Function at 0x10032240
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040bd7
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x450]
push eax
call fcn.1002a3e0
push 4
push 0x100470c0
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], 0
call fcn.1002a3e0
mov eax, dword [ebp - 0x440]
mov ecx, eax
sub ecx, dword [ebp - 0x470]
mov byte [ebp - 4], 1
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
cmp eax, ecx
jb 0x10032b59
sub eax, ecx
or edi, 0xffffffff
cmp eax, edi
mov esi, edi
cmovb esi, eax
cmp dword [ebp - 0x43c], 0x10
lea eax, [ebp - 0x450]
mov dword [ebp - 0x488], esi
cmovae eax, dword [ebp - 0x450]
add eax, ecx
lea ecx, [edi + 0x17]
mov dword [ebp - 0x48c], eax
cmp esi, 0xf
ja 0x1003234b
push esi
push eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x428], esi
push eax
call sub.VCRUNTIME140.dll_memmove
mov byte [ebp + esi - 0x438], 0
mov eax, dword [ebp - 0x438]
mov esi, dword [ebp - 0x424]
mov dword [ebp - 0x484], eax
jmp 0x100323ba
cmp esi, 0x7fffffff
ja 0x10032b5e
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10032369
mov esi, SysReAllocString
jmp 0x1003236e
cmp esi, ecx
cmovb esi, ecx
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x438]
call fcn.1002a3e0
mov ecx, eax
mov dword [ebp - 0x424], esi
mov eax, dword [ebp - 0x488]
push eax
push dword [ebp - 0x48c]
mov dword [ebp - 0x484], ecx
push ecx
mov dword [ebp - 0x428], eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x438], eax
mov byte [eax + ecx], 0
add esp, 0xc
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 2
push 0x100470c0
push eax
call fcn.1002a3e0
add esp, 8
mov dword [ebp - 0x458], 0
test al, al
mov dword [ebp - 0x454], 7
mov ecx, str.http
mov edx, str..pdf
cmove edx, ecx
xor eax, eax
mov ecx, edx
mov word [ebp - 0x468], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x48c], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10032410
sub ecx, dword [ebp - 0x48c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x468]
call fcn.1002a3e0
mov byte [ebp - 4], 4
cmp esi, 0x10
jb 0x10032468
mov ecx, dword [ebp - 0x484]
inc esi
mov eax, ecx
cmp esi, 0x1000
jb 0x1003245e
mov ecx, dword [ecx - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032b2c
push esi
push ecx
call fcn.1002a3e0
add esp, 8
mov edx, dword [ebp - 0x46c]
mov byte [ebp - 4], 5
cmp edx, 0x10
jb 0x100324a6
mov ecx, dword [ebp - 0x480]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003249c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032b2c
push edx
push ecx
call fcn.1002a3e0
add esp, 8
cmp dword [ebp - 0x454], 8
lea esi, [ebp - 0x468]
cmovae esi, dword [ebp - 0x468]
cmp dword [ebp - 0x458], 4
jne 0x10032675
mov ecx, str..pdf
mov edx, 4
sub esi, ecx
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x10032675
add ecx, 2
sub edx, 1
jne 0x100324d3
push 8
push str.file:___
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], dl
call fcn.1002a3e0
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x470]
mov byte [ebp - 4], 6
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
cmp eax, ecx
jb 0x10032b63
sub eax, ecx
cmp eax, 0xffffffff
cmovb edi, eax
cmp dword [ebp - 0x43c], 0x10
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
add eax, ecx
mov dword [ebp - 0x48c], eax
cmp edi, 0xf
ja 0x10032580
push edi
push eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x428], edi
push eax
call sub.VCRUNTIME140.dll_memmove
mov byte [ebp + edi - 0x438], 0
jmp 0x100325e8
cmp edi, 0x7fffffff
ja 0x10032b68
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x1003259f
mov eax, SysReAllocString
jmp 0x100325aa
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0x488], eax
lea ecx, [ebp - 0x438]
inc eax
push eax
call fcn.1002a3e0
push edi
push dword [ebp - 0x48c]
mov esi, eax
mov dword [ebp - 0x428], edi
mov eax, dword [ebp - 0x488]
push esi
mov dword [ebp - 0x424], eax
call sub.VCRUNTIME140.dll_memcpy
mov byte [esi + edi], 0
mov dword [ebp - 0x438], esi
add esp, 0xc
lea eax, [ebp - 0x438]
lea ecx, [ebp - 0x450]
push eax
call fcn.1002a3e0
mov edx, dword [ebp - 0x424]
cmp edx, 0x10
jb 0x10032637
mov ecx, dword [ebp - 0x438]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003262d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032b2c
push edx
push ecx
call fcn.1002a3e0
add esp, 8
mov edx, dword [ebp - 0x46c]
mov byte [ebp - 4], 5
cmp edx, 0x10
jb 0x10032675
mov ecx, dword [ebp - 0x480]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003266b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032b2c
push edx
push ecx
call fcn.1002a3e0
add esp, 8
cmp dword [ebp - 0x43c], 0x10
lea eax, [ebp - 0x450]
push 0
cmovae eax, dword [ebp - 0x450]
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
movzx esi, ax
xor ecx, ecx
mov edx, 2
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002a3e0
add esp, 4
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x43c], 0x10
lea ecx, [ebp - 0x450]
cmovae ecx, dword [ebp - 0x450]
push esi
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x490]
push ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x490], 0x208
push ecx
push str.open
lea eax, [ebp - 0x468]
mov edi, 1
cmovae eax, dword [ebp - 0x468]
push eax
push 2
push 0
call dword [sym.imp.shlwapi.dll_AssocQueryStringW]
test eax, eax
js 0x10032a97
mov ecx, dword [ebp - 0x484]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10032740
sub ecx, edx
lea edx, [ebp - 0x218]
sar ecx, 1
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10032760
sub edx, esi
lea eax, [ecx + 0x400]
sar edx, 1
xor ecx, ecx
add eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002a3e0
mov esi, eax
lea eax, [ebp - 0x218]
push 0x100470ec
push eax
mov dword [ebp - 0x488], esi
call sub.VCRUNTIME140.dll_wcsstr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1003290a
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100327c0
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100327d4
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
add edi, 4
sub ecx, edx
push ecx
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov esi, dword [ebp - 0x484]
add esp, 0x10
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10032810
sub esi, ecx
lea edx, [ebp - 0x420]
sar esi, 1
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10032830
sub edx, ecx
mov ecx, 0x104
sar edx, 1
sub ecx, edx
cmp esi, ecx
ja 0x10032862
mov ecx, dword [ebp - 0x484]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10032853
sub ecx, edx
sar ecx, 1
push ecx
push dword [ebp - 0x484]
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov edx, edi
add esp, 0x10
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10032883
sub edx, ecx
lea esi, [ebp - 0x420]
sar edx, 1
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100328a0
sub esi, ecx
mov ecx, 0x104
sar esi, 1
sub ecx, esi
cmp edx, ecx
ja 0x100328cf
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100328c0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x100470f4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp - 0x488]
add esp, 0x1c
jmp 0x100329f3
lea edx, [ebp - 0x218]
mov dword [esi], 0x22
mov ecx, edx
mov dword [ebp - 0x48c], ecx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10032920
sub edx, ecx
lea edi, [esi - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10032930
mov esi, dword [ebp - 0x48c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x488]
lea edi, [esi - 2]
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10032960
mov eax, dword [0x100470fc]
lea ecx, [esi - 2]
mov dword [edi], eax
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10032976
mov eax, dword [0x10047100]
mov edx, dword [ebp - 0x484]
mov dword [ecx], eax
mov ax, word [0x10047104]
mov word [ecx + 4], ax
mov ecx, edx
mov dword [ebp - 0x48c], ecx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100329a1
sub edx, ecx
lea edi, [esi - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100329b1
mov esi, dword [ebp - 0x48c]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x488]
lea edi, [esi - 2]
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100329e0
mov eax, dword [0x100470fc]
mov dword [edi], eax
lea eax, [ebp - 0x430]
mov dword [ebp - 0x4d4], 0x44
push eax
lea eax, [ebp - 0x4d4]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
movlpd qword [ebp - 0x4d0], xmm0
mov edi, 1
movlpd qword [ebp - 0x4c8], xmm0
movlpd qword [ebp - 0x4c0], xmm0
movlpd qword [ebp - 0x4b8], xmm0
movlpd qword [ebp - 0x4b0], xmm0
movlpd qword [ebp - 0x4a8], xmm0
movlpd qword [ebp - 0x4a0], xmm0
movlpd qword [ebp - 0x498], xmm0
movups xmmword [ebp - 0x430], xmm0
call dword [sym.imp.kernel32.dll_CreateProcessW]
push dword [ebp - 0x430]
xor ecx, ecx
test eax, eax
cmovne edi, ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x42c]
call dword [sym.imp.kernel32.dll_CloseHandle]
push esi
call fcn.1003aa37
add esp, 4
push dword [ebp - 0x484]
call fcn.1003aa37
mov edx, dword [ebp - 0x454]
add esp, 4
add edi, edi
cmp edx, 8
jb 0x10032ae3
mov ecx, dword [ebp - 0x468]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10032ad9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032b2c
push edx
push ecx
call fcn.1002a3e0
add esp, 8
mov edx, dword [ebp - 0x43c]
xor eax, eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
cmp edx, 0x10
jb 0x10032b3c
mov ecx, dword [ebp - 0x450]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10032b32
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10032b32
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1002a3e0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret
call fcn.1000d660
call fcn.1000d640
call fcn.1000d660
call fcn.1000d640
int3