Function at 0x1002d16
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x314], 0xffffffff
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call sub.msvcrt.dll_memset
mov esi, 0x1001214
lea edi, [ebp - 0x20c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xf8
lea eax, [ebp - 0x200]
push ebx
push eax
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
push 0xa
pop ecx
mov esi, 0x1001220
lea edi, [ebp - 0x310]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xd9
lea eax, [ebp - 0x2e5]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x24
cmp dword [ebp + 8], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendA]
je 0x1002e7f
push 0x44
lea eax, [ebp - 0x368]
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov word [ebp - 0x338], ax
lea edi, [ebp - 0x324]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x1008670
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x368], 0x44
mov dword [ebp - 0x33c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x100124c
lea eax, [ebp - 0x108]
push eax
call ebx
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x310]
call fcn.01002b25
lea eax, [ebp - 0x324]
push eax
xor ecx, ecx
lea eax, [ebp - 0x368]
push eax
push ecx
push ecx
push ecx
push 1
push ecx
push ecx
lea eax, [ebp - 0x310]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1002e73
push 0xffffffffffffffff
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x324]
call esi
push dword [ebp - 0x320]
call esi
jmp 0x1002e7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x314], eax
push 0x44
lea eax, [ebp - 0x368]
push 0
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x324]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x1008670
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x368], 0x44
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.01002c58
test eax, eax
lea eax, [ebp - 0x108]
je 0x1002ed0
push 0x100125c
jmp 0x1002ed5
push 0x1001274
push eax
call ebx
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x20c]
call fcn.01002b25
cmp dword [ebp + 8], 0
je 0x1002eff
mov eax, 0x100128c
lea ecx, [ebp - 0x20c]
call fcn.01002b25
lea eax, [ebp - 0x324]
push eax
xor ecx, ecx
lea eax, [ebp - 0x368]
push eax
push ecx
push ecx
push ecx
push 1
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1002f61
push 0xffffffffffffffff
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x324]
call esi
push dword [ebp - 0x320]
call esi
mov eax, dword [ebp - 0x314]
jmp 0x1002f67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006dd6
leave
ret 4