Function at 0x1000c826
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aa50a
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x100d6084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
lea eax, [edx + 1]
cmp eax, ecx
jbe 0x1000c804
xor al, al
jmp 0x1000c80a
mov eax, dword [esi + 0x10]
mov al, byte [edx + eax]
movzx eax, al
inc edx
add eax, 0xffffff5d
mov dword [esi + 8], edx
cmp eax, 9
ja case.0x1000c81f.164
jmp dword [eax*4 + 0x1000cdc8]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1000f8f0
cmp dword [ebp - 0x2c], 0x10
lea esi, [ebp - 0x40]
push 1
cmovae esi, dword [ebp - 0x40]
mov ah, 0xe
push 0
mov al, 0x61
mov byte [ebp - 0x50], ah
xor al, ah
mov byte [ebp - 0x4b], 0
push 0
mov cl, 0x7e
mov byte [ebp - 0x4f], al
mov dl, 0x6b
mov byte [ebp - 0x4b], 0
mov bl, 0x60
xor cl, ah
xor dl, ah
mov byte [ebp - 0x4e], cl
xor bl, ah
mov byte [ebp - 0x4d], dl
push esi
lea eax, [ebp - 0x4f]
mov byte [ebp - 0x4c], bl
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x40]
jmp 0x1000cda7
mov ecx, esi
call fcn.1000fcb0
jmp case.0x1000c81f.164
mov edi, dword [0x100dafb4]
test edi, edi
je case.0x1000c81f.164
mov ecx, dword [esi + 0x14]
lea eax, [edx + 1]
sub ecx, dword [esi + 0x10]
cmp eax, ecx
jbe 0x1000c8d0
lea eax, [edx + 1]
xor cl, cl
mov dword [esi + 8], eax
mov byte [edi + 2], cl
jmp case.0x1000c81f.164
mov eax, dword [esi + 0x10]
mov cl, byte [edx + eax]
lea eax, [edx + 1]
mov dword [esi + 8], eax
mov byte [edi + 2], cl
jmp case.0x1000c81f.164
mov edi, dword [0x100dafb4]
test edi, edi
je case.0x1000c81f.164
mov ecx, esi
call fcn.1000fa20
mov byte [edi + 3], al
jmp case.0x1000c81f.164
mov edi, dword [0x100dafb4]
test edi, edi
je case.0x1000c81f.164
mov ecx, esi
call fcn.1000fa20
mov byte [edi + 1], al
jmp case.0x1000c81f.164
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.1000f850
mov eax, dword [ebp - 0x48]
mov ecx, 0x3e8
cmp ax, cx
cmova eax, ecx
xor ecx, ecx
cmp cx, ax
jae case.0x1000c81f.164
movzx eax, ax
mov dword [ebp - 0x48], eax
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
lea eax, [edx + 2]
cmp eax, ecx
jbe 0x1000c975
xor edi, edi
jmp 0x1000c97c
mov eax, dword [esi + 0x10]
movzx edi, word [edx + eax]
add edx, 2
mov dword [esi + 8], edx
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
lea eax, [edx + 1]
cmp eax, ecx
jbe 0x1000c995
mov byte [ebp - 0x41], 0
jmp 0x1000c99e
mov eax, dword [esi + 0x10]
mov al, byte [edx + eax]
mov byte [ebp - 0x41], al
lea eax, [edx + 1]
mov ecx, esi
mov dword [esi + 8], eax
lea eax, [ebp - 0x28]
push eax
call fcn.1000f8f0
mov edx, eax
mov ebx, dword [edx + 8]
mov ecx, dword [edx + 0x14]
sub ecx, dword [edx + 0x10]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1000c9c7
mov byte [ebp - 0x5c], 0
jmp 0x1000c9d0
mov eax, dword [edx + 0x10]
mov al, byte [ebx + eax]
mov byte [ebp - 0x5c], al
inc ebx
mov dword [edx + 8], ebx
mov ecx, dword [edx + 0x14]
sub ecx, dword [edx + 0x10]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1000c9e7
mov byte [ebp - 0x58], 0
jmp 0x1000c9f0
mov eax, dword [edx + 0x10]
mov al, byte [ebx + eax]
mov byte [ebp - 0x58], al
inc ebx
mov dword [edx + 8], ebx
mov ecx, dword [edx + 0x14]
sub ecx, dword [edx + 0x10]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1000ca07
mov byte [ebp - 0x54], 0
jmp 0x1000ca10
mov eax, dword [edx + 0x10]
mov al, byte [ebx + eax]
mov byte [ebp - 0x54], al
lea eax, [ebx + 1]
movzx ebx, di
mov dword [edx + 8], eax
mov edx, ebx
call fcn.1000cf50
cmp byte [ebp - 0x41], 1
jne 0x1000cb02
test eax, eax
jne 0x1000cb5d
push 0x1c
call fcn.1006e186
mov edi, eax
add esp, 4
mov dword [ebp - 0x88], edi
push dword [ebp - 0x54]
mov byte [ebp - 4], 2
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x1000ca6e
mov eax, dword [ecx]
jmp 0x1000ca70
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.10002400
mov ecx, edi
call fcn.1000f790
push 0x1c
mov edi, eax
mov byte [ebp - 4], 1
call fcn.1006e186
add esp, 4
mov dword [ebp - 0x84], eax
push dword [ebp - 0x54]
mov byte [ebp - 4], 3
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x1000cac7
mov eax, dword [ecx]
jmp 0x1000cac9
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.10002400
mov ecx, dword [ebp - 0x84]
call fcn.1000f790
push eax
mov edx, ebx
mov byte [ebp - 4], 1
call fcn.1000d040
test al, al
jne 0x1000cb5d
test edi, edi
je 0x1000cb5d
push ecx
mov ecx, edi
call fcn.1000cdf0
jmp 0x1000cb5d
test eax, eax
je 0x1000cb5d
mov ecx, eax
call fcn.1000f760
mov edx, ebx
mov ecx, 0x100df9a8
call fcn.1000ce50
mov ecx, edi
call fcn.10025200
mov edi, eax
test edi, edi
je 0x1000cb5d
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1000cb5d
cmp dword [edi + 0x760], eax
je 0x1000cb5d
mov ecx, dword [edi + 0x3a8]
mov dword [edi + 0x760], eax
test ecx, ecx
je 0x1000cb5d
mov eax, dword [ecx]
push 1
mov eax, dword [eax]
call eax
mov dword [edi + 0x3a8], 0
sub dword [ebp - 0x48], 1
jne 0x1000c961
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb case.0x1000c81f.164
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10002720
jmp case.0x1000c81f.164
mov byte [ebp - 0x41], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 4], 4
mov dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x41]
mov byte [ebp - 0x28], 0
push eax
mov ecx, esi
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
or ebx, 0xffffffff
mov dword [ebp - 0x48], 0
mov byte [esi + 4], 0
call fcn.1000fa50
mov ecx, eax
call fcn.1000f8f0
mov ecx, eax
call fcn.1000f720
cmp dword [ebp - 0x18], 0
je 0x1000cd9c
mov edi, dword [ebp - 0x48]
test edi, edi
jle 0x1000cd9c
mov ecx, edi
call fcn.10012910
mov esi, eax
test esi, esi
je 0x1000cd9c
mov cl, byte [esi + 4]
mov edx, edi
call fcn.10012940
mov edi, eax
test edi, edi
je 0x1000cd9c
mov al, byte [ebp - 0x41]
cmp al, 1
jne 0x1000ccd2
push edi
mov edx, esi
lea ecx, [ebp - 0xb8]
call fcn.10012f70
add esp, 4
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x1000cc49
mov eax, dword [eax]
cmp dword [ebp - 0x14], 0x10
movaps xmm0, xmmword [0x100c8fc0]
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x60], 0
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
movups xmmword [ebp - 0x80], xmm0
push eax
movaps xmm0, xmmword [str._eOTeNKIZ_e]
movups xmmword [ebp - 0x70], xmm0
mov al, byte [ebp - 0x80]
xor byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x1f
jb 0x1000cc72
sub esp, 0x18
mov byte [ebp - 0x60], 0
lea eax, [ebp - 0x7f]
mov ecx, esp
push eax
call fcn.10002940
lea eax, [ebp - 0xa0]
push eax
call fcn.1000f610
add esp, 0x24
lea ecx, [ebp - 0x40]
push eax
call fcn.10007a40
lea ecx, [ebp - 0xa0]
call fcn.100022f0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 5
call fcn.100022f0
mov cl, byte [edi + 0x4c]
call fcn.1000c740
mov ebx, eax
jmp 0x1000cd86
test al, al
jne 0x1000cd86
push edi
mov edx, esi
lea ecx, [ebp - 0xa0]
call fcn.10012f70
add esp, 4
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x1000ccf7
mov eax, dword [eax]
cmp dword [ebp - 0x14], 0x10
movaps xmm0, xmmword [0x100c8590]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x70], 0x1e1b4e01
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], 0xa0f1c09
mov dword [ebp - 0x68], 0x1d4b4e0b
mov word [ebp - 0x64], 0x40
nop dword [eax]
mov al, byte [ebp - 0x80]
xor byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x1c
jb 0x1000cd30
sub esp, 0x18
mov byte [ebp - 0x63], 0
lea eax, [ebp - 0x7f]
mov ecx, esp
push eax
call fcn.10002940
lea eax, [ebp - 0xb8]
push eax
call fcn.1000f610
add esp, 0x24
lea ecx, [ebp - 0x40]
push eax
call fcn.10007a40
lea ecx, [ebp - 0xb8]
call fcn.100022f0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 5
call fcn.100022f0
mov ebx, 0xffff0000
cmp dword [ebp - 0x30], 0
je 0x1000cd9c
push 3
push 1
push ebx
lea ecx, [ebp - 0x40]
call fcn.10032320
add esp, 0xc
lea ecx, [ebp - 0x40]
call fcn.100022f0
lea ecx, [ebp - 0x28]
call fcn.100022f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e175
mov esp, ebp
pop ebp
ret