Function at 0x100c631b
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x78
push esi
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ecx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov esi, dword [ebp + 0xc]
mov edi, eax
or dword [esp + 8], 0xffffffff
push 2
push 1
mov esi, dword [esi]
mov eax, esi
sar eax, 6
and esi, 0x3f
imul ecx, esi, 0x38
mov eax, dword [eax*4 + 0x10105340]
mov eax, dword [eax + ecx + 0x18]
xor ecx, ecx
push ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x14]
push ecx
push edi
push eax
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x100c654b
mov esi, dword [ebp + 0xc]
push dword [esi]
call sym.ucrtbase.dll__close
mov edx, dword [esp + 0x20]
or dword [esi], 0xffffffff
pop ecx
mov ecx, dword [esi + 4]
call fcn.1009f7fe
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
test eax, eax
je 0x100c6542
xor ecx, ecx
call fcn.100c6bd0
mov dword [esp + 0xc], eax
test eax, eax
je 0x100c6539
call fcn.100c689a
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x100c63ca
mov edi, 0x1000b498
push 0x44
pop esi
xor eax, eax
push esi
push eax
lea eax, [esp + 0x40]
push eax
call sym.ucrtbase.dll__o_memset
mov ecx, dword [0x10105340]
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x64], 0x100
jne 0x100c6400
mov eax, dword [esp + 8]
mov dword [esp + 0x70], eax
jmp 0x100c6411
cmp dword [ebp + 8], 1
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 8]
je 0x100c6414
mov eax, dword [ecx + 0x50]
mov dword [esp + 0x74], eax
xor esi, esi
mov eax, dword [ecx + 0x88]
mov ecx, edi
mov dword [esp + 0x78], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x100c6429
sub ecx, edx
mov edx, 0x1000b478
sar ecx, 1
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [esp + 0x18]
jne 0x100c6440
sub edx, esi
mov esi, dword [esp + 0x20]
sar edx, 1
lea eax, [esi + 2]
mov dword [esp + 0x14], eax
mov ax, word [esi]
add esi, 2
cmp ax, word [esp + 0x18]
jne 0x100c645c
sub esi, dword [esp + 0x14]
inc ecx
sar esi, 1
push 2
lea eax, [esi + edx]
add eax, ecx
push eax
mov dword [esp + 0x1c], eax
call sym.ucrtbase.dll__calloc_base
mov esi, eax
mov dword [esp + 0x20], esi
pop ecx
pop ecx
test esi, esi
je 0x100c6527
push edi
push dword [esp + 0x18]
push esi
call sym.ucrtbase.dll_wcscpy_s
add esp, 0xc
test eax, eax
jne 0x100c65b9
push 0x1000b478
push dword [esp + 0x18]
push esi
call sym.ucrtbase.dll_wcscat_s
add esp, 0xc
test eax, eax
jne 0x100c65b9
push dword [esp + 0x20]
push dword [esp + 0x18]
push esi
call sym.ucrtbase.dll_wcscat_s
add esp, 0xc
test eax, eax
jne 0x100c65b9
mov ecx, edi
call fcn.100c69f3
mov edx, eax
test edx, edx
je 0x100c6527
mov ecx, edx
sub ecx, edi
lea edi, [esp + 0x28]
neg ecx
sbb ecx, ecx
xor eax, eax
stosd dword es:[edi], eax
and ecx, edx
mov dword [esp + 0x20], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
xor edi, edi
lea eax, [esp + 0x3c]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push esi
push edx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x100c655c
lea ecx, [esp + 0x20]
call fcn.1002896d
lea ecx, [esp + 0x18]
call fcn.1002896d
lea ecx, [esp + 0x1c]
call fcn.1002896d
lea ecx, [esp + 0xc]
call fcn.100c6b9d
lea ecx, [esp + 0x10]
call fcn.100c6bb3
lea ecx, [esp + 8]
call fcn.1004a115
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [esp + 0x2c]
mov dword [esp + 0x14], edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], edi
mov dword [eax + 4], ecx
lea ecx, [esp + 0x20]
mov dword [eax], esi
call fcn.1002896d
lea ecx, [esp + 0x18]
call fcn.1002896d
lea ecx, [esp + 0x1c]
call fcn.1002896d
lea ecx, [esp + 0xc]
call fcn.100c6b9d
lea ecx, [esp + 0x10]
call fcn.100c6bb3
lea ecx, [esp + 8]
call fcn.1004a115
mov eax, esi
jmp 0x100c6556
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call sym.ucrtbase.dll__invoke_watson
int3