Function at 0x10019c2a
Capabilities:
Create process on windows
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
mov dword [ebp - 0x38], edx
xor ebx, ebx
mov dword [ebp - 0x2c], 0x824a8c6a
mov esi, ecx
push edi
mov dword [ebp - 0x2c], ebx
jmp 0x10019c70
mov dword [ebp - 4], 0x1d69f428
mov dword [ebp - 4], ebx
jmp 0x10019c67
lea eax, [ebp - 0x1d]
mov byte [ebp - 0x1d], bl
push eax
push ebx
call fcn.1001d245
inc dword [ebp - 4]
pop ecx
pop ecx
cmp dword [ebp - 4], 8
jle 0x10019c55
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 9
jne 0x10019c49
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.1001d30a
pop ecx
mov dword [ebp - 4], 0x57a7c203
pop ecx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], 0xe26b5cfd
push 2
mov dword [ebp - 0x18], 0x99fa
mov dword [ebp - 4], ebx
pop edi
jmp 0x10019cb4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48], 0x7862fd41
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10019ca6
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], ebx
jl 0x10019da7
mov dword [ebp - 0x14], 0x17b4d2c2
mov dword [ebp - 0x10], ebx
jmp 0x10019ce2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64], 0xa756
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10019cd4
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], 0xfffffffc
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
cmp eax, ecx
mov eax, dword [ebp - 0x58]
setge dl
xor ecx, ecx
cmp edx, eax
push 9
setle cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
pop ecx
setle dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x3ff14eb4
setg al
xor edx, edx
cmp eax, 8
mov eax, dword [ebp - 0x58]
setne dl
sub ecx, edx
add eax, ecx
cmp eax, dword [ebp - 0x58]
jg 0x10019d52
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x58]
je 0x10019db3
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], ebx
jl 0x10019d7c
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
test eax, eax
sete cl
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0x10]
jns 0x10019d66
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x10019d9b
push 0x748
push 0x85
push ebx
push 0xfdf
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor ecx, ecx
inc ecx
dec dword [ebp - 4]
jns 0x10019cc8
cmp dword [esi + 0x10], ebx
jne 0x10019e15
xor al, al
jmp 0x1001a642
xor ecx, ecx
mov dword [ebp - 8], ebx
inc ecx
jmp 0x10019dc9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x78], 0x5d0
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10019dbb
mov dword [ebp - 8], ebx
jmp 0x10019e0e
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
xor edx, edx
mov dword [ebp - 0x78], ecx
inc ecx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
inc dword [ebp - 8]
inc ecx
cmp dword [ebp - 8], ecx
jle 0x10019dd3
jmp 0x10019d9e
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xfffffffb
mov dword [ebp - 8], ebx
jmp 0x10019e2e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1c], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10019e24
mov dword [ebp - 8], ebx
jmp 0x10019e46
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x30], 0xa6d0811
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10019e38
push 3
mov dword [ebp - 8], ebx
pop edi
jmp 0x10019e5d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10019e53
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg ecx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
push 7
setg dl
pop eax
cmp edx, 0xe2db58e4
ja 0x10019faf
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xc964b5ad
mov dword [ebp - 4], ebx
jmp 0x10019ec2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xec], 0xfffffffc
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10019eb1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
dec eax
imul ecx, eax
mov eax, dword [ebp - 8]
cmp ecx, 0xd6b22149
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 8]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [ebp - 8]
add eax, 7
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setle cl
xor edx, edx
cmp ecx, 0xc844fc3
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 8]
cmp ecx, eax
setne dl
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 4], 0x23fe2983
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x4c]
je 0x10019f5e
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
sub eax, 0xf3a8a1d5
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 8], ebx
jne 0x10019f91
cmp dword [ebp - 0x14], ebx
jne 0x10019f91
mov ecx, ebx
