Function at 0x10119280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x10229ea4], ecx
cmp dword [ebp + 8], 0
je 0x101192a5
cmp dword [ebp + 8], 0
je 0x101192a5
cmp dword [ebp + 0xc], 1
je 0x101192ac
xor al, al
jmp 0x10119504
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x18]
jne 0x101192f4
mov ecx, dword [0x10229c40]
cmp dword [ecx + 0x443c], 0
je 0x101192ef
push 1
push 0
push 0
mov edx, dword [0x10229c40]
mov ecx, dword [edx + 0x443c]
add ecx, 0x58
call fcn.10008c60
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
jmp 0x10119502
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 8]
jne 0x1011934c
mov edx, dword [0x10229c40]
cmp dword [edx + 0x4478], 0
je 0x10119347
mov eax, dword [0x10229c40]
mov ecx, dword [eax + 0x4478]
call fcn.1005fcf0
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c4070
push 7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c6220
nop
jmp 0x10119502
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0xc]
jne 0x101193b0
mov ecx, dword [0x10229c40]
mov edx, dword [ecx + 0x43d8]
cmp dword [edx + 0x13c], 0
je 0x101193ab
mov eax, dword [0x10229c40]
mov ecx, dword [eax + 0x43d8]
mov ecx, dword [ecx + 0x13c]
call fcn.10073910
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c4070
push 7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c6220
nop
jmp 0x10119502
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jne 0x101193e0
mov edx, dword [0x10229c40]
cmp dword [edx + 0x449c], 0
je 0x101193db
mov eax, dword [0x10229c40]
mov ecx, dword [eax + 0x449c]
call fcn.1001ca10
nop
jmp 0x10119502
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x14]
jne 0x10119410
mov eax, dword [0x10229c40]
cmp dword [eax + 0x449c], 0
je 0x1011940b
mov ecx, dword [0x10229c40]
mov ecx, dword [ecx + 0x449c]
call fcn.1001cb90
nop
jmp 0x10119502
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x20]
jne 0x10119479
mov ecx, dword [0x10229c40]
cmp dword [ecx + 0x44a0], 0
je 0x10119474
mov edx, dword [0x10229c40]
mov eax, dword [edx + 0x44a0]
mov ecx, dword [eax + 0x230]
push ecx
mov ecx, dword [0x10229c40]
call fcn.100c40a0
movzx edx, al
test edx, edx
je 0x10119462
mov eax, dword [0x10229c40]
mov ecx, dword [eax + 0x44a0]
call fcn.100276a0
nop
jmp 0x10119474
mov ecx, dword [0x10229c40]
mov ecx, dword [ecx + 0x44a0]
call fcn.100276f0
nop
jmp 0x10119502
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x24]
jne 0x101194ce
mov ecx, dword [0x10229c40]
cmp dword [ecx + 0x4474], 0
je 0x101194cc
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
mov ecx, dword [0x10229c40]
call fcn.100c4070
push 7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
mov ecx, dword [0x10229c40]
call fcn.100c6220
mov eax, dword [0x10229c40]
mov ecx, dword [eax + 0x4474]
call fcn.1001f180
nop
jmp 0x10119502
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x28]
jne 0x10119502
mov ecx, dword [ebp - 4]
call fcn.101195d0
nop
mov eax, dword [0x10229c40]
cmp dword [eax + 0x447c], 0
je 0x10119502
mov ecx, dword [0x10229c40]
mov ecx, dword [ecx + 0x447c]
call fcn.100194f0
nop
mov al, 1
mov esp, ebp
pop ebp
ret 8