Function at 0x10025668
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e2a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10025c4b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x24], 0x6525
push 4
lea ecx, [ebp - 0x148]
call fcn.1001673e
and dword [ebp - 4], 0
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x100256d5
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x100256f1
push dword [ebp - 0x68]
lea ecx, [ebp - 0x148]
call fcn.100167dc
mov dword [eax], 0xc2f1fcc1
jmp 0x100256ce
mov dword [ebp - 0x10], 0
jmp 0x10025701
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jg 0x1002593f
mov dword [ebp - 0x48], 0x5a83d87e
mov dword [ebp - 0x70], 6
push 3
lea ecx, [ebp - 0x130]
call fcn.1001673e
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0xffff
mov dword [ebp - 0x64], 0
jmp 0x10025741
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1002575d
push dword [ebp - 0x64]
lea ecx, [ebp - 0x130]
call fcn.100167dc
mov dword [eax], 0xa73a151c
jmp 0x1002573a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x24], 0
je 0x10025809
cmp dword [ebp - 0x48], 0
je 0x10025785
cmp dword [ebp - 0x48], 0
je 0x10025785
mov dword [ebp - 0x80], 1
jmp 0x10025789
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x80], eax
jne 0x1002579d
mov dword [ebp - 0xc0], 1
jmp 0x100257a4
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0x59ea4d59
jne 0x100257bc
mov dword [ebp - 0x10c], 1
jmp 0x100257c3
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x48]
jl 0x100257e1
mov dword [ebp - 0x6c], 1
jmp 0x100257e5
and dword [ebp - 0x6c], 0
push 3
lea ecx, [ebp - 0x148]
call fcn.100167dc
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
cmp dword [ebp - 0x6c], 0
je 0x10025809
mov dword [ebp - 0x110], 1
jmp 0x10025810
and dword [ebp - 0x110], 0
cmp dword [ebp - 0x10], 0
je 0x10025828
cmp dword [ebp - 0x24], 0
je 0x10025828
mov dword [ebp - 0x124], 1
jmp 0x1002582f
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x70], eax
je 0x10025849
mov dword [ebp - 0x84], 1
jmp 0x10025850
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x10]
jle 0x10025870
cmp dword [ebp - 0x24], 0
je 0x10025870
mov dword [ebp - 0x88], 1
jmp 0x10025877
and dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 1
jne 0x1002588c
mov dword [ebp - 0xa8], 1
jmp 0x10025893
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xa8], eax
je 0x100258aa
mov dword [ebp - 0x90], 1
jmp 0x100258b1
and dword [ebp - 0x90], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.100167dc
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
cmp dword [ebp - 0x38], 0
jbe 0x100258d8
mov dword [ebp - 0xb8], 1
jmp 0x100258df
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xb8]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x38], 0
jmp 0x100258fe
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 6
jne 0x1002592b
mov dword [ebp - 0x108], 0
mov esi, dword [ebp - 0x70]
push 1
lea ecx, [ebp - 0x130]
call fcn.100167dc
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x108], eax
jmp 0x100258f7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x130]
call fcn.100167c0
jmp 0x100256fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.100167c0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x120], eax
push 1
lea ecx, [ebp - 0xe0]
call fcn.1001673e
mov dword [ebp - 4], 2
mov dword [ebp - 0x168], 0x9ea9831
mov dword [ebp - 0x60], 0
jmp 0x10025985
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x100259a1
push dword [ebp - 0x60]
lea ecx, [ebp - 0xe0]
call fcn.100167dc
mov dword [eax], 0xdb3ae355
jmp 0x1002597e
push 0
lea ecx, [ebp - 0xe0]
call fcn.100167dc
and dword [eax], 0
jmp 0x100259d7
push 0
lea ecx, [ebp - 0xe0]
call fcn.100167dc
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xe0]
call fcn.100167dc
cmp dword [eax], 0xa
jle 0x10025a13
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x100259fd
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
lea ecx, [ebp - 0xe0]
call fcn.100167dc
cmp dword [eax], 0
je 0x10025a11
jmp 0x10025a13
jmp 0x100259b3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.100167c0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xa0], 0x974b666a
push 4
lea ecx, [ebp - 0x154]
call fcn.1001673e
mov dword [ebp - 4], 3
mov dword [ebp - 0x74], 5
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0xfc], 0x5300ce3d
mov dword [ebp - 0x14], 0
jmp 0x10025a71
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10025a87
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc8], 1
jmp 0x10025a6a
mov dword [ebp - 0x14], 0
jmp 0x10025a97
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10025ab0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x154]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x10025a90
mov byte [ebp - 0x1a], 0
movzx eax, byte [ebp - 0x1a]
test eax, eax
je 0x10025acb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
lea ecx, [ebp - 0x154]
call fcn.100167dc
mov dword [eax], 0xbfb66feb
cmp dword [ebp - 0x50], 0xbfb66feb
je 0x10025af3
mov dword [ebp - 0xf0], 1
jmp 0x10025afa
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x158], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc8]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x50], 0x4d07ddbf
