Function at 0x1006d3e0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1012fc77
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x388], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x3a0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3b8]
mov ebp, dword [esp + 0x3b0]
mov ebx, dword [esp + 0x3b4]
mov esi, ecx
cmp byte [esi + 0x11c], 0
mov edi, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
lea eax, [esi + 0xc]
jne 0x1006d44b
mov eax, dword [esi + 8]
add eax, 4
mov dword [esp + 0x1c], eax
call fcn.1005ef50
mov dword [esp + 0x20], 0xffffffff
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x28]
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x3b0], 0
call fcn.10061790
test al, al
je 0x1006d704
lea edi, [esp + 0x274]
call fcn.10062500
push str._t:0
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
add esp, 8
test ebp, ebp
je 0x1006d4da
push 0x1014727c
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push ebp
push 0x10145b10
mov edx, edi
call fcn.10062cd0
push 0x1013f830
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
add esp, 0x18
push 0x10147284
push 0x1013c7e4
lea edx, [esp + 0x27c]
call fcn.10062cd0
mov edx, dword [esp + 0x3c4]
push edx
push 0x1013f9d8
lea edx, [esp + 0x284]
call fcn.10062cd0
push 0x1013f830
push 0x1013c7e4
lea edx, [esp + 0x28c]
call fcn.10062cd0
add esp, 0x18
cmp byte [esi + 0x240], 0
lea edi, [esi + 0x130]
jne 0x1006d537
mov edi, dword [esi + 0x12c]
push 0x10143658
push 0x1013c7e4
lea edx, [esp + 0x27c]
call fcn.10062cd0
add edi, 4
push edi
push 0x1013c7e4
lea edx, [esp + 0x284]
call fcn.10062cd0
push 0x1014728c
push 0x1013c7e4
lea edx, [esp + 0x28c]
call fcn.10062cd0
add esp, 0x18
test ebx, ebx
je 0x1006d594
push ebx
push 0x1013c7e4
lea edx, [esp + 0x27c]
call fcn.10062cd0
add esp, 8
cmp byte [esp + 0x390], 0
lea ecx, [esp + 0x280]
jne 0x1006d5ac
mov ecx, dword [esp + 0x27c]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x1006d5bb
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x14]
push 0
push edx
add ecx, 4
push ecx
add eax, 4
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebp, eax
cmp ebp, 0x20
jg 0x1006d718
cmp byte [esi + 0x240], 0
je 0x1006d5f3
add esi, 0x130
jmp 0x1006d5f9
mov esi, dword [esi + 0x12c]
lea edi, [esp + 0x2c]
call fcn.10062500
lea eax, [esi + 4]
mov edx, edi
call fcn.10062710
push 0x10145300
lea edi, [esp + 0x154]
call fcn.10062630
mov esi, eax
push ebp
push 0x1013f9d8
mov edx, esi
mov byte [esp + 0x3b0], 4
call fcn.10062cd0
push 0x10145290
push 0x1013c7e4
mov edx, esi
call fcn.10062cd0
add esp, 0x10
cmp byte [esi + 0x11c], 0
je 0x1006d656
add esi, 0xc
jmp 0x1006d659
mov esi, dword [esi + 8]
mov edi, dword [esp + 0x18]
add esi, 4
push esi
mov ecx, edi
call fcn.100619a0
mov esi, eax
lea eax, [esp + 0x30]
call fcn.10062310
cmp byte [esp + 0x26c], 0
mov ebx, vtable.t_str.0
mov dword [esp + 0x150], ebx
jne 0x1006d6a4
mov eax, dword [esp + 0x158]
lea ecx, [esp + 0x15c]
cmp eax, ecx
je 0x1006d6a4
push eax
call fcn.100cf89b
add esp, 4
mov byte [esp + 0x3a8], 1
cmp byte [esp + 0x148], 0
mov dword [esp + 0x2c], ebx
jne 0x1006d6cf
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x38]
cmp eax, edx
je 0x1006d6cf
push eax
call fcn.100cf89b
add esp, 4
mov eax, ebp
mov esi, edi
call fcn.1006cee0
cmp byte [esp + 0x390], 0
mov dword [esp + 0x274], ebx
jne 0x1006d704
mov eax, dword [esp + 0x27c]
lea ecx, [esp + 0x280]
cmp eax, ecx
je 0x1006d704
push eax
call fcn.100cf89b
add esp, 4
mov dword [esp + 0x3a8], 0xffffffff
call fcn.1005ef50
xor al, al
jmp 0x1006d75a
cmp byte [esp + 0x390], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x1006d748
mov eax, dword [esp + 0x27c]
lea edx, [esp + 0x280]
cmp eax, edx
je 0x1006d748
push eax
call fcn.100cf89b
add esp, 4
mov dword [esp + 0x3a8], 0xffffffff
call fcn.1005ef50
mov al, 1
mov ecx, dword [esp + 0x3a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x388]
xor ecx, esp
call fcn.100cf604
add esp, 0x398
ret 0x10