Function at 0x1002a091
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [ebp + 0x14]
lea edi, [ebp - 4]
or dword [ebp - 4], 0xffffffff
mov edx, eax
push 2
push 1
mov ecx, dword [esi]
xor ebx, ebx
mov eax, ecx
mov dword [ebp - 0x10], ebx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
push edi
mov eax, dword [eax*4 + 0x1008f598]
push edx
push dword [eax + ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1002a2fb
push dword [esi]
call fcn.10003cc4
push dword [ebp + 0xc]
or dword [esi], 0xffffffff
push dword [esi + 4]
call fcn.1000100a
mov ebx, eax
add esp, 0xc
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x1002a2fb
xor edi, edi
push edi
call fcn.1002b02b
mov esi, eax
pop ecx
test esi, esi
jne 0x1002a121
push ebx
call fcn.100021d0
pop ecx
jmp 0x1002a2fb
push 0x100803c8
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push edi
push eax
call fcn.10003cb0
add esp, 0xc
test eax, eax
je 0x1002a180
cmp eax, 0x16
je 0x1002a359
mov ebx, edi
mov edi, str.cmd.exe
mov dword [ebp - 0xc], edi
xor eax, eax
push 0x44
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.100026bc
mov ecx, dword [0x1008f598]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], 0x100
jne 0x1002a18e
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
jmp 0x1002a19d
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1002a145
mov edi, ebx
mov dword [ebp - 0xc], ebx
jmp 0x1002a14d
cmp dword [ebp + 0x10], 1
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
je 0x1002a1a0
mov eax, dword [ecx + 0x50]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 0x88]
mov ecx, edi
mov dword [ebp - 0x2c], eax
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1002a1b3
sub ecx, edx
mov edx, str.__c
sar ecx, 1
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x10]
jne 0x1002a1ca
sub edx, edi
mov edi, dword [ebp + 8]
sar edx, 1
lea eax, [edi + 2]
mov dword [ebp - 0x18], eax
mov ax, word [edi]
add edi, 2
cmp ax, word [ebp - 0x10]
jne 0x1002a1e3
sub edi, dword [ebp - 0x18]
inc edx
sar edi, 1
push 2
lea eax, [edi + ecx]
add eax, edx
push eax
mov dword [ebp - 0x10], eax
call fcn.10003bb1
mov edi, eax
mov dword [ebp - 0x18], edi
pop ecx
pop ecx
test edi, edi
jne 0x1002a232
push edi
call fcn.1000484f
push ebx
call fcn.1000484f
mov dword [esi + 4], edi
mov dword [esi], edi
mov eax, dword [ebp - 8]
push eax
call fcn.100021d0
add esp, 0xc
jmp 0x1002a2fb
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push edi
call fcn.10002c11
add esp, 0xc
test eax, eax
jne 0x1002a350
push str.__c
push dword [ebp - 0x10]
push edi
call fcn.10002301
add esp, 0xc
test eax, eax
jne 0x1002a350
push dword [ebp + 8]
push dword [ebp - 0x10]
push edi
call fcn.10002301
add esp, 0xc
test eax, eax
jne 0x1002a350
push dword [ebp - 0xc]
call fcn.1002a7df
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x1002a29d
push edi
call fcn.1000484f
push ebx
call fcn.1000484f
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x1002a221
mov eax, ecx
lea edi, [ebp - 0x28]
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp - 0x10], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x6c]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1002a311
push dword [ebp - 0x10]
call fcn.1000484f
push edi
call fcn.1000484f
push ebx
call fcn.1000484f
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov eax, dword [ebp - 8]
push eax
call fcn.100021d0
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x1002a30a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
call fcn.1000484f
push edi
call fcn.1000484f
push ebx
call fcn.1000484f
add esp, 0xc
cmp dword [ebp - 4], 0xffffffff
je 0x1002a34b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x1002a30c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x1002a35e
push edi
push edi
push edi
push edi
push edi
call fcn.100029ff
int3