Function at 0x102b6ed
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push esi
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
cmp eax, esi
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
je 0x102b8c2
push ebx
push eax
call fcn.0102b277
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
je 0x102b8b9
lea ecx, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push ecx
push 4
push eax
push 0x102b2c8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
je 0x102b8b1
push edi
xor eax, eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
lea edi, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
xor eax, eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
lea edi, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
rep stosd dword es:[edi], eax
push 0x104
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102b89a
push 0x102b940
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x102b89a
push dword [ebp - 0x640]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push 0x400
push 0x102b8d8
push 0x208
push eax
call fcn.0100ae15
add esp, 0x14
test eax, eax
jl 0x102b89a
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push esi
push 4
push esi
push esi
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x102b89a
push dword [ebp - 0x63c]
push dword [ebp - 0x628]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x102b874
push dword [ebp - 0x638]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 1
call edi
push dword [ebp - 0x620]
call edi
cmp dword [ebp + 0xc], esi
je 0x102b882
push 0x4ff
push 0xffffffffffffffff
push dword [ebp - 0x620]
push esi
call fcn.0101fccb
jmp 0x102b882
push 5
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x63c]
call ebx
push dword [ebp - 0x638]
call ebx
cmp dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
jne 0x102b8a8
push 5
push dword [ebp - 0x620]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x620]
call ebx
pop edi
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x628]
call ebx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
pop esi
call fcn.01001b01
leave
ret 8