Function at 0x1006c4f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100db8d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x100db1c0]
xor eax, dword [0x100db1c4]
and eax, 0x1199f81d
add eax, 0x6893c1dc
xor eax, 0xbfbaa51a
or eax, 0x493bca94
and eax, 0x626d49f3
and eax, 0x538c22b3
xor eax, 0x90e28e0e
add eax, 0x23ec4688
and eax, 0x6073cf8e
mov ecx, 0xfdf5eff
xor edx, edx
div ecx
mov ecx, 0x2f760361
xor edx, edx
div ecx
xor eax, 0xf52fbf32
or eax, 0x16303db3
and eax, 0x5b8bf30a
or eax, 0x72cb138b
sub eax, 0x2b3c7650
mov ecx, 0x30a6835
xor edx, edx
div ecx
sub eax, 0xd10ba89e
or eax, 0xd0071968
imul eax, eax, 0xa6485b5a
or eax, 0x47e63cea
or eax, 0x7a640b2a
xor eax, 0xbe987f3b
add eax, 0xdfc70f07
sub eax, 0xb2fd3349
imul eax, eax, 0x9520fe20
imul eax, eax, 0x5d0590d3
sub eax, 0xf1d338a4
or eax, 0x1bd0fdb3
imul eax, eax, 0xf73a0ab7
and eax, 0x7026b897
or eax, 0x39422d97
imul eax, eax, 0xc1abcd14
add eax, 0xf9ae4cd1
sub eax, 0xdd61d2f2
sub eax, 0x32bdf63d
imul eax, eax, 0xf289f10b
and eax, 0xdebc849c
or eax, 0xa54efd2d
imul eax, eax, 0x5d738d6c
mov ecx, 0xc271cd10
xor edx, edx
div ecx
mov ecx, 0xa7d019dc
xor edx, edx
div ecx
imul eax, eax, 0xbc5dd4a6
and eax, 0x5ce51e6
xor eax, 0x137fde95
or eax, 0x8cbcb37c
sub eax, 0x6e70355
add eax, 0xdadac690
and eax, 0xe650940c
add eax, 0x3b094f8d
mov ecx, 0x27fc196f
xor edx, edx
div ecx
imul eax, eax, 0x4edc122d
mov ecx, 0x1f7a6f09
xor edx, edx
div ecx
and eax, 0xcb83a3
and eax, 0x336a826f
or eax, 0x2c8e075f
imul eax, eax, 0x4080b2d6
add eax, 0xf4720c70
or eax, 0xd0fe69f0
sub eax, 0xb0f84651
imul eax, eax, 0xf7b7faa4
imul eax, eax, 0xb15d8c98
add eax, 0x6a6bb94
mov ecx, 0xe007b36c
xor edx, edx
div ecx
xor eax, 0x60fb65d8
imul eax, eax, 0x81edfaa8
or eax, 0xf3274b79
and eax, 0xd41f4aff
mov ecx, 0x41fe3501
xor edx, edx
div ecx
add eax, 0xe8b14bdc
and eax, 0xbb2c646f
add eax, 0x262d2299
cmp eax, 0xa163438
je 0x1006c81d
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0x4a552d11
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100860e0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10036430
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0x9f55265
je 0x1006c81d
mov al, byte [ebp - 0x16]
test al, 1
jne 0x1006c7c3
jmp 0x1006c7dc
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008271f
mov eax, dword [ebp - 0x30]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [ebp - 0x3c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x38], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x34], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.100860e0
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.10036430
add esp, 0xc
jmp 0x1006c6be