Function at 0x1002d69
Capabilities:
Create process on windows

Disassembly:
push 0x94
push 0x1001a80
call fcn.01007e18
mov eax, dword [0x100a140]
mov dword [ebp - 0x1c], eax
mov ebx, ecx
mov dword [ebp - 0x48], ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov eax, dword [ebp + 0x10]
push eax
push dword [esi]
call fcn.01002873
mov dword [ebx], fcn.0100291b
xor edx, edx
mov dword [ebp - 0xa4], edx
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0xa0]
rep stosd dword es:[edi], eax
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x48], edx
lea edi, [ebx + 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 0x60], edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], edx
mov ecx, dword [esi + 0xc]
mov dword [ebx + 0x64], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x44], edx
cmp eax, edx
je 0x1003395
cmp dword [ebx + 0x20], edx
je 0x1003395
mov dword [ebx + 0x20], edx
lea eax, [ebp - 0x5c]
push eax
push 0xffff
push dword [esi + 8]
call fcn.01007f90
test eax, eax
jl 0x1003395
mov ecx, ebx
call fcn.01002b00
test eax, eax
je 0x1003395
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x1002e51
cmp eax, 0x720
je 0x1002e51
test byte [0x100a0bc], 8
je 0x1003395
cmp byte [0x100a0b9], 2
jb 0x1003395
push eax
push 0x10017a8
push 0xa
jmp 0x1002ef2
lea esi, [ebx + 0x4c]
push esi
lea eax, [ebp - 0x34]
push eax
mov edi, dword [sym.imp.RPCRT4.dll_UuidToStringW]
call edi
test eax, eax
je 0x1002e89
test byte [0x100a0bc], 8
je 0x1003395
cmp byte [0x100a0b9], 2
jb 0x1003395
push eax
push 0x10017a8
push 0xb
jmp 0x1002ef2
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x1002ec2
cmp eax, 0x720
je 0x1002ec2
test byte [0x100a0bc], 8
je 0x1003395
cmp byte [0x100a0b9], 2
jb 0x1003395
push eax
push 0x10017a8
push 0xc
jmp 0x1002ef2
lea eax, [ebx + 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
call edi
test eax, eax
je 0x1002f08
test byte [0x100a0bc], 8
je 0x1003395
cmp byte [0x100a0b9], 2
jb 0x1003395
push eax
push 0x10017a8
push 0xd
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
jmp 0x1003395
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x4c], eax
push dword [esi]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
mov edi, eax
push dword [ebx + 0x48]
call esi
add edi, eax
push dword [ebp - 0x4c]
call esi
add edi, eax
push 0x1001a64
call esi
add edi, eax
push 0x10019c8
call esi
add edi, eax
push 0x10019b4
call esi
add edi, eax
push 0x1001988
call esi
add edi, eax
push 0x1001964
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x1001960
call esi
add edi, eax
push 0x100195c
call esi
add edi, eax
push 0x100195c
call esi
add edi, eax
push 0x100195c
call esi
add edi, eax
push 0x100195c
call esi
add esp, 0x40
add edi, eax
push dword [ebx + 0x44]
call esi
add edi, dword [ebp - 0x5c]
lea esi, [eax + edi + 1]
lea eax, [esi + esi]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
pop ecx
mov edi, eax
mov dword [ebp - 0x58], edi
test edi, edi
jne 0x1002ff7
test byte [0x100a0bc], 8
je 0x1003395
cmp byte [0x100a0b9], 3
jb 0x1003395
push 0x10017a8
push 0xe
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
jmp 0x1003395
push 0x100195c
push esi
push edi
call fcn.01007f6e
test eax, eax
jl 0x100338e
push dword [ebx + 0x44]
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x100195c
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x1001960
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x1001964
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push dword [ebx + 0x4c]
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x1001960
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x1001988
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push dword [ebx + 0x48]
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x1001960
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x10019b4
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x10019c8
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push dword [ebx + 0x30]
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x1001960
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x1001a64
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x100195c
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
mov eax, dword [ebp - 0x50]
push dword [eax + 8]
push esi
push edi
call fcn.01007ff1
test eax, eax
jl 0x100338e
push 0x100195c
push esi
push edi
call fcn.01007ff1
xor esi, esi
cmp eax, esi
jl 0x100338e
test byte [0x100a0bc], 8
je 0x1003185
cmp byte [0x100a0b9], 5
jb 0x1003185
push edi
push 0x10017a8
push 0xf
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027d5
call fcn.01008411
mov dword [ebp - 0x40], eax
cmp eax, esi
jne 0x10031c8
test byte [0x100a0bc], 8
je 0x100338e
cmp byte [0x100a0b9], 2
jb 0x100338e
push 0x10017a8
push 0x10
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
jmp 0x100338e
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0xa4]
push eax
push esi
push esi
push 0x10
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
jne 0x1003224
test byte [0x100a0bc], 8
je 0x1003384
cmp byte [0x100a0b9], 2
jb 0x1003384
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10017a8
push 0x11
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
jmp 0x1003384
push esi
push dword [ebp - 0x40]
push 3
lea eax, [ebx + 0x60]
push eax
push dword [ebx + 0x48]
call fcn.01008c64
mov dword [ebp - 0x38], eax
cmp eax, esi
jge 0x1003263
test byte [0x100a0bc], 8
je 0x1003384
cmp byte [0x100a0b9], 2
jb 0x1003384
push 0x10017a8
push 0x12
jmp 0x100335f
mov dword [ebp - 0x3c], esi
mov eax, dword [ebx + 0x68]
imul eax, eax, 0x3e8
cmp dword [ebp - 0x3c], eax
jae 0x1003341
mov eax, dword [0x1001954]
mov dword [ebp - 0x24], eax
mov eax, dword [0x1001958]
mov dword [ebp - 0x20], eax
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], esi
lea edx, [ebp - 0x44]
push edx
push esi
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebx + 0x60]
call fcn.01002659
mov dword [ebp - 0x38], eax
or dword [ebp - 4], 0xffffffff
jmp 0x1003318
mov eax, dword [ebp - 0x38]
and eax, 0xffff
cmp eax, 0x6ba
jne 0x100333e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [ebp - 0x3c], 0x3e8
jmp 0x1003266
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], esi
jge 0x1003372
test byte [0x100a0bc], 8
je 0x1003384
cmp byte [0x100a0b9], 2
jb 0x1003384
push 0x10017a8
push 0x14
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
jmp 0x1003384
xor esi, esi
inc esi
mov dword [ebx + 0x20], esi
push ebx
mov ecx, dword [ebx + 0x70]
call fcn.0100582c
mov dword [ebx + 0x74], esi
push dword [ebp - 0x40]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 0x1c]
call fcn.01007b5b
call fcn.01007e53
ret 0xc