Function at 0x100096d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2100
call fcn.1000b940
mov dword [ebp - 0x20ec], ecx
mov ecx, dword [ebp - 0x20ec]
call fcn.10008e90
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20ec]
add ecx, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1000d380
mov edx, dword [ebp - 0x20ec]
add edx, 0x6a0
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x20ec]
add eax, 0x4dc
push eax
mov ecx, dword [ebp - 0x20ec]
call fcn.10009f30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009749
mov eax, dword [ebp - 8]
jmp 0x10009ae1
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10009a55
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100097a1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x100099b2
mov ecx, dword [ebp - 0x20ec]
call fcn.10009f90
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10009804
mov eax, 0x10009c00
sub eax, fcn.10009af0
push eax
push fcn.10009af0
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x20ec]
call fcn.100091b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100097f5
mov dword [ebp - 0x20f0], str.succeed
jmp 0x100097ff
mov dword [ebp - 0x20f0], str.failed
jmp 0x100099ad
push 0x10
lea edx, [ebp - 0x2c]
push edx
call fcn.1000ac30
add esp, 8
push 0x44
lea eax, [ebp - 0x378]
push eax
call fcn.1000ac30
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x378], 0x44
push 0
push 0x1000e01c
lea ecx, [ebp - 0x330]
call fcn.10002a50
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x100099ad
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x37c]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x1c]
push eax
push 1
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x384], eax
lea ecx, [ebp - 0x380]
push ecx
push 0x2000000
mov edx, dword [ebp - 0x384]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100098e2
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x378]
push ecx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push str._4fy7r2___:x17_0.lc___4_7_
lea ecx, [ebp - 0x688]
call fcn.10002a50
push eax
push 0
mov edx, dword [ebp - 0x380]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000991e
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x378]
push ecx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push str._4fy7r2___:x17_0.lc___4_7_
lea ecx, [ebp - 0x688]
call fcn.10002a50
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10009930
mov dword [ebp - 0x20f4], str.succeed
jmp 0x1000993a
mov dword [ebp - 0x20f4], str.failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xc], 0
je 0x100099ad
mov ecx, dword [ebp - 0x20ec]
call fcn.10009f90
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 0
je 0x100099ad
mov edx, 0x10009c00
sub edx, fcn.10009af0
push edx
push fcn.10009af0
mov eax, dword [ebp - 0x68c]
push eax
mov ecx, dword [ebp - 0x20ec]
call fcn.100091b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100099a3
mov dword [ebp - 0x20f8], str.succeed
jmp 0x100099ad
mov dword [ebp - 0x20f8], str.failed
jmp 0x10009a33
mov ecx, dword [ebp - 0x20ec]
call fcn.10009f90
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 0
je 0x10009a10
mov ecx, 0x10009c00
sub ecx, fcn.10009af0
push ecx
push fcn.10009af0
mov edx, dword [ebp - 0x690]
push edx
mov ecx, dword [ebp - 0x20ec]
call fcn.100091b0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10009a04
mov dword [ebp - 0x20fc], str.succeed
jmp 0x10009a0e
mov dword [ebp - 0x20fc], str.failed
jmp 0x10009a33
mov dword [ebp - 8], 0x17
cmp dword [ebp - 8], 0
jne 0x10009a29
mov dword [ebp - 0x2100], str.succeed
jmp 0x10009a33
mov dword [ebp - 0x2100], str.failed
cmp dword [ebp - 0x10], 0
je 0x10009a43
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
cmp dword [ebp - 0x14], 0
je 0x10009a53
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_CloseDesktop]
jmp 0x10009a67
mov edx, dword [ebp - 0x20ec]
add edx, 0xc
push edx
call fcn.10009af0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009a72
mov eax, dword [ebp - 8]
jmp 0x10009ae1
mov ecx, dword [ebp - 0x20ec]
call fcn.10009560
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009a8b
mov eax, dword [ebp - 8]
jmp 0x10009ae1
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
mov ecx, dword [ebp - 0x20ec]
call fcn.1000a0c0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10009ade
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x10009ade
mov ecx, dword [ebp - 0x20ec]
call fcn.1000a140
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009ac8
mov eax, dword [ebp - 8]
jmp 0x10009ae1
movzx edx, byte [ebp + 0x10]
test edx, edx
je 0x10009ade
mov ecx, dword [ebp - 0x20ec]
call fcn.1000a240
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc