Function at 0x10006db0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1001a069
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x100203f4]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100203f4]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov esi, dword [esp + 0xf0]
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
xor ebx, ebx
mov dword [esp + 0xd8], 0xf
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
mov edx, 7
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xbc], edx
mov dword [esp + 0xb8], ebx
mov word [esp + 0xa8], bx
mov dword [esp + 0xa0], edx
mov dword [esp + 0x9c], ebx
mov word [esp + 0x8c], bx
push ecx
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0xf4], 2
call fcn.10006ca0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xcc]
mov byte [esp + 0xf4], 3
call fcn.10001930
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0xe8], 2
jb 0x10006e9e
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.10008dcc
add esp, 4
push 1
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.10004600
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xb0]
mov byte [esp + 0xf4], 4
call fcn.10003b50
mov ebp, 8
cmp dword [esp + 0x40], ebp
mov byte [esp + 0xe8], 2
jb 0x10006ee6
mov eax, dword [esp + 0x2c]
push eax
call fcn.10008dcc
add esp, 4
push 1
lea ecx, [esp + 0xc4]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.10004600
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0xf4], 5
call fcn.10003b50
cmp dword [esp + 0x40], ebp
jb 0x10006f28
mov eax, dword [esp + 0x2c]
push eax
call fcn.10008dcc
add esp, 4
mov esi, dword [esp + 0x9c]
add esi, 3
lea ecx, [esi + esi]
push ecx
call fcn.1000a656
push 0x44
lea edx, [esp + 0x4c]
push ebx
push edx
mov edi, eax
call fcn.10009670
xor eax, eax
push 0x1001b65c
push esi
push edi
mov dword [esp + 0x60], 0x44
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.1000a59b
mov eax, dword [esp + 0xa8]
add esp, 0x1c
cmp dword [esp + 0xa0], ebp
jae 0x10006f8a
lea eax, [esp + 0x8c]
push eax
push esi
push edi
call fcn.1000a521
mov eax, dword [esp + 0xb4]
add esp, 0xc
cmp dword [esp + 0xbc], ebp
jae 0x10006fac
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x48]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
mov eax, dword [esp + 0x18]
push eax
setne byte [esp + 0x1b]
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call esi
cmp dword [esp + 0xa0], ebp
jb 0x10006ff8
mov edx, dword [esp + 0x8c]
push edx
call fcn.10008dcc
add esp, 4
cmp dword [esp + 0xbc], ebp
mov esi, 7
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], ebx
mov word [esp + 0x8c], bx
jb 0x1000702c
mov eax, dword [esp + 0xa8]
push eax
call fcn.10008dcc
add esp, 4
cmp dword [esp + 0xd8], 0x10
mov dword [esp + 0xbc], esi
mov dword [esp + 0xb8], ebx
mov word [esp + 0xa8], bx
jb 0x1000705c
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.10008dcc
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.10009526
add esp, 0xd8
ret