jmp 0x10019f94
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x594a39b7
push 7
setne al
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0xe4], eax
jmp 0x10019fc9
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x10019fc9
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x100a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x10], ebx
jmp 0x10019ffe
mov dword [ebp - 0x18], 0xb78960bd
cmp dword [ebp - 0x30], ebx
jne 0x1001a003
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
sub edx, 0xffc8ecea
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10019fce
push ebx
call fcn.1001a6ca
mov dword [ebp - 0x18], 0xa684
mov byte [ebp - 9], bl
pop ecx
cmp byte [ebp - 9], bl
je 0x1001a021
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001a03b
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
lea eax, [ebp - 0x38]
push 0x3ef2
push eax
call fcn.1001cff0
mov dword [ebp - 0x10], 0xffffffff
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 8], ebx
jmp 0x1001a07b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb0], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1001a06a
mov dword [ebp - 8], ebx
jmp 0x1001a096
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x118], 0xa6aed1d2
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1001a085
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
push 0xfffffffffffffff6
setge dl
pop eax
test edx, edx
jne 0x1001a100
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x14], eax
jmp 0x1001a10e
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001a10e
call dword [sym.imp.KERNEL32.dll_GetACP]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001a11d
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5a74d4b4
mov dword [ebp - 8], ebx
jmp 0x1001a141
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x24], 0x9c9fb37b
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x1001a133
mov dword [ebp - 8], ebx
jmp 0x1001a15d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9c], 0x83989226
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1001a14c
cmp dword [ebp - 0x24], ebx
jne 0x1001a1cc
mov eax, dword [ebp - 0x94]
sub eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0x7356a0b3
imul eax, dword [ebp - 0x90]
test eax, eax
jne 0x1001a193
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x90]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
sub edx, 0xb333
neg edx
sbb edx, edx
inc edx
sub edx, eax
jne 0x1001a1cc
mov eax, ebx
jmp 0x1001a1cf
xor eax, eax
inc eax
xor edx, edx
cmp eax, 0x3f6a0837
mov eax, dword [ebp - 0x90]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x24]
jle 0x1001a1f7
cmp dword [ebp - 0x14], ebx
jne 0x1001a1f7
mov dword [ebp - 0x24], ebx
mov eax, ebx
jmp 0x1001a201
xor eax, eax
mov dword [ebp - 0x24], 1
inc eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x26]
push ebx
push eax
mov byte [ebp - 0x26], bl
call fcn.1001ca53
cmp dword [esi + 0x14], 0x10
pop ecx
pop ecx
jb 0x1001a21d
mov ecx, dword [esi]
jmp 0x1001a21f
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x34], ecx
jb 0x1001a22c
mov edx, dword [esi]
jmp 0x1001a22e
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001a592
mov dword [ebp - 8], 0xa66fe7d8
mov dword [ebp - 4], ebx
jmp 0x1001a258
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa4], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001a247
xor ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], ebx
jl 0x1001a32e
mov dword [ebp - 0x10], 0xfffffffd
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xa4], ebx
jne 0x1001a32e
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ebx
jl 0x1001a325
mov dword [ebp - 4], ebx
jmp 0x1001a2a6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdc], 0xfffffff8
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001a295
mov dword [ebp - 0xd0], ecx
cmp dword [ebp - 0xd0], ebx
jl 0x1001a31c
mov dword [ebp - 4], 0xd2ab60e7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa4], edi
mov dword [ebp - 4], 0xffffffe2
cmp dword [ebp - 4], 0xffffffe5
jl 0x1001a314
mov dword [ebp - 0x14], 0x84217059
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x1001a301
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001a2fc
push ebx
push 0x65a
call fcn.1001d280
pop ecx
pop ecx
dec dword [ebp - 0x14]
jns 0x1001a2e7
xor cl, cl
call fcn.100194b8
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe5
push 1
pop ecx
jge 0x1001a2d8
dec dword [ebp - 0xd0]
jns 0x1001a2ba
dec dword [ebp - 0x10]
jns 0x1001a290
dec dword [ebp - 8]
jns 0x1001a26d
mov eax, dword [ebp - 0x34]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001a3ce
cmp al, 0x39
jg 0x1001a3ce
mov dword [ebp - 4], ebx
jmp 0x1001a356
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0xac204e2d
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001a348
mov dword [ebp - 0x40], ebx
jmp 0x1001a397
mov dword [ebp - 4], ebx
jmp 0x1001a377
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf8], 0x97f0a290
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001a366
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001a38b
push ebx
call fcn.1001d382
pop ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xf4], eax
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x13
jg 0x1001a361
push ebx
call fcn.1001cd0a
mov dword [esp], 0x3666
lea eax, [ebp - 0x34]
push 0x5d73
push eax
push ebx
lea eax, [ebp - 0x38]
push 0x242c
push eax
call fcn.1001ce3b
mov ecx, dword [ebp - 0x34]
add esp, 0x18
inc ecx
jmp 0x1001a21f
mov dword [ebp - 4], 0x33a4
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xeda58528
mov dword [ebp - 0x18], 0x52aa0a5d
mov dword [ebp - 0x18], 0x7e813a3d
mov dword [ebp - 0x18], 0x63782845
mov dword [ebp - 0x10], ebx
jmp 0x1001a40e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe0], 0x2e65251c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001a3fd
cmp dword [ebp - 4], ebx
je 0x1001a4a2
mov dword [ebp - 4], ebx
jmp 0x1001a432
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x130], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001a421
push 7
pop eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffff5
jge 0x1001a4a7
push 0xfffffffffffffffe
pop esi
mov dword [ebp - 0x10], 0x8c9f3690
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 2
jg 0x1001a497
mov dword [ebp - 0x74], esi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x70], esi
push eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x7c], 0xf1fc
push ebx
call fcn.1001a687
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
pop ecx
pop ecx
jle 0x1001a46c
xor ecx, ecx
inc ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff5
jl 0x1001a446
jmp 0x1001a4a7
call fcn.100194b8
lea eax, [ebp - 0x38]
push eax
push 0x6ce
push 0x5386
push 0x35f6
push 0x7c68
push 0x56a0
push 0x7769
push ebx
push 0x156c
push 0x6602
call fcn.1001d3a3
mov dword [ebp - 0x10], 1
add esp, 0x28
mov dword [ebp - 8], ebx
jmp 0x1001a4f9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x108], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1001a4e8
mov dword [ebp - 8], ebx
jmp 0x1001a511
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x124], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1001a504
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xffffffe2
jge 0x10019dac
push 0xc
pop esi
mov dword [ebp - 4], 0x33843046
mov dword [ebp - 4], ebx
jmp 0x1001a543
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x8c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001a532
mov dword [ebp - 0x80], ebx
jmp 0x1001a55d
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x108], ebx
jne 0x1001a562
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], edi
jle 0x1001a54e
mov dword [ebp - 4], esi
jmp 0x1001a57f
lea eax, [ebp - 0x25]
mov byte [ebp - 0x25], bl
push eax
push ebx
push 0x2b22
call fcn.1001c963
add esp, 0xc
dec dword [ebp - 4]
cmp dword [ebp - 4], esi
jge 0x1001a567
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jl 0x1001a526
jmp 0x10019dac
mov dword [ebp - 0x10], 0x6915a136
mov dword [ebp - 4], ebx
jmp 0x1001a5af
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], 0x8ec0
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001a59e
push 2
pop edi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1001a624
mov dword [ebp - 4], 0xcd53bc6e
mov dword [ebp - 0x14], 0xfada
mov dword [ebp - 0x18], 0xe75cb554
mov dword [ebp - 4], edi
cmp dword [ebp - 4], ebx
jl 0x1001a619
xor edx, edx
inc edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x1001a5f6
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xb8], 4
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setge cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 4]
jns 0x1001a5df
mov eax, dword [ebp - 0xb4]
dec dword [ebp - 0x10]
jns 0x1001a5bf
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001a640
push ebx
push ebx
push ebx
push ebx
push 0x26fd
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret