Function at 0x10006e90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x10018264]
mov ecx, dword [0x1001827c]
mov edx, dword [0x10018258]
add ecx, eax
push ebx
push esi
mov dword [0x10018280], ecx
sub edx, ecx
mov ecx, dword [0x10018284]
push edi
je 0x10006ecd
mov edx, dword [0x10018278]
sub edx, ecx
mov dword [0x1001828c], edx
add ecx, eax
mov dword [0x1001825c], ecx
push 0x10007122
push dword fs:[0]
mov dword fs:[0], esp
mov dword [0x100b93c4], esp
mov dword [0x100b93c8], ebp
xor eax, eax
mov dword [0x100b93c0], 2
xor ecx, ecx
neg ecx
mov edx, ecx
lea ecx, [eax + edx]
lea esi, [ecx + ecx*2]
mov eax, esi
sub eax, edx
lea edx, [eax + eax]
lea edi, [edx + edx]
test edi, edi
je 0x10006f1c
xor eax, eax
mov ebx, ecx
sub ebx, edx
je 0x10006f24
add eax, edx
mov ebx, eax
sub ebx, ecx
je 0x10006f2c
mov eax, edi
add edx, ecx
xor ebx, ebx
add eax, edx
lea edi, [eax + eax]
add eax, ecx
lea edx, [eax + eax]
cmp edx, ebx
je 0x10006f47
lea edi, [ecx + eax]
je 0x10006f47
sub esi, edi
mov eax, esi
mov edx, eax
sub edx, ecx
lea esi, [edx + edx]
test esi, esi
je 0x10006f56
sub edx, eax
shl edx, 1
sub ecx, edx
lea edx, [ecx + ecx]
mov eax, edx
sub eax, ecx
lea ecx, [eax + edx]
test ecx, ecx
je 0x10006f6c
mov ecx, edx
sub ecx, eax
mov eax, ecx
sub eax, edx
lea edx, [ebp - 4]
add eax, eax
push ebx
push edx
xor esi, esi
lea edi, [eax + eax]
mov dword [ebp - 4], 0x20
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, esi
sub eax, edi
mov ecx, eax
sub ecx, esi
je 0x10006f97
mov edx, esi
sub edx, eax
mov eax, edx
sub eax, esi
lea ecx, [eax + esi]
test ecx, ecx
je 0x10006fa2
sub esi, eax
lea edx, [ebp - 4]
lea eax, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
push eax
lea edx, [ebp - 0x4c]
push ecx
push edx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
lea eax, [esi + esi]
lea ecx, [eax + esi]
test ecx, ecx
je 0x10006fca
sub esi, eax
lea eax, [esi*4]
mov edx, esi
sub edx, eax
je 0x10006fd9
add esi, esi
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
lea edx, [ebp - 0x60]
push ecx
push edx
mov dword [ebp - 4], 0x3d
mov dword [ebp - 8], 0x3c
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
lea eax, [esi + esi]
xor ecx, ecx
lea esi, [eax + eax]
neg eax
je 0x10007007
mov ecx, esi
mov edi, esi
mov eax, ecx
sub eax, edi
je 0x10007011
add esi, ecx
cmp esi, ebx
je 0x10007017
mov edi, esi
mov ebx, dword [sym.imp.USER32.dll_InSendMessage]
call ebx
test esi, esi
je 0x10007025
add edi, edi
push 0x10
push 0xfe0
push 0xa79
lea ecx, [ebp - 0x80]
push str.SachetSpringti
push ecx
call sub.ADVAPI32.dll_BuildExplicitAccessWithNameA
lea edx, [edi + edi]
sub esi, edx
mov eax, esi
mov edx, eax
mov ecx, edx
sub ecx, eax
add eax, edx
lea esi, [ecx + ecx]
test esi, esi
je 0x10007059
mov eax, ecx
sub eax, edx
lea esi, [eax*4]
sub esi, eax
sub eax, ecx
neg esi
add eax, esi
add esi, eax
call ebx
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0xc4]
push eax
push ecx
push str.Steeplecha
push 0
push 0x40000
lea edx, [ebp - 0x28]
push 0
lea eax, [ebp - 0x1c]
push edx
push eax
push str.SeemingSpittingSc
push str.SymmetricallyReten
push 0
neg esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov edx, dword [0x100b93c0]
lea eax, [esi + esi*2]
lea ecx, [eax + eax]
sub esi, ecx
dec edx
test esi, esi
mov eax, esi
mov dword [0x100b93c0], edx
je 0x100070be
xor eax, eax
mov ecx, eax
mov edx, eax
neg ecx
add esi, eax
sub edx, ecx
je 0x100070cc
xor esi, esi
add eax, ecx
mov ecx, 0
lea edx, [eax + esi]
je 0x100070da
add edx, edx
lea esi, [edx + edx]
test esi, esi
je 0x100070e7
mov esi, edx
sub esi, eax
mov eax, esi
test edx, edx
je 0x100070ed
mov eax, edx
mov esi, eax
neg esi
je 0x100070f5
xor eax, eax
lea esi, [eax + edx]
test esi, esi
je 0x100070fe
xor edx, edx
mov esi, edx
add eax, edx
neg esi
je 0x10007108
mov ecx, edx
mov edx, dword [0x100b93c0]
test edx, edx
jne 0x10006f02
add eax, ecx
lea edx, [eax + ecx*2]
add eax, ecx
add edx, eax
lea eax, [edx + ecx]
mov ebp, dword [0x100b93c8]
add ecx, eax
xor edx, edx
mov esi, ecx
neg esi
je 0x10007136
sub ecx, eax
mov edx, ecx
mov ecx, edx
sub ecx, eax
lea esi, [ecx + ecx]
test esi, esi
je 0x10007143
add edx, ecx
lea ecx, [edx + eax]
lea esi, [ecx + ecx]
add eax, esi
mov esp, dword [0x100b93c4]
lea edi, [eax + eax]
test edi, edi
je 0x1000715a
mov ecx, esi
mov esi, edx
sub esi, ecx
add eax, esi
lea esi, [edx + eax]
test esi, esi
je 0x1000716b
mov ecx, eax
sub ecx, edx
add edx, ecx
add edx, eax
lea ecx, [edx + eax]
mov esi, ecx
sub esi, edx
je 0x1000717a
xor ecx, ecx
sub eax, ecx
lea esi, [edx + edx]
lea ecx, [eax + eax]
test ecx, ecx
je 0x10007188
add eax, edx
pop dword fs:[0]
mov ecx, esi
add esi, eax
sub ecx, eax
mov edx, esi
sub edx, ecx
je 0x100071a1
mov edx, ecx
sub edx, esi
mov esi, edx
sub ecx, esi
mov edx, ecx
sub edx, eax
je 0x100071ab
add eax, ecx
add ecx, ecx
lea edx, [ecx + ecx]
test edx, edx
je 0x100071b6
xor ecx, ecx
add eax, eax
lea edx, [ecx + eax]
test edx, edx
je 0x100071c1
xor ecx, ecx
lea edx, [ecx + eax]
test edx, edx
je 0x100071ce
mov edx, eax
sub edx, ecx
mov ecx, edx
lea edx, [ecx + ecx]
test edx, edx
je 0x100071d8
lea ecx, [eax + eax]
lea edx, [eax + eax]
add esp, 4
lea eax, [ecx + edx]
add ecx, eax
test ecx, ecx
je 0x100071e9
mov edx, ecx
neg eax
lea ecx, [edx + eax]
mov edx, ecx
sub edx, eax
je 0x100071f7
mov dword [ebp - 8], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret