Function at 0x10020688
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x100612a3
call fcn.10060138
sub esp, 0xa4
push ebx
push esi
push edi
mov edi, edx
cmp byte [edi], 0x50
jne 0x10020e38
cmp byte [edi + 1], 0x4b
jne 0x10020e38
push 0xfffffffffffffff9
pop eax
push 3
pop esi
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
push esi
call fcn.10004840
xor ebx, ebx
mov dword [ebp - 0x28], 0xa50b5f0
mov dword [ebp - 0x10], ebx
jmp 0x100206ed
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100206dd
mov dword [ebp - 0x10], ebx
jmp 0x10020708
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8c], 0xd744d028
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100206f7
inc dword [ebp - 0x88]
lea ecx, [ebp - 0xb0]
call fcn.1000489d
mov al, byte [edi + 2]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x18], 0x844a7543
mov dword [ebp - 0x14], 0xec3203bd
push esi
mov byte [ebp - 0x19], al
call fcn.10004840
mov dword [ebp - 0x24], 0x7b5cf1c9
xor ecx, ecx
mov dword [ebp - 0x20], esi
inc ecx
mov dword [ebp - 0x10], ebx
jmp 0x10020757
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002074d
mov dword [ebp - 0x10], ebx
jmp 0x10020771
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 0xaf0a9b27
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10020761
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x2c], 0x8c66
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x58]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xe6f7fbf2
mov edx, dword [esi + 8]
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x8c66
setl cl
xor eax, eax
cmp ecx, edx
setne al
sub eax, edx
sub eax, 0xfffffff7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
je 0x100207dc
mov byte [ebp - 0x1a], bl
cmp byte [ebp - 0x1a], bl
je 0x100207f7
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x100207f7
mov dword [ebp - 0x24], 0x42be197e
dec dword [ebp - 0x24]
mov byte [ebp - 0x1a], bl
cmp byte [ebp - 0x1a], bl
je 0x100207f7
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
cmp dword [esi + 8], 9
setge cl
xor eax, eax
cmp ecx, dword [esi + 8]
setg al
cmp eax, dword [ebp - 0x18]
jle 0x10020832
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
jmp 0x1002084a
mov dword [ebp - 0x28], 0x4fa72d50
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x28], 0x3747c914
dec dword [ebp - 0x20]
lea ecx, [ebp - 0x58]
call fcn.1000489d
mov al, byte [edi + 3]
lea ecx, [ebp - 0x70]
xor esi, esi
mov byte [ebp - 0x1a], al
inc esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0x7f6cc9ca
mov dword [ebp - 0x20], 0xfffffffd
mov dword [ebp - 0x18], 6
push esi
call fcn.10004840
mov dword [ebp - 0x18], ebx
jmp 0x10020891
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], 0x6bf5ee87
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10020881
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0xf451dba1
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xe0c2
jg 0x100208e4
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, esi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
sub ecx, eax
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0xffffffe9
jmp 0x10020937
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1002092f
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1002092a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x70]
cmp dword [eax + ecx*4], ebx
jne 0x1002092a
dec dword [ebp - 0x18]
jns 0x1002091a
dec dword [ebp - 0x10]
jns 0x10020912
cmp dword [ebp - 0x20], ebx
jne 0x1002093d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xc
jne 0x10020903
lea ecx, [ebp - 0x70]
call fcn.1000489d
movzx esi, byte [ebp - 0x19]
mov dword [ebp - 0x10], 0x5c96
add esi, 4
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x10], ebx
je 0x10020a38
mov dword [ebp - 0x18], 0xc63c4078
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x20], 3
push 2
call fcn.10004840
push 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], ebx
call fcn.10004840
mov dword [ebp - 0x14], ebx
jmp 0x100209a0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], 0xc58f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10020990
mov dword [ebp - 0x14], ebx
jmp 0x100209bb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 0xef2f37fc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100209ab
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100209d2
push ebx
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x18]
add edx, 6
jne 0x100209f5
cmp dword [ebp - 0x10], ebx
jne 0x100209f5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jge 0x10020a19
mov eax, dword [ebp - 0x64]
cmp dword [eax], ebx
jne 0x10020a19
cmp dword [ebp - 0x10], ebx
jne 0x10020a19
mov ecx, ebx
jmp 0x10020a1c
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x4c]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x4c]
call fcn.1000489d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.1000489d
jmp 0x10020a3e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], ebx
jmp 0x10020a61
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10020a5e
push ebx
push 0x21e7
push ebx
push 0x993
call dword [sym.imp.USER32.dll_SetTimer]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jne 0x10020a43
movzx eax, byte [ebp - 0x1a]
lea ecx, [ebp - 0x40]
add eax, 0x18
mov dword [ebp - 0x10], 0x69bd
add eax, esi
push 1
mov dword [ebp - 0x30], eax
call fcn.10004840
mov dword [ebp - 0x14], 0xc6d21cd
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x20], 0x67df2ddf
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x18], ebx
jmp 0x10020ab2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10020aa5
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setle cl
xor ebx, ebx
cmp eax, ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x40]
setne bl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp ebx, edx
setle cl
imul eax, ecx
test eax, eax
je 0x10020afa
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
test edx, edx
setns cl
xor eax, eax
cmp ecx, edx
setge al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xa
cmp dword [ebp - 0x14], 0x1d
jge 0x10020bd1
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov dword [ebp - 0x10], 0x4acc
mov dword [ebp - 0x20], 0xfffffffa
cmp dword [ecx], 0x9ed5
mov eax, dword [ecx]
setne dl
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ebx, ebx
cmp eax, edx
setne bl
xor ecx, ecx
imul ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x18]
cmp eax, ebx
setl cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub ecx, 0xc7e7
cmp ecx, eax
setg dl
xor ebx, ebx
neg edx
je 0x10020b9b
cmp dword [ebp - 0x10], ebx
je 0x10020b9b
xor eax, eax
inc eax
jmp 0x10020b9d
mov eax, ebx
imul ecx, eax, 0xfffffff9
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x24]
je 0x10020bbc
mov dword [ebp - 0x20], 0xa3d35555
jmp 0x10020bc2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1d
jl 0x10020b24
jmp 0x10020bd3
xor ebx, ebx
lea ecx, [ebp - 0x40]
call fcn.1000489d
mov ecx, dword [esi + edi + 0x14]
mov edx, dword [esi + edi]
call fcn.1000d486
mov dword [ebp - 0x10], 0x99cf
mov dword [ebp - 0x14], 0x62a2b3b7
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
neg esi
mov dword [ebp - 0x24], eax
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
sete dl
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jne 0x10020c87
cmp dword [ebp - 0x10], 6
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
jne 0x10020c87
push 3
lea ecx, [ebp - 0xa4]
call fcn.10004840
mov dword [ebp - 0x18], ebx
jmp 0x10020c4a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10020c37
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x10020c7a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10020c75
push 0x11fd
push 0xed3
call dword [sym.imp.GDI32.dll_SetTextAlign]
dec dword [ebp - 0x10]
jns 0x10020c5c
lea ecx, [ebp - 0xa4]
call fcn.1000489d
jmp 0x10020cbf
mov dword [ebp - 0x14], 0x19
jmp 0x10020cb9
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10020ca1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10020cb6
push 0xa82
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jg 0x10020c90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x30]
add esi, edi
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x10], 0xfffffffb
inc eax
mov dword [ebp - 0x20], eax
shr ecx, 2
mov dword [ebp - 0x30], 0x764ce34a
inc ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0x1b
mov dword [ebp - 0x24], ecx
je 0x10020daa
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0xe8fe
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0xfffc
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
jne 0x10020d83
cmp dword [ebp - 0x14], ebx
jne 0x10020d83
mov ecx, ebx
jmp 0x10020d86
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x2c5d177c
push 1
setne al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1b
pop eax
jne 0x10020cf4
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + edi]
mov dword [ebp - 0x80], eax
mov eax, dword [edx + edi + 4]
mov dword [ebp - 0x7c], eax
mov eax, dword [edx + edi + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [edx + edi + 0xc]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0x11151c
mov dword [ebp - 0x14], 0x477862fd
mov dword [ebp - 0x14], ebx
jmp 0x10020e0e
mov dword [ebp - 0x18], ebx
jmp 0x10020df4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98], 0xe08974b6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10020de3
cmp dword [ebp - 0x98], ebx
jne 0x10020e14
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jne 0x10020dde
test ecx, ecx
je 0x10020e3d
sub edi, esi
mov ecx, dword [esi]
mov edx, ebx
and edx, 3
mov edx, dword [ebp + edx*4 - 0x80]
call fcn.1000d486
inc ebx
mov dword [edi + esi], eax
lea esi, [esi + 4]
cmp ebx, dword [ebp - 0x24]
jb 0x10020e1a
jmp 0x10020e3d
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret