Function at 0x10056870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x100c42d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x100c3bb8]
or eax, dword [0x100c3bbc]
or eax, 0xc8241f55
sub eax, 0x232c2ee8
imul eax, eax, 0xd60b4312
imul eax, eax, 0x4109db87
mov ecx, 0xa8b0f210
xor edx, edx
div ecx
imul eax, eax, 0xed1f97a4
xor eax, 0xff619735
or eax, 0xd5787c39
xor eax, 0x1ec4dde6
imul eax, eax, 0xa13ff24a
xor eax, 0x8299b513
and eax, 0xdee45d4c
or eax, 0xbcfe0dea
imul eax, eax, 0xd515611c
sub eax, 0x57283766
imul eax, eax, 0x80bed53
mov ecx, 0xd81a8a55
xor edx, edx
div ecx
or eax, 0xc5fc8a1d
mov ecx, 0x7306e6fc
xor edx, edx
div ecx
xor eax, 0xbd54a093
add eax, 0xbab8aea
sub eax, 0x1c15076e
add eax, 0x99adc6d6
xor eax, 0xb045d0e4
sub eax, 0x8ae9135d
imul eax, eax, 0xee09685d
and eax, 0xe6c8d26a
and eax, 0xc2f96e6d
xor eax, 0x92b0f6e4
sub eax, 0x21bea3cc
mov ecx, 0xcf975d5d
xor edx, edx
div ecx
mov ecx, 0x5ced8c02
xor edx, edx
div ecx
xor eax, 0xf1307369
sub eax, 0xdbfb6a17
mov ecx, 0xb614fd2c
xor edx, edx
div ecx
sub eax, 0x39ad1f84
sub eax, 0xfbcd59a6
and eax, 0x864e1424
mov ecx, 0x5a57579b
xor edx, edx
div ecx
and eax, 0x64007059
xor eax, 0x42ff976c
or eax, 0x83db328e
and eax, 0x1169740c
mov ecx, 0x6fa93f5c
xor edx, edx
div ecx
add eax, 0x99f8d77b
and eax, 0x2209a444
xor eax, 0x16934b35
add eax, 0x260c4853
imul eax, eax, 0x6a16613f
sub eax, 0xf03abbcf
or eax, 0xb7c6e992
and eax, 0x341d1bd5
imul eax, eax, 0x95eb16f0
and eax, 0x7ccd344
imul eax, eax, 0xb483eb04
add eax, 0xe1b417c7
and eax, 0x79be860a
xor eax, 0x7d1cd711
mov ecx, 0x4d3e097f
xor edx, edx
div ecx
imul eax, eax, 0x2f8d0cdf
add eax, 0x2f0aea26
or eax, 0x4dc5f6c
sub eax, 0x718dca00
or eax, 0x5181392c
mov ecx, 0xace98961
xor edx, edx
div ecx
add eax, 0x64d267c0
imul eax, eax, 0x7b074401
and eax, 0x3562ef77
mov ecx, 0xcf55d1f5
xor edx, edx
div ecx
or eax, 0x1666fd
and eax, 0x9981c981
xor eax, 0x84f2d7e0
cmp eax, 0x2fc173a7
jb 0x10056f1a
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
mov eax, 0x1ec520a0
mov dword [ebp - 0x1c], eax
push eax
mov esi, esp
mov dword [ebp - 0x20], esi
push eax
mov ecx, esp
mov dword [ebp - 0x2c], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x28], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x24], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1006f6e0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.100374f0
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [ebp - 0x16], cl
cmp eax, 0xdf604b63
jae 0x10056a45
mov al, byte [ebp - 0x16]
test al, 1
jne 0x10056b4a
jmp 0x10056b63
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x100c3bc8]
imul eax, dword [0x100c3bcc]
xor eax, 0xc5ba6cfc
add eax, 0xc8656b90
or eax, 0xdcdae7f1
and eax, 0xfaf27ab5
and eax, 0x9937750e
imul eax, eax, 0xb1ea395
xor eax, 0xdac77417
xor eax, 0x3f6551ab
add eax, 0x35b2fff0
mov ecx, 0xf354800d
xor edx, edx
div ecx
and eax, 0x32279296
imul eax, eax, 0xaa74b1f6
or eax, 0x2d520111
imul eax, eax, 0x14cf5bcd
mov ecx, 0xeafb5ded
xor edx, edx
div ecx
add eax, 0xe457cb9
mov ecx, 0xc42824e9
xor edx, edx
div ecx
add eax, 0x19d5074f
mov ecx, 0xf6d12541
xor edx, edx
div ecx
xor eax, 0x6d49b767
and eax, 0x51a336fb
and eax, 0x4a67efbd
add eax, 0x74e5cc93
xor eax, 0x9c369f68
or eax, 0xbfd71956
xor eax, 0xd88e78d5
and eax, 0x94a1fed0
imul eax, eax, 0x7409e385
and eax, 0x7309aa93
imul eax, eax, 0x942095fc
and eax, 0xcc5a7660
and eax, 0x2c0bf97d
xor eax, 0x5982d85e
imul eax, eax, 0x2742595f
mov ecx, 0xc8980eb3
xor edx, edx
div ecx
and eax, 0xd0133db1
sub eax, 0xdbe3e837
sub eax, 0x5416084c
add eax, 0x92522b6
or eax, 0xf024370b
or eax, 0xeb43264
add eax, 0x49e0656e
xor eax, 0xa4a9fcfe
and eax, 0xa1ded340
xor eax, 0x9328ce9e
or eax, 0x5f354a34
xor eax, 0xec90a146
mov ecx, 0xf35232f0
xor edx, edx
div ecx
add eax, 0x5ce9a7c4
mov ecx, 0xf62a816c
xor edx, edx
div ecx
mov ecx, 0xa0121339
xor edx, edx
div ecx
mov ecx, 0x79b0d190
xor edx, edx
div ecx
imul eax, eax, 0xf4c46a68
and eax, 0x37eefb1e
and eax, 0x960c9c58
mov ecx, 0x6f855822
xor edx, edx
div ecx
mov ecx, 0x2f361561
xor edx, edx
div ecx
sub eax, 0x656661fe
imul eax, eax, 0xd6b2dfc2
mov ecx, 0x1af90443
xor edx, edx
div ecx
or eax, 0x3958cf70
add eax, 0xd199c391
sub eax, 0x7288a058
or eax, 0x88054923
add eax, 0x98f7c6fe
sub eax, 0xeefaff73
mov ecx, 0xcd078a13
xor edx, edx
div ecx
xor eax, 0xa0e16e9a
sub eax, 0xebff774e
xor eax, 0xbd8d8e86
or eax, 0x36dcd94c
xor eax, 0x51883390
cmp eax, 0x517e1b4d
jbe 0x10056ff3
mov eax, dword [0x100c3bd0]
add eax, dword [0x100c3bd4]
xor eax, 0x6470466a
and eax, 0x39f81bb1
imul eax, eax, 0x1e15c307
imul eax, eax, 0x17d9f979
imul eax, eax, 0xf5436752
and eax, 0x92d03b42
mov ecx, 0x1adc836a
xor edx, edx
div ecx
xor eax, 0x10819326
xor eax, 0x44eacbe9
and eax, 0x98801f8
or eax, 0x644e1597
xor eax, 0x6b1bf339
imul eax, eax, 0x5da324b6
xor eax, 0x9477b8bd
or eax, 0x3d202ffa
or eax, 0xbabcfb35
or eax, 0xc1ce13d
sub eax, 0xc1ffae16
add eax, 0xb7b5f853
and eax, 0x798e07ca
xor eax, 0xa08373b6
imul eax, eax, 0xe6e67bce
or eax, 0x8f3a4fc9
add eax, 0x917b250f
imul eax, eax, 0x4768d671
mov ecx, 0x1baca123
xor edx, edx
div ecx
add eax, 0x82aa770e
add eax, 0x4b30b8b2
and eax, 0xb643813c
add eax, 0xa8251507
add eax, 0x492cf3f4
or eax, 0x3a0e57ed
add eax, 0xd6a936e7
mov ecx, 0x1cd72b4e
xor edx, edx
div ecx
imul eax, eax, 0x2ed80a06
sub eax, 0x930c46e3
or eax, 0xf0ed15de
imul eax, eax, 0xdd90e2b1
xor eax, 0xbb37506c
and eax, 0x1fcb00
mov ecx, 0x7e2c8d19
xor edx, edx
div ecx
imul eax, eax, 0xab734192
and eax, 0xe4d586d6
mov ecx, 0x5ae10a8a
xor edx, edx
div ecx
mov ecx, 0x257fc13f
xor edx, edx
div ecx
and eax, 0x72c93c54
imul eax, eax, 0xf740c2e5
mov ecx, 0x900c491
xor edx, edx
div ecx
and eax, 0x96603638
add eax, 0x467d0508
add eax, 0x6ab995d2
or eax, 0xdfdacf8
add eax, 0xf354e4bc
or eax, 0x22712d09
xor eax, 0x513f6722
xor eax, 0x6f361ac2
or eax, 0x968011f6
imul eax, eax, 0x87f04490
sub eax, 0xc94fe4cc
and eax, 0x1bb9be77
add eax, 0xdc6f3497
or eax, 0x9c33954d
mov ecx, 0x3e38acf2
xor edx, edx
div ecx
xor eax, 0x2d3a8970
mov ecx, 0x3301d42c
xor edx, edx
div ecx
add eax, 0x82d0cf16
sub eax, 0x1fa1ece2
add eax, 0x6c725f4c
and eax, 0x2314305e
mov ecx, 0x6bc1b62f
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [ebp - 0x24]
sub ecx, 0x5d77a527
and ecx, 0x55e4f1d8
mov dword [ebp - 0x34], ecx
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x30], ecx
cmp eax, 0xc99318cb
jae 0x10056ff3
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006bd1f
mov eax, dword [ebp - 0x30]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov bl, byte [ebp - 0x15]
push eax
mov esi, esp
push eax
mov ecx, esp
mov dword [ebp - 0x40], ecx
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x3c], eax
sub esp, 0x10
mov edi, esp
mov dword [ebp - 0x38], edi
and bl, 1
mov byte [esi], bl
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x44
call fcn.1006f6e0
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add esp, 0xc
mov dword [ecx], 0x44
mov dword [ecx + 0x2c], 1
mov word [ecx + 0x30], 0
mov edx, dword [edx]
xor esi, esi
sub esp, 0x28
mov dword [esp], 0
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0xc
mov dword [esp], 0x20
mov dword [esp + 4], 0x2a
mov dword [esp + 8], 0x2e
call fcn.100374f0
add esp, 0xc
jmp 0x10056a45
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10056d1e