Function at 0x1000b3ff
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006bcf2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push ebx
push esi
mov dword [esp + 0x28], ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], 0xee76f502
mov esi, edx
xor edi, edi
mov dword [esp + 0x1c], 0x90ef874a
mov dword [esp + 0x40], esi
inc edi
mov dword [esp + 0xc], ebx
jmp 0x1000b454
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x20], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1000b448
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1000b526
mov dword [esp + 0xc], 3
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x20]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + eax*4 + 0x20]
mov eax, dword [esp + 0x20]
imul edx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x20]
cmp edx, eax
mov eax, dword [esp + 0x10]
setg cl
cmp ecx, 0xffffffff
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [esp + eax*4 + 0x20]
mov eax, dword [esp + 0x20]
cmp edx, eax
mov eax, dword [esp + 0x10]
setle cl
mov dword [esp + eax*4 + 0x20], ecx
mov eax, dword [esp + 0x20]
sub eax, 0x3a4d1b40
neg eax
sbb eax, eax
inc eax
cmp eax, 0xb28
jle 0x1000b510
mov ecx, dword [esp + 0x20]
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x10]
imul eax, ecx
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x334a
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [esp + 0xc]
cmp ecx, dword [esp + 0xc]
mov ecx, ebx
jle 0x1000b512
mov ecx, edi
mov eax, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x1c], eax
dec dword [esp + 0x10]
jns 0x1000b468
mov dword [esp + 0x14], 3
lea ecx, [esp + 0x7c]
push 3
call fcn.1000bc61
mov dword [esp + 0x28], 0xffffffff
push 7
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0x4d91b059
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0x24], 0x46e4944c
push 3
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1000b580
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1000b571
cmp dword [esp + 0x14], ebx
jne 0x1000b5a4
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub eax, 5
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x7c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0xc], eax
call fcn.1000bce3
mov eax, dword [0x106d8654]
test al, 1
jne 0x1000b662
or eax, edi
mov dword [0x106d8654], eax
push ebx
mov dword [esp + 0xc0], ebx
push ebx
mov dword [0x106d8600], ebx
mov dword [0x106d8604], ebx
call fcn.1000c6b6
mov dword [0x106d8600], eax
mov dword [0x106d8608], ebx
mov dword [0x106d8610], ebx
mov byte [esp + 0xbc], 2
mov ecx, 0x106d8608
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
push eax
push 0x10
push ebx
lea eax, [esp + 0x84]
mov dword [0x106d861c], 0x3f800000
push eax
mov dword [0x106d860c], ebx
call fcn.1000c48e
push 0x1006d0ad
mov dword [0x106d8614], 7
mov dword [0x106d8618], 8
call fcn.10054a36
or dword [esp + 0xc0], 0xffffffff
pop ecx
imul eax, dword [esp + 0x2c], 0x2710
lea ecx, [esp + 0x5c]
push edi
add eax, esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x14], edi
call fcn.1000bc61
mov dword [esp + 0xc], ebx
jmp 0x1000b697
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0xa1654207
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1000b684
mov esi, dword [esp + 0x10]
neg esi
sbb esi, esi
xor edx, edx
inc esi
imul esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setl dl
add esi, edx
cmp esi, dword [esp + 0x10]
jne 0x1000b6ca
mov ecx, ebx
cmp dword [esp + 0x10], ebx
je 0x1000b6cc
mov ecx, edi
mov eax, dword [esp + 0x5c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0xf904
mov dword [esp + 0x10], ebx
jmp 0x1000b707
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0x3847d228
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1000b6f4
lea ecx, [esp + 0x5c]
call fcn.1000bce3
lea eax, [esp + 0x3c]
push eax
call fcn.1000bd61
mov esi, dword [eax]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], 0x68bb
mov dword [esp + 0x28], 0xa94
mov dword [esp + 0xc], 0x17
jmp 0x1000b85f
mov dword [esp + 0x10], 0x85c6f1bf
mov dword [esp + 0x1c], 0xa58390a3
mov dword [esp + 0x10], 0xfffffffe
jmp 0x1000b850
mov dword [esp + 0x14], 0xfffffffa
mov dword [esp + 0x1c], 6
mov dword [esp + 0x1c], 0x7675daaf
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1000b78f
push 0xa0f
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [esp + 0xc], ebx
jne 0x1000b81f
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
setge cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x1c], eax
setge cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
add edx, dword [esp + 0x14]
cmp edx, 0x76bd76df
setge al
sub eax, 0x2e166580
imul eax, dword [esp + 0x14]
test eax, eax
jne 0x1000b7f7
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setle cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
sub eax, 0x2457718d
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xc
jg 0x1000b760
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff3
jg 0x1000b743
test esi, esi
je 0x1000b877
mov dword [esp + 0x30], esi
jmp 0x1000bbfc
mov dword [esp + 0xc], ebx
xor edx, edx
mov dword [esp + 0x28], 0xa8f90a3c
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setle dl
sub eax, edx
je 0x1000b949
mov dword [esp + 0x1c], 0x6475
cmp dword [esp + 0x1c], 0x66b0
jle 0x1000b90a
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x88]
cdq
push edx
push eax
call fcn.10009e8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b8df
mov eax, dword [eax]
push eax
call fcn.10054a60
pop ecx
push ebx
push 1
lea ecx, [esp + 0x90]
call fcn.1000bf32
inc edi
cmp edi, 0x6967
jl 0x1000b8c0
inc esi
cmp esi, 0x62e2
jl 0x1000b8be
xor edi, edi
inc edi
mov byte [esp + 0x1b], bl
cmp dword [esp + 0x1c], 0x613a
jge 0x1000b923
push 0x100076d0
call fcn.10054a60
pop ecx
or dword [esp + 0xbc], 0xffffffff
cmp byte [esp + 0x1b], 0
je 0x1000b9c4
push 0x599
push ebx
push 0x713
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1000b9c4
mov dword [esp + 0xc], 8
lea ecx, [esp + 0x68]
push 2
call fcn.1000bc61
mov dword [esp + 0x14], ebx
jmp 0x1000b975
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], 0x4ccb63e8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1000b962
mov eax, dword [esp + 0xc]
mov ecx, 0xa60d0058
cmp ecx, eax
mov eax, dword [esp + 0x68]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov dword [esp + 0xc], ebx
jmp 0x1000b9b4
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1000b9ac
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x1c], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 9
jne 0x1000b997
lea ecx, [esp + 0x68]
call fcn.1000bce3
mov eax, dword [0x106d8654]
mov dword [esp + 0x1c], edi
test al, 2
jne 0x1000ba69
or eax, 2
mov dword [0x106d8654], eax
push ebx
mov dword [esp + 0xc0], 5
push ebx
mov dword [0x106d8630], ebx
mov dword [0x106d8634], ebx
call fcn.1000c6b6
mov dword [0x106d8630], eax
mov dword [0x106d8638], ebx
mov dword [0x106d8640], ebx
mov byte [esp + 0xbc], 7
mov ecx, 0x106d8638
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
push eax
push 0x10
push ebx
lea eax, [esp + 0x80]
mov dword [0x106d864c], 0x3f800000
push eax
mov dword [0x106d863c], ebx
call fcn.1000c48e
push 0x1006d0a8
mov dword [0x106d8644], 7
mov dword [0x106d8648], 8
call fcn.10054a36
or dword [esp + 0xc0], 0xffffffff
pop ecx
mov dword [esp + 0x14], 0xe83c773
mov dword [esp + 0xc], ebx
jmp 0x1000ba83
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x30], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1000ba77
mov dword [esp + 0x14], ebx
jmp 0x1000bb33
mov dword [esp + 0x1c], 6
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x30]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x30]
jne 0x1000bac1
mov eax, dword [esp + 0x14]
mov edx, ebx
cmp dword [esp + eax*4 + 0x30], ebx
je 0x1000bac3
mov edx, edi
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x8953526c
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3413f087
setg al
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
test ecx, ecx
setns al
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x30]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, 0xcc19583e
setne dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1000ba93
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1000bb55
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
lea eax, [esp + 0x2c]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x50], xmm0
call fcn.1000bdc3
mov ebx, dword [eax]
mov al, byte [ebp + 0xc]
test al, al
jne 0x1000bb75
test ebx, ebx
jne 0x1000bbd2
lea ecx, [esp + 0xa0]
mov dl, al
push ecx
mov ecx, dword [esp + 0x30]
call fcn.10009ec2
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x50]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1000bbad
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x1000bbad
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
test ebx, ebx
jne 0x1000bbd2
cmp dword [esp + 0x4c], ebx
jle 0x1000bbd2
mov ecx, dword [esp + 0x50]
test ecx, ecx
je 0x1000bbd2
call fcn.1000b285
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
call fcn.1000bdc3
mov dword [eax], ebx
lea ecx, [esp + 0x4c]
call fcn.1000abf9
test ebx, ebx
je 0x1000bbfc
mov edx, dword [esp + 0x40]
mov ecx, ebx
call fcn.1000b3f5
mov esi, eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x34], esi
call fcn.1000bd61
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x30]
mov ecx, dword [esp + 0xb4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret