Function at 0x10068380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov ecx, dword [0x100d5788]
xor ecx, ebp
mov dword [ebp - 4], ecx
and al, 1
mov byte [ebp - 0x59], al
lea eax, [ebp - 0x48]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1007fc80
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 0
mov edx, dword [ebp + 8]
xor eax, eax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x58]
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10034fa0
test byte [ebp - 0x59], 1
je 0x100687ba
mov eax, dword [0x100d50c0]
or eax, dword [0x100d50c4]
add eax, 0xaf67780
add eax, 0x8233a070
and eax, 0x1c56e72d
xor eax, 0x6b241dd1
and eax, 0xa16eb447
or eax, 0xfa3cf50a
add eax, 0xf5b336c4
add eax, 0xe3e01130
imul eax, eax, 0x6cc7977
xor eax, 0x5dd29c8a
and eax, 0xd90e6f41
imul eax, eax, 0x59d9f0ef
xor eax, 0xf5c1663c
xor eax, 0xc8d4052b
xor eax, 0x74888c21
mov ecx, 0xc917950b
xor edx, edx
div ecx
xor eax, 0x40fed4db
or eax, 0x9299c908
and eax, 0x7fb1e0b5
mov ecx, 0x49ca795a
xor edx, edx
div ecx
add eax, 0x7944badf
xor eax, 0xaaa76b76
add eax, 0x37f72d80
add eax, 0x392bc35f
and eax, 0x45d8a48a
add eax, 0x52b701ee
and eax, 0xe3ed3d6e
and eax, 0x4c9635ea
add eax, 0xc9f1b713
sub eax, 0x2df3b46
imul eax, eax, 0x284e94e0
imul eax, eax, 0xa858b67e
xor eax, 0x60f5dcda
add eax, 0x8bdad451
sub eax, 0xbf0719f1
add eax, 0xf7a1e34d
mov ecx, 0xc622f627
xor edx, edx
div ecx
and eax, 0x3f543bac
imul eax, eax, 0x4e347108
mov ecx, 0x18b0d904
xor edx, edx
div ecx
and eax, 0x4efce63f
and eax, 0xd833e6a
imul eax, eax, 0x78d4be4e
imul eax, eax, 0x909d60b6
or eax, 0x28873f88
imul eax, eax, 0x3993a0a0
xor eax, 0x16f09591
and eax, 0xcede99c7
or eax, 0xda37df0e
xor eax, 0xcb0a41e3
and eax, 0x9fa0663a
xor eax, 0xeee22de5
add eax, 0xb9b752cc
xor eax, 0xd1ba71c4
and eax, 0xdd86f957
and eax, 0x7f86e249
add eax, 0x290a4e54
and eax, 0x9ef03535
and eax, 0xd049e9bb
add eax, 0x4ba22806
sub eax, 0x7ac7ec76
imul eax, eax, 0x936f11f5
xor eax, 0xcad00f23
and eax, 0xc429d2d9
sub eax, 0x87ccc52e
mov ecx, 0x864584f3
xor edx, edx
div ecx
and eax, 0x2b2c6346
add eax, 0x3b3485e6
sub eax, 0x408615c8
mov ecx, 0x98830482
xor edx, edx
div ecx
add eax, 0x9acbe5e5
mov ecx, 0x8e4fbee5
xor edx, edx
div ecx
cmp eax, 0x86c13e7e
ja 0x100687f3
mov eax, dword [0x100d50c8]
or eax, dword [0x100d50cc]
mov ecx, 0x2c96aafc
xor edx, edx
div ecx
xor eax, 0x74715d02
imul eax, eax, 0xe5107050
add eax, 0xd7a95eb4
or eax, 0x992af1c0
add eax, 0x332017e1
sub eax, 0x110f1fca
or eax, 0x79df8338
add eax, 0xe1f8c97f
add eax, 0x4f6c2747
sub eax, 0xe67dbac5
xor eax, 0x72bd0dc1
and eax, 0x2bd4ed20
and eax, 0xae851431
imul eax, eax, 0x998750dd
imul eax, eax, 0xe5a2edb1
sub eax, 0x3a1a3eb
mov ecx, 0x4c0cba6
xor edx, edx
div ecx
xor eax, 0x39f264f4
or eax, 0x9c1cd2b6
xor eax, 0x24891a76
and eax, 0xcb3ab490
sub eax, 0x755fe141
mov ecx, 0x84b70fd7
xor edx, edx
div ecx
imul eax, eax, 0xc62b6b80
xor eax, 0x973bcd21
mov ecx, 0x96ab0ef3
xor edx, edx
div ecx
or eax, 0xcee27a2
imul eax, eax, 0x69490268
and eax, 0x72ee02e2
xor eax, 0x91a9906d
or eax, 0xcf194e78
or eax, 0xcf7f0bc9
xor eax, 0x8e819075
and eax, 0x86f418ab
imul eax, eax, 0x64a0421f
or eax, 0x7767ebc
xor eax, 0xaeda485d
xor eax, 0xc7415d36
add eax, 0x9d419b57
sub eax, 0x52d30686
sub eax, 0x5e7afa19
add eax, 0xb702ea19
mov ecx, 0x109acc3c
xor edx, edx
div ecx
mov ecx, 0x8b1d1105
xor edx, edx
div ecx
xor eax, 0x762e58ae
or eax, 0x837cafdb
add eax, 0x3705893b
xor eax, 0xeff607da
xor eax, 0x78cf2975
or eax, 0x2c7a0c15
sub eax, 0x6045e2e1
imul eax, eax, 0x1a0be7ed
and eax, 0x79d38755
imul eax, eax, 0xefbd2847
mov ecx, 0xc406ceac
xor edx, edx
div ecx
xor eax, 0x204ea509
mov ecx, 0x9181a8a4
xor edx, edx
div ecx
and eax, 0xaeaab544
sub eax, 0xbea88e61
add eax, 0xa48e2611
xor eax, 0xca617e72
or eax, 0xa67a7e61
and eax, 0xdd10258e
add eax, 0xa821291b
imul eax, eax, 0xa02edc61
add eax, 0x72b398e5
and eax, 0x8c517e64
or eax, 0xfedef8f2
add eax, 0x3a6fbda5
sub eax, 0x4d85e1b4
imul eax, eax, 0x567ac482
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [ebp - 0x60]
cmp eax, 0x778ac86f
je 0x100687f3
jmp 0x100687ba
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007c2bf
mov eax, dword [ebp - 0x64]
add esp, 0x8c
pop ebp
ret
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
jmp 0x100685f0