Function at 0x1001ec80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f2023
mov eax, dword fs:[0]
push eax
sub esp, 0x3a8
mov eax, dword [0x10135134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x350], ecx
mov dword [ebp - 0x360], 0
mov ecx, dword [ebp - 0x350]
add ecx, 0x4c
call fcn.1001b490
movzx eax, al
test eax, eax
jne 0x1001eece
push 0
mov ecx, dword [ebp - 0x350]
add ecx, 0x4c
call fcn.1000d690
push eax
lea ecx, [ebp - 0x144]
call fcn.1001d980
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x36c]
mov dword [ebp - 0x370], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x370]
call fcn.10009170
push eax
lea ecx, [ebp - 0x354]
call fcn.1001da10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x144]
call fcn.10017d60
push 0
mov ecx, dword [ebp - 0x350]
add ecx, 0x64
call fcn.1000d690
push eax
lea ecx, [ebp - 0x248]
call fcn.1001d980
mov dword [ebp - 0x374], eax
mov edx, dword [ebp - 0x374]
mov dword [ebp - 0x378], edx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x378]
call fcn.10009170
push eax
lea ecx, [ebp - 0x35c]
call fcn.1001da10
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x248]
call fcn.10017d60
lea ecx, [ebp - 0x354]
call fcn.10009170
push eax
call fcn.10029390
add esp, 4
test eax, eax
jne 0x1001edd5
mov dword [ebp - 0x37c], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x35c]
call fcn.100133e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x354]
call fcn.100133e0
mov eax, dword [ebp - 0x37c]
jmp 0x1001f0c2
mov eax, dword [ebp - 0x350]
cmp dword [eax + 0x7c], 0
jle 0x1001ee8d
lea ecx, [ebp - 0x354]
push ecx
lea ecx, [ebp - 0x358]
call fcn.1001d9f0
mov byte [ebp - 4], 6
push 0x1010658c
lea ecx, [ebp - 0x358]
call fcn.1001dd20
lea edx, [ebp - 0x35c]
push edx
lea ecx, [ebp - 0x358]
call fcn.1001dd00
push 0
push 0
push 0
push 0
push 0xa
lea ecx, [ebp - 0x358]
call fcn.1001e460
push eax
call fcn.1001e180
add esp, 0x18
test eax, eax
jne 0x1001ee65
push 0xa
push 0
lea ecx, [ebp - 0x35c]
call fcn.10009170
push eax
lea ecx, [ebp - 0x354]
call fcn.10009170
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x358]
call fcn.1001ec10
mov dword [ebp - 0x360], 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x358]
call fcn.100133e0
jmp 0x1001eead
push 0
push 0
lea eax, [ebp - 0x35c]
push eax
lea ecx, [ebp - 0x354]
push ecx
call fcn.10022430
add esp, 0x10
mov dword [ebp - 0x360], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x35c]
call fcn.100133e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x354]
call fcn.100133e0
lea ecx, [ebp - 0x3b4]
call fcn.10007ad0
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x350]
add edx, 4
push edx
lea ecx, [ebp - 0x3b4]
call fcn.1001b860
mov eax, dword [ebp - 0x350]
add eax, 0x1c
push eax
lea ecx, [ebp - 0x3b4]
call fcn.1001b8c0
push 1
lea ecx, [ebp - 0x3b4]
call fcn.1000cb30
lea ecx, [ebp - 0x28]
call fcn.10017aa0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.1002ce70
movzx edx, al
test edx, edx
je 0x1001f035
push 2
push 4
push 1
lea ecx, [ebp - 0x39c]
call fcn.100a8670
mov byte [ebp - 4], 9
push 0
mov ecx, dword [ebp - 0x350]
add ecx, 0x34
call fcn.1000d690
push eax
lea ecx, [ebp - 0x34c]
call fcn.1001d980
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x384], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x384]
call fcn.10009170
push eax
lea ecx, [ebp - 0x368]
call fcn.1001da10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x34c]
call fcn.10017d60
lea ecx, [ebp - 0x368]
call fcn.10009170
push eax
lea ecx, [ebp - 0x40]
call fcn.1001da90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x39c]
call fcn.100a85d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x40]
call fcn.1001c040
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x39c]
call fcn.100a8560
call fcn.10013f80
mov dword [ebp - 0x364], eax
lea eax, [ebp - 0x39c]
push eax
mov ecx, dword [ebp - 0x364]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x364]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x360], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x368]
call fcn.100133e0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x39c]
call fcn.100a8770
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x350]
mov dword [ecx + 0x84], eax
mov edx, dword [ebp - 0x360]
push edx
mov eax, dword [ebp - 0x350]
mov ecx, dword [eax + 0x7c]
push ecx
mov ecx, dword [ebp - 0x350]
add ecx, 0x64
call fcn.1000d690
push eax
mov ecx, dword [ebp - 0x350]
add ecx, 0x4c
call fcn.1000d690
push eax
mov ecx, dword [ebp - 0x350]
add ecx, 0x1c
call fcn.1000d690
push eax
push str.CPopClient::Run_businessid_s__m_strExe_s__m_strCmd_s__level_d__bsucess_lu
call fcn.10021df0
add esp, 0x18
mov edx, dword [ebp - 0x360]
mov dword [ebp - 0x388], edx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x28]
call fcn.10007e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.10007f90
mov eax, dword [ebp - 0x388]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027da5
mov esp, ebp
pop ebp
ret