Function at 0x10127e70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3fad
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10245db0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x2c]
mov dword [0x1024cc78], ecx
cmp dword [ebp + 8], 0
je 0x10127eb6
cmp dword [ebp + 8], 0
je 0x10127eb6
cmp dword [ebp + 0xc], 1
je 0x10127ebd
xor al, al
jmp 0x101280cb
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x24]
jne 0x10127f61
mov ecx, dword [0x1024ca04]
cmp dword [ecx + 0x4f8], 0
jne 0x10127eec
mov edx, dword [0x1024ca04]
mov ecx, dword [edx + 0x4f8]
call fcn.10040f90
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
mov eax, dword [0x1024ca04]
mov edx, dword [eax + 0x468]
add edx, 0x154
push edx
call fcn.100e1dc0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov eax, dword [0x1024ca04]
mov edx, dword [eax + 0x468]
add edx, 0x144
push edx
call fcn.100938a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x1024ca04]
mov ecx, dword [eax + 0x4f8]
call fcn.100910b0
mov ecx, dword [0x1024ca04]
mov ecx, dword [ecx + 0x4f8]
call fcn.10090ae0
jmp 0x101280c9
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0x18]
jne 0x10127f91
mov ecx, dword [0x1024ca04]
cmp dword [ecx + 0x500], 0
je 0x10127f8c
mov edx, dword [0x1024ca04]
mov ecx, dword [edx + 0x500]
call fcn.10121440
jmp 0x101280c9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x14]
jne 0x10127fd2
mov edx, dword [0x1024ca04]
cmp dword [edx + 0x514], 0
je 0x10127fcd
push 0xc8
mov eax, dword [0x1024ca04]
mov ecx, dword [eax + 0x514]
mov edx, dword [0x1024ca04]
mov eax, dword [ecx]
mov ecx, dword [edx + 0x514]
mov edx, dword [eax]
call edx
jmp 0x101280c9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jne 0x10127ff3
mov edx, dword [0x1024ca04]
mov ecx, dword [edx + 0x510]
call fcn.10098b60
jmp 0x101280c9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x20]
jne 0x10128035
mov edx, dword [0x1024ca04]
cmp dword [edx + 0x4c8], 0
je 0x10128030
push 1
mov eax, dword [0x1024ca04]
mov ecx, dword [eax + 0x4c8]
call fcn.10085f40
mov ecx, dword [0x1024ca04]
mov ecx, dword [ecx + 0x4c8]
call fcn.10086570
jmp 0x101280c9
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp eax, dword [edx]
jne 0x10128073
mov ecx, dword [0x1024ca04]
cmp dword [ecx + 0x4c8], 0
je 0x10128071
push 1
mov edx, dword [0x1024ca04]
mov ecx, dword [edx + 0x4c8]
call fcn.10085f40
mov eax, dword [0x1024ca04]
mov ecx, dword [eax + 0x4c8]
call fcn.10086570
jmp 0x101280c9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jne 0x1012809f
push 1
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.10044d80
push eax
push 0x1020efb4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x101280c9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 8]
jne 0x101280c9
push 1
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.10044d80
push eax
push 0x1020efdc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8