Function at 0x1000aa3e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030157
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x100430b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x384], esi
mov ecx, dword [ebx + 0xc]
sub ecx, dword [ebx + 8]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x1000a673
mov eax, 0x80070057
jmp 0x1000b293
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10013600
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x27c]
push 0x10031ea0
push eax
call fcn.10001ba0
add esp, 8
push 2
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x264], 0
call fcn.10004b00
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x3a0]
push eax
call fcn.10001ba0
add esp, 8
push 2
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 2
mov dword [ebp - 0x388], 0
call fcn.10004b00
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x3a0]
call fcn.10004940
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 4
push ecx
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.100024a0
add esp, 0xc
lea ecx, [ebp - 0x2d0]
call fcn.10002200
lea ecx, [ebp - 0x3a0]
call fcn.10002200
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 8
call fcn.10002200
movzx eax, word [esi + 0xc]
mov dword [ebp - 0x3a4], eax
dec eax
cmp eax, 5
ja case.default.0x1000a774
jmp dword [eax*4 + 0x1000b2b4]
xor eax, eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
mov ecx, dword [ebx + 0xc]
mov eax, 0x2aaaaaab
mov edi, dword [ebx + 8]
sub ecx, edi
imul ecx
mov byte [ebp - 4], 9
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jne 0x1000a7cb
push edi
lea ecx, [ebp - 0x278]
call fcn.1000d520
jmp 0x1000a99b
push str.s7z_
lea ecx, [ebp - 0x248]
call fcn.10001f30
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.10002b20
add esp, 8
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0xc
call fcn.10002200
push 0xb0
lea eax, [ebp - 0x380]
push 0
push eax
call fcn.10013600
add esp, 0xc
lea eax, [ebp - 0x2d0]
lea ecx, [ebp - 0x39c]
push eax
call fcn.10001ea0
push 1
push 0x40
push 2
lea eax, [ebp - 0x39c]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x380]
call fcn.1000c6a0
lea ecx, [ebp - 0x39c]
mov byte [ebp - 4], 0xf
call fcn.10002200
mov edi, dword [ebx + 8]
mov ebx, dword [ebx + 0xc]
cmp edi, ebx
je 0x1000a8ff
push 2
push edi
lea ecx, [ebp - 0x3c4]
call fcn.10001130
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 0x10
push eax
call fcn.10001900
cmp dword [ebp - 0x24c], 0x10
lea eax, [ebp - 0x260]
push dword [ebp - 0x250]
cmovae eax, dword [ebp - 0x260]
push eax
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 0x11
push eax
call fcn.1000bf00
mov esi, eax
add esp, 0x14
mov ecx, dword [esi]
push 0xa
mov ecx, dword [ecx + 4]
add ecx, esi
call fcn.1000f950
movzx ecx, al
push ecx
mov ecx, esi
call fcn.1000ee80
mov ecx, esi
call fcn.1000ea30
lea ecx, [ebp - 0x260]
call fcn.100021b0
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 0xf
call fcn.10002200
add edi, 0x18
cmp edi, ebx
jne 0x1000a865
mov esi, dword [ebp - 0x384]
push 0x10031ebc
lea ecx, [ebp - 0x248]
call fcn.10001f30
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x294]
call fcn.10001ea0
cmp dword [ebp - 0x280], 8
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 0x13
cmovae eax, dword [ebp - 0x294]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x3c0]
push eax
call fcn.1000ba60
add esp, 0xc
lea ecx, [ebp - 0x278]
push eax
call fcn.1000d4e0
lea ecx, [ebp - 0x3c0]
call fcn.10002200
lea ecx, [ebp - 0x294]
call fcn.10002200
lea ecx, [ebp - 0x248]
call fcn.10002200
lea ecx, [ebp - 0x380]
call fcn.1000d550
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 9
call fcn.10002200
push str._c_add__i___s___s_5
lea ecx, [ebp - 0x39c]
call fcn.10001f30
cmp dword [ebp - 0x264], 8
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x14
cmovae eax, dword [ebp - 0x278]
