Function at 0x1000caec
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x36c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x174]
push str.explo
xor ebx, ebx
push eax
mov byte [esp + 0x1b], bl
call fcn.1000ffa0
lea eax, [esp + 0x17c]
push str.rer.exe
push eax
call fcn.1000ffb0
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 0x10
mov ebp, str.Hello_World
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
lea eax, [esp + 0x174]
push eax
call fcn.1000d1cd
pop ecx
push ebp
push ebx
mov dword [esp + 0x1c], eax
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push dword [esp + 0x14]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x1000cc25
xor al, al
jmp 0x1000cedf
push eax
call fcn.1000c99e
cmp eax, ebx
pop ecx
mov dword [esp + 0x14], eax
je 0x1000ced3
push 0x10
pop ecx
xor eax, eax
mov dword [esp + 0x2c], 0x44
lea edi, [esp + 0x30]
push 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.1000ff40
push 0x44
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.1000ff40
add esp, 0x18
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
lea eax, [esp + 0x70]
push str.winsta0default
push eax
call fcn.1000ffa0
pop ecx
pop ecx
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
lea eax, [esp + 0x74]
push ebx
mov dword [esp + 0x34], 0x44
mov dword [esp + 0x3c], eax
mov dword [esp + 0x60], 1
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [esp + 0x3a0]
mov word [esp + 0x80], 5
push ebx
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x1000cec5
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
push ebp
push ebx
call esi
push ebx
push ebx
call edi
mov byte [esp + 0x13], 1
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, byte [esp + 0x13]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x36c
ret