Function at 0x100e9381
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
mov eax, edx
mov esi, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
push edi
test eax, eax
jne 0x100e944d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
or ebx, 0xffffffff
mov ecx, dword [0x1010e2c0]
mov esi, eax
cmp ecx, ebx
je 0x100e94a9
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x100e94a3
cmp edi, ebx
jne 0x100e9426
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac0
mov dword [eax], 0x16
call sym.ucrtbase.dll__invalid_parameter_noinfo
mov eax, ebx
jmp 0x100e9836
xor edx, edx
call fcn.10032a89
push 0
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100e93cd
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x100e9417
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x100e93f4
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x100e93cd
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x100e93d4
lea eax, [edi + 0x10]
jmp 0x100e93d9
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100e93a1
cmp esi, 4
jbe 0x100e9575
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
or ebx, 0xffffffff
mov esi, eax
cmp ecx, ebx
je 0x100e94e1
call fcn.10029fa0
mov edi, eax
test edi, edi
je 0x100e94db
cmp edi, ebx
jne 0x100e9543
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac4
and dword [eax], 0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x100e93aa
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100e93cd
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
je 0x100e93eb
jmp 0x100e93fc
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100e9489
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x1010e2c0]
test edi, edi
jne 0x100e9519
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100e9489
mov edx, edi
call fcn.10032a89
test eax, eax
jne 0x100e9534
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
push edi
jmp 0x100e950e
mov ecx, edi
call fcn.10031ad6
push 0
call sym.ucrtbase.dll__free_base
pop ecx
test edi, edi
je 0x100e9489
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add edi, eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test edi, edi
je 0x100e9490
lea eax, [edi + 0x14]
jmp 0x100e9495
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.100e66b9
or ebx, 0xffffffff
pop ecx
pop ecx
cmp eax, ebx
jne 0x100e95ad
push dword [ebp - 0x10]
call sym.ucrtbase.dll__free_base
push dword [ebp - 0x14]
call sym.ucrtbase.dll__free_base
pop ecx
pop ecx
jmp 0x100e93e4
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], eax
cmp esi, 4
lea eax, [ebp - 4]
mov dword [ebp - 0xc], eax
setne byte [ebp - 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 8]
push 7
mov dword [ebp - 0x30], eax
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100e84de
test al, al
jne 0x100e9615
push dword [ebp - 4]
call sym.ucrtbase.dll__free_base
mov dword [ebp - 4], edi
push dword [ebp - 0x10]
call sym.ucrtbase.dll__free_base
push dword [ebp - 0x14]
call sym.ucrtbase.dll__free_base
mov eax, ebx
jmp 0x100e9833
mov eax, edi
cmp esi, 4
jne 0x100e961f
push 8
pop eax
or eax, 0x400
mov dword [ebp - 0x18], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x1010e2c0]
mov esi, eax
cmp ecx, ebx
je 0x100e96ed
call fcn.10029fa0
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100e96e7
cmp eax, ebx
jne 0x100e975a
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x1010eac4
push 0x44
pop esi
push esi
mov dword [eax], edi
lea eax, [ebp - 0x8c]
push edi
push eax
call sym.ucrtbase.dll__o_memset
mov ax, word [ebp - 0x2c]
add esp, 0xc
mov word [ebp - 0x5a], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], esi
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 1
push edi
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x44]
test eax, eax
jne 0x100e9793
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.1003779a
cmp edi, ebx
je 0x100e96d3
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp esi, ebx
je 0x100e97f9
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x100e97f9
mov ecx, dword [0x1010e2c0]
mov edx, ebx
call fcn.10032a89
test eax, eax
je 0x100e9655
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
mov ecx, dword [0x1010e2c0]
test eax, eax
jne 0x100e972a
xor edx, edx
call fcn.10032a89
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100e9655
mov edx, eax
call fcn.10032a89
test eax, eax
jne 0x100e9748
mov ecx, dword [0x1010e2c0]
xor edx, edx
call fcn.10032a89
mov ecx, dword [ebp - 0xc]
push ecx
jmp 0x100e971f
mov ecx, dword [ebp - 0xc]
call fcn.10031ad6
push edi
call sym.ucrtbase.dll__free_base
mov eax, dword [ebp - 0xc]
pop ecx
test eax, eax
je 0x100e9655
mov ecx, dword [0x1010e2c4]
call fcn.10029fa0
imul eax, eax, 0x364
push esi
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100e965c
add eax, 0x14
jmp 0x100e9661
mov eax, dword [ebp - 0x24]
cmp eax, 2
jne 0x100e97a2
push 0
call sym.ucrtbase.dll__Exit
test eax, eax
jne 0x100e97dc
push ebx
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x48]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
cmp edi, ebx
je 0x100e97cc
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp esi, ebx
je 0x100e97d7
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ebx, dword [ebp - 0x20]
jmp 0x100e97f9
cmp eax, 4
jne 0x100e980a
cmp edi, ebx
je 0x100e97ec
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp esi, ebx
je 0x100e97f7
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ebx, ebx
push dword [ebp - 4]
call sym.ucrtbase.dll__free_base
and dword [ebp - 4], 0
jmp 0x100e95fe
cmp edi, ebx
je 0x100e9815
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 4]
call sym.ucrtbase.dll__free_base
push dword [ebp - 0x10]
and dword [ebp - 4], 0
call sym.ucrtbase.dll__free_base
push dword [ebp - 0x14]
call sym.ucrtbase.dll__free_base
mov eax, esi
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret