Function at 0x10083c1
Capabilities:
Create process on windows
Resume thread

Disassembly:
push 0x20
push 0x10084b0
call fcn.010015a0
mov edi, ecx
mov dword [ebp - 0x30], edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 8], esi
je 0x102086d
mov ecx, edi
call fcn.01002920
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1020932
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
mov ecx, edi
call fcn.01007941
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1020965
mov ebx, 0x1040184
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x1008459
test byte [eax + 0x1c], 0x20
je 0x1008459
cmp byte [eax + 0x19], 4
jb 0x1008459
push dword [edi + 0x78]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x100186c
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100994f
mov esi, dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [edi + 0x78]
push dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
or eax, 0x404
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x48]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x10209ac
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], 0xfffffffe
call fcn.010084d1
mov eax, dword [ebp - 0x1c]
call fcn.01001580
ret 0x18
mov eax, dword [edi + 0x28]
mov eax, dword [eax + 0x58]
cmp eax, 2
je 0x1020884
mov dword [ecx + 8], 0x1007e44
jmp 0x10083f2
mov ecx, dword [edi + 0x28]
mov eax, dword [ecx + 0x58]
lea edx, [ebp - 0x24]
push edx
push eax
call fcn.0102babf
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x10208d9
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1008494
test byte [eax + 0x1c], 0x20
je 0x1008494
cmp byte [eax + 0x19], 2
jb 0x1008494
push dword [ebp - 0x1c]
push 0x100186c
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x1008494
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10208e6
sub eax, edx
sar eax, 1
lea esi, [eax + 9]
lea eax, [esi + esi]
push eax
mov ecx, edi
call fcn.01003587
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 8], eax
test eax, eax
jne 0x1020918
mov dword [ebp - 0x1c], 0xe
jmp 0x1008494
push dword [ebp - 0x24]
push 0x1020a4c
push esi
push eax
call fcn.01004d53
add esp, 0x10
mov dword [ebp - 0x1c], eax
jmp 0x10083f2
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1008494
test byte [eax + 0x1c], 0x20
je 0x1008494
cmp byte [eax + 0x19], 2
jb 0x1008494
push dword [ebp - 0x1c]
push 0x100186c
push 0x2e
jmp 0x10208c9
mov eax, dword [0x1040184]
mov ebx, 0x1040184
cmp eax, ebx
je 0x1020999
test byte [eax + 0x1c], 0x20
je 0x1020999
cmp byte [eax + 0x19], 2
jb 0x1020999
push dword [ebp - 0x1c]
push 0x100186c
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
mov eax, dword [0x1040184]
cmp dword [edi + 0x4c], 0
je 0x1008494
and dword [ebp - 0x1c], 0
jmp 0x100842e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x1008494
test byte [eax + 0x1c], 0x20
je 0x1008494
cmp byte [eax + 0x19], 2
jb 0x1008494
push dword [ebp - 0x1c]
push 0x100186c
push 0x31
jmp 0x10208c9