Function at 0x10014a6b
Capabilities:
Create process on windows

Disassembly:
push 0xf4
mov eax, 0x1004faa0
call fcn.10018733
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp dword [eax], 0x40
jne 0x10014aa6
test dword [eax + 4], 0x4000
je 0x10014aa6
xor ebx, ebx
cmp word [eax + 0x2a], bx
je 0x10014aae
push dword [eax + 0x28]
lea ecx, [ebp - 0xb0]
call fcn.1000fff6
jmp 0x10014ac7
xor ebx, ebx
cmp word [eax + 0xe], bx
jne 0x10014ab4
movzx edi, word [eax + 0xc]
jmp 0x10014ae3
push ebx
push dword [eax + 0xc]
lea eax, [ebp - 0xb0]
push eax
call fcn.10010b84
add esp, 0xc
lea eax, [ebp - 0xb0]
mov ecx, esi
push eax
call fcn.10014625
push dword [ebp - 0xb0]
mov edi, eax
call fcn.10018644
pop ecx
test edi, edi
js 0x10014f0b
cmp edi, dword [esi + 0x30]
jae 0x10014f0b
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0x100]
push dword [eax + edi*4]
call fcn.10013f77
mov eax, dword [ebp - 0x100]
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp eax, 0xb
jg 0x10014cc3
cmp eax, 6
jge 0x10014c2e
cmp eax, 1
je 0x10014b84
jle 0x10014b43
cmp eax, 4
jle 0x10014b55
cmp eax, 5
jne 0x10014b43
push ebx
lea eax, [esi + 0x10]
push ebx
push eax
call fcn.100131e8
add esp, 0xc
lea ecx, [ebp - 0x100]
call fcn.100141ab
xor eax, eax
jmp 0x10014f10
jne 0x10014b5f
cmp byte [esi + 0x40], 0
mov cl, 1
jne 0x10014b61
mov cl, bl
cmp eax, 2
push 1
push ebx
push ecx
sete al
movzx eax, al
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.1001309b
add esp, 0x18
jmp 0x10014b43
lea ecx, [ebp - 0xbc]
call fcn.1001002d
mov eax, dword [esi + 0x10]
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0xb0]
push eax
call fcn.10012236
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 3
call fcn.100100a1
push dword [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.10018644
cmp dword [ebp - 0xc8], 0
pop ecx
je 0x10014bf1
push 0x100572b8
lea ecx, [ebp - 0xbc]
call fcn.10010327
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xbc]
call fcn.100102e9
lea eax, [ebp - 0xb0]
push eax
call fcn.100146fe
pop ecx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 4
push ecx
push dword [eax]
call fcn.1001227d
pop ecx
pop ecx
push dword [ebp - 0xb0]
call fcn.10018644
push dword [ebp - 0xbc]
call fcn.10018644
pop ecx
jmp 0x10014d19
cmp eax, 7
je 0x10014c43
cmp eax, 9
je 0x10014c43
mov byte [ebp - 0x9c], bl
cmp eax, 0xb
jne 0x10014c4a
mov byte [ebp - 0x9c], 1
cmp eax, 6
je 0x10014c5a
mov byte [ebp - 0xa0], bl
cmp eax, 7
jne 0x10014c61
mov byte [ebp - 0xa0], 1
cmp eax, 6
je 0x10014c71
mov byte [ebp - 0xa4], bl
cmp eax, 7
jne 0x10014c78
mov byte [ebp - 0xa4], 1
sub esp, 0xc
mov ecx, esp
push 0x10054a0c
call fcn.1000fff6
push 1
push ebx
push ebx
push dword [ebp - 0xa0]
lea eax, [esi + 0x10]
push dword [ebp - 0x9c]
push eax
push dword [ebp - 0xa4]
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10012bdc
add esp, 0x34
jmp 0x10014b43
cmp eax, 0xf
jle 0x10014cd6
cmp eax, 0x10
je 0x10014d1f
cmp eax, 0x11
jne 0x10014b43
cmp ebx, 5
jae 0x10014b43
imul ecx, ebx, 0xc
add ecx, 0x10057710
cmp dword [ecx], eax
jne 0x10014f05
push dword [ecx + 8]
lea ecx, [ebp - 0xb0]
call fcn.1000ffac
push eax
lea eax, [esi + 0x10]
mov byte [ebp - 4], 5
push eax
call fcn.10012ac8
pop ecx
pop ecx
push dword [ebp - 0xb0]
call fcn.10018644
pop ecx
jmp 0x10014b43
call fcn.1000296f
push eax
lea ecx, [ebp - 0x9c]
call fcn.1000254a
mov byte [ebp - 4], 6
mov edi, ebx
cmp edi, dword [esi + 0x14]
jae 0x10014db5
mov eax, dword [esi + 0x10]
mov eax, dword [eax + edi*4]
cmp dword [eax + 4], 0
je 0x10014db2
mov eax, dword [eax]
lea ecx, [ebp - 0x94]
push 3
mov dword [ebp - 0x98], ecx
lea ecx, [ebp - 0x98]
push eax
call fcn.10004327
push dword [ebp - 0x98]
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 7
call fcn.10014343
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x98], eax
je 0x10014d96
push dword [ebp - 0x98]
call fcn.10033db6
pop ecx
push 0x10057ad8
call fcn.10033a90
pop ecx
push eax
push 0x10057ad8
lea ecx, [ebp - 0x9c]
call fcn.1001436c
inc edi
jmp 0x10014d36
lea eax, [ebp - 0xbc]
push eax
call fcn.10010e1c
pop ecx
push str.Female.exe
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 8
call fcn.10010376
mov eax, dword [ebp - 0x9c]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.10002d6d
add esp, 0xc
push eax
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 9
call fcn.1001428f
mov ecx, dword [ebp - 0xc0]
mov byte [ebp - 4], 8
lea ecx, [ecx - 0x10]
call fcn.10002c15
push str._mdfilelist
lea ecx, [ebp - 0xa0]
call fcn.10002573
mov esi, 0x10054710
mov byte [ebp - 4], 0xa
push esi
call fcn.10033a90
pop ecx
push eax
push esi
lea ecx, [ebp - 0xa0]
call fcn.1001436c
mov esi, dword [ebp - 0x9c]
lea ecx, [ebp - 0xa0]
push dword [esi - 0xc]
push esi
call fcn.1001436c
push 3
push dword [ebp - 0xbc]
lea eax, [ebp - 0x94]
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], eax
call fcn.10004327
push dword [ebp - 0x98]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0xb
call fcn.10002573
lea eax, [ebp - 0x94]
cmp dword [ebp - 0x98], eax
je 0x10014ea1
push dword [ebp - 0x98]
call fcn.10033db6
pop ecx
push 5
push ebx
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xa4]
lea ecx, [ecx - 0x10]
call fcn.10002c15
mov ecx, dword [ebp - 0xa0]
lea ecx, [ecx - 0x10]
call fcn.10002c15
push dword [ebp - 0xbc]
call fcn.10018644
pop ecx
lea ecx, [esi - 0x10]
call fcn.10002c15
jmp 0x10014b43
inc ebx
jmp 0x10014cd6
mov eax, 0x80004005
call fcn.10018680
ret 8