jge 0x10025b2b
mov dword [ebp - 0xb0], 1
jmp 0x10025b32
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
neg eax
je 0x10025b61
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc8], 0
je 0x10025b61
mov dword [ebp - 0x78], 1
jmp 0x10025b65
and dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x78], eax
jle 0x10025b76
mov dword [ebp - 0x7c], 1
jmp 0x10025b7a
and dword [ebp - 0x7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x7c], eax
jg 0x10025b98
mov dword [ebp - 0xe4], 1
jmp 0x10025b9f
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
cmp dword [ebp - 0x74], eax
jg 0x10025bc4
mov dword [ebp - 0x8c], 1
jmp 0x10025bcb
and dword [ebp - 0x8c], 0
cmp dword [ebp - 0x8c], 1
je 0x10025be0
mov dword [ebp - 0x94], 1
jmp 0x10025be7
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x94]
inc eax
inc eax
mov dword [ebp - 0xfc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.100167c0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x34]
mov dword [eax], 0
jmp 0x10025c26
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov eax, dword [ebp - 0x34]
cmp dword [eax], 3
jge 0x10025c46
mov eax, dword [ebp - 0x34]
push dword [eax]
mov ecx, dword [ebp - 0x104]
call fcn.100167dc
mov dword [eax], 1
jmp 0x10025c1b
jmp 0x10025fef
mov dword [ebp - 0x3c], 0xcea5d6c0
mov dword [ebp - 0x164], 0x891c5534
mov dword [ebp - 0x3c], 0xffffffed
jmp 0x10025c6c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x18
jl 0x10025cb4
mov dword [ebp - 0x58], 0xeede0b40
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x58], 0
jmp 0x10025c9d
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffe6
jl 0x10025cb2
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
jmp 0x10025c96
jmp 0x10025c65
mov byte [ebp - 0x1b], 0
movzx eax, byte [ebp - 0x1b]
test eax, eax
je 0x10025cdd
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x2c], 0xd06ce125
mov dword [ebp - 0x40], 0
jmp 0x10025cfd
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10025d13
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x114], 0xfffffff8
jmp 0x10025cf6
mov dword [ebp - 0x2c], 0
jmp 0x10025d23
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10025d39
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x114], 0
jmp 0x10025d1c
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x10025d54
push 0
push 0x804
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x44], 0
jmp 0x10025d7b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10025d91
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x11c], 1
jmp 0x10025d74
mov dword [ebp - 0x18], 1
jmp 0x10025da1
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10025e12
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x11c], 0
je 0x10025de9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x11c], ecx
cmp dword [ebp - 0xa4], 0
je 0x10025de9
mov dword [ebp - 0xac], 1
jmp 0x10025df0
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x10025e10
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x10025d9a
mov dword [ebp - 0x30], 0xf
jmp 0x10025e22
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jl 0x10025e4a
mov byte [ebp - 0x1c], 0
movzx eax, byte [ebp - 0x1c]
test eax, eax
je 0x10025e48
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x10025e1b
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x28], eax
push 1
lea ecx, [ebp - 0xd4]
call fcn.1001673e
mov dword [ebp - 4], 4
mov dword [ebp - 0x174], 0x49d585ed
mov dword [ebp - 0x4c], 0
jmp 0x10025e81
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10025e9a
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd4]
call fcn.100167dc
and dword [eax], 0
jmp 0x10025e7a
push 0
lea ecx, [ebp - 0xd4]
call fcn.100167dc
and dword [eax], 0
jmp 0x10025ed0
push 0
lea ecx, [ebp - 0xd4]
call fcn.100167dc
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xd4]
call fcn.100167dc
cmp dword [eax], 2
jge 0x10025f8e
mov dword [ebp - 0x54], 0x57102d14
mov dword [ebp - 0x17c], 0x33843046
mov dword [ebp - 0x160], 0x9dd952ea
mov dword [ebp - 0x54], 0x15
jmp 0x10025f11
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff8
je 0x10025f89
push 3
lea ecx, [ebp - 0x13c]
call fcn.1001673e
mov byte [ebp - 4], 5
mov dword [ebp - 0x5c], 0
jmp 0x10025f38
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10025f54
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x13c]
call fcn.100167dc
mov dword [eax], 1
jmp 0x10025f31
push 0
lea ecx, [ebp - 0x13c]
call fcn.100167dc
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xbc]
mov dword [ecx], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x13c]
call fcn.100167c0
jmp 0x10025f0a
jmp 0x10025eac
push 0
lea ecx, [ebp - 0xd4]
call fcn.100167dc
mov dword [eax], 0x9acf2579
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.100167c0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
jmp 0x10025fd2
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x28]
cmp dword [eax], 2
jge 0x10025fef
mov eax, dword [ebp - 0x28]
push dword [eax]
mov ecx, dword [ebp - 0x100]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x10025fc7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret