Function at 0x1012e070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bb03d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10247db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x2c]
mov dword [0x10266f1c], ecx
cmp dword [ebp + 8], 0
je 0x1012e0b6
cmp dword [ebp + 8], 0
je 0x1012e0b6
cmp dword [ebp + 0xc], 1
je 0x1012e0bd
xor al, al
jmp 0x1012e37d
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x24]
jne 0x1012e161
mov ecx, dword [0x10266cc8]
cmp dword [ecx + 0x504], 0
jne 0x1012e0ec
mov edx, dword [0x10266cc8]
mov ecx, dword [edx + 0x504]
call fcn.10040f30
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
mov eax, dword [0x10266cc8]
mov edx, dword [eax + 0x474]
add edx, 0x154
push edx
call fcn.100e88c0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov eax, dword [0x10266cc8]
mov edx, dword [eax + 0x474]
add edx, 0x144
push edx
call fcn.10095de0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x10266cc8]
mov ecx, dword [eax + 0x504]
call fcn.10093650
mov ecx, dword [0x10266cc8]
mov ecx, dword [ecx + 0x504]
call fcn.10093100
jmp 0x1012e37b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x18]
jne 0x1012e191
mov ecx, dword [0x10266cc8]
cmp dword [ecx + 0x50c], 0
je 0x1012e18c
mov edx, dword [0x10266cc8]
mov ecx, dword [edx + 0x50c]
call fcn.10127240
jmp 0x1012e37b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x14]
jne 0x1012e1d2
mov edx, dword [0x10266cc8]
cmp dword [edx + 0x520], 0
je 0x1012e1cd
push 0xc8
mov eax, dword [0x10266cc8]
mov ecx, dword [eax + 0x520]
mov edx, dword [0x10266cc8]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x520]
mov edx, dword [eax]
call edx
jmp 0x1012e37b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jne 0x1012e1f3
mov edx, dword [0x10266cc8]
mov ecx, dword [edx + 0x51c]
call fcn.1009b350
jmp 0x1012e37b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x20]
jne 0x1012e235
mov edx, dword [0x10266cc8]
cmp dword [edx + 0x4d4], 0
je 0x1012e230
push 1
mov eax, dword [0x10266cc8]
mov ecx, dword [eax + 0x4d4]
call fcn.100882c0
mov ecx, dword [0x10266cc8]
mov ecx, dword [ecx + 0x4d4]
call fcn.100888f0
jmp 0x1012e37b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx]
jne 0x1012e276
mov ecx, dword [0x10266cc8]
cmp dword [ecx + 0x4d4], 0
je 0x1012e271
push 1
mov edx, dword [0x10266cc8]
mov ecx, dword [edx + 0x4d4]
call fcn.100882c0
mov eax, dword [0x10266cc8]
mov ecx, dword [eax + 0x4d4]
call fcn.100888f0
jmp 0x1012e37b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0x38]
jne 0x1012e325
mov eax, dword [0x10266cc8]
cmp dword [eax + 0x478], 0
jne 0x1012e2a6
mov ecx, dword [0x10266cc8]
mov ecx, dword [ecx + 0x474]
call fcn.1013da90
jmp 0x1012e323
mov edx, dword [0x10266cc8]
mov eax, dword [edx + 0x478]
mov ecx, dword [eax + 0x104]
push ecx
mov ecx, dword [0x10266cc8]
call fcn.100e1d10
movzx edx, al
test edx, edx
je 0x1012e2dd
mov eax, dword [0x10266cc8]
mov ecx, dword [eax + 0x478]
call fcn.1007ae60
jmp 0x1012e323
mov ecx, dword [0x10266cc8]
mov edx, dword [ecx + 0x478]
mov eax, dword [edx + 0xf8]
push eax
mov ecx, dword [0x10266cc8]
call fcn.100e1d10
movzx ecx, al
test ecx, ecx
je 0x1012e313
mov edx, dword [0x10266cc8]
mov ecx, dword [edx + 0x478]
call fcn.1007a410
mov eax, dword [0x10266cc8]
mov ecx, dword [eax + 0x478]
call fcn.1007a8e0
jmp 0x1012e37b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jne 0x1012e351
push 1
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.10044e70
push eax
push 0x1021572c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1012e37b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 8]
jne 0x1012e37b
push 1
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.10044e70
push eax
push 0x10215724
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8