], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x100bdf4d
mov eax, dword [edi]
push edi
call dword [eax + 0x30]
jmp 0x100bdfd9
cmp eax, 1
je 0x100be00c
cmp eax, 2
je 0x100be000
cmp eax, 0x102
je 0x100bdf70
push 0x10151e
call fcn.100b86e6
xor eax, eax
push eax
push 0x4e20
push dword [ebp - 0x314]
mov dword [ebp - 0x31c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
je 0x100be00c
cmp eax, 0x80
je 0x100bdff2
xor eax, eax
push eax
push 1
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x100bdfc3
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov dword [ebp - 0x334], eax
jmp 0x100bdfcd
mov dword [ebp - 0x31c], 1
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x334], ebx
je 0x100be00c
mov eax, dword [ebp - 0x32c]
mov edx, dword [ebp - 0x324]
jmp 0x100bdf09
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100be00c
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi]
push edi
call dword [eax + 0x34]
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x100be10f
mov ecx, dword [ebp - 0x31c]
test ecx, ecx
mov ecx, dword [ebp - 0x318]
je 0x100be094
test dword [ecx + 0x18], eax
je 0x100be094
push 0x10
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [esi + 0x9a84]
test ebx, ebx
jne 0x100be078
dec eax
je 0x100be070
dec eax
je 0x100be06c
dec eax
dec eax
je 0x100be068
push 0x101520
call fcn.100b86e6
xor eax, eax
mov ebx, eax
jmp 0x100be10f
push 7
jmp 0x100be072
push 6
jmp 0x100be072
push 9
pop ebx
jmp 0x100be10f
mov dword [ebx], eax
mov eax, dword [ebp - 0x330]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x324]
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
jmp 0x100be154
test dword [ecx + 0x1c], eax
je 0x100be0c2
dec eax
je 0x100be0be
dec eax
je 0x100be0ba
dec eax
dec eax
je 0x100be0b6
sub eax, 0xc
je 0x100be0e5
push 0x101522
call fcn.100b86e6
xor eax, eax
jmp 0x100be10f
push 3
jmp 0x100be072
push 2
jmp 0x100be072
push 5
jmp 0x100be072
mov eax, dword [edi]
push edi
call dword [eax + 0x28]
test eax, eax
je 0x100be10f
mov eax, dword [esi + 0x9a84]
test eax, eax
je 0x100be105
cmp eax, 2
jbe 0x100be0f4
cmp eax, 4
je 0x100be0ea
cmp eax, 0x10
jne 0x100be105
xor ebx, ebx
inc ebx
jmp 0x100be10f
push 3
pop ebx
push 0x101523
jmp 0x100be10a
mov eax, dword [ebp - 0x318]
mov eax, dword [eax]
mov eax, dword [eax]
push dword [eax]
call fcn.100bc194
push 0x101541
call fcn.100b86e6
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x330]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x314]
jmp 0x100be12c
mov esi, ebx
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x100be149
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100be154
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100be290
call fcn.10038a9d
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret 0x10