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.1000ba60
add esp, 0xc
lea ecx, [ebp - 0x39c]
call fcn.10002200
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
push 1
cmovae ecx, dword [ebp - 0x230]
lea eax, [ebp - 0x2b4]
cmp dword [ebp - 0x2a0], 8
push 0
cmovae eax, dword [ebp - 0x2b4]
push ecx
push eax
push str.open
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x230]
call fcn.10002200
lea ecx, [ebp - 0x278]
call fcn.10002200
xor esi, esi
jmp 0x1000b286
xor eax, eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
mov ecx, dword [ebx + 0xc]
mov eax, 0x2aaaaaab
mov edi, dword [ebx + 8]
sub ecx, edi
imul ecx
mov byte [ebp - 4], 0x16
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jne 0x1000abe5
push edi
lea ecx, [ebp - 0x278]
call fcn.1000d520
push 2
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x3e4]
call fcn.10001130
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x17
push ecx
mov ecx, eax
call fcn.1000f330
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x18
call fcn.10001ea0
cmp dword [ebp - 0x3a4], 2
mov ecx, str..zip
mov eax, 0x10031ef8
mov byte [ebp - 4], 0x19
cmovne eax, ecx
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x3c0]
push eax
call fcn.1000b7a0
add esp, 0xc
push 2
push eax
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x1a
call fcn.10002100
push 2
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x438]
call fcn.10001130
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, eax
call fcn.10004940
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x1d
push ecx
push eax
lea eax, [ebp - 0x298]
push eax
call fcn.100024a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x39c]
mov byte [ebp - 4], 0x1e
call fcn.10001ea0
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x260]
call fcn.1000d4e0
lea ecx, [ebp - 0x39c]
call fcn.10002200
lea ecx, [ebp - 0x298]
call fcn.10002200
lea ecx, [ebp - 0x41c]
call fcn.10002200
lea ecx, [ebp - 0x438]
call fcn.10002200
lea ecx, [ebp - 0x2d0]
call fcn.10002200
lea ecx, [ebp - 0x3c0]
call fcn.10002200
lea ecx, [ebp - 0x230]
call fcn.10002200
lea ecx, [ebp - 0x400]
call fcn.10002200
lea ecx, [ebp - 0x3e4]
jmp 0x1000ae51
push str.s7z_
lea ecx, [ebp - 0x39c]
call fcn.10001f30
lea eax, [ebp - 0x39c]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.10002b20
add esp, 8
lea ecx, [ebp - 0x39c]
mov byte [ebp - 4], 0x21
call fcn.10002200
push 0xb0
lea eax, [ebp - 0x380]
push 0
push eax
call fcn.10013600
add esp, 0xc
lea eax, [ebp - 0x2d0]
lea ecx, [ebp - 0x3c0]
push eax
call fcn.10001ea0
push 1
push 0x40
push 2
lea eax, [ebp - 0x3c0]
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0x380]
call fcn.1000c6a0
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x24
call fcn.10002200
mov edi, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
cmp edi, eax
je 0x1000ad21
mov ebx, eax
push 2
push edi
lea ecx, [ebp - 0x3e4]
call fcn.10001130
push eax
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 0x25
push eax
call fcn.10001900
cmp dword [ebp - 0x280], 0x10
lea eax, [ebp - 0x294]
push dword [ebp - 0x284]
cmovae eax, dword [ebp - 0x294]
push eax
lea eax, [ebp - 0x380]
mov byte [ebp - 4], 0x26
push eax
call fcn.1000bf00
mov esi, eax
add esp, 0x14
mov ecx, dword [esi]
push 0xa
mov ecx, dword [ecx + 4]
add ecx, esi
call fcn.1000f950
movzx ecx, al
push ecx
mov ecx, esi
call fcn.1000ee80
mov ecx, esi
call fcn.1000ea30
lea ecx, [ebp - 0x294]
call fcn.100021b0
lea ecx, [ebp - 0x3e4]
mov byte [ebp - 4], 0x24
call fcn.10002200
add edi, 0x18
cmp edi, ebx
jne 0x1000ac81
mov ebx, dword [ebp - 0x3c8]
mov esi, dword [ebp - 0x384]
push 0x10031ebc
lea ecx, [ebp - 0x39c]
call fcn.10001f30
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x230]
call fcn.10001ea0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x28
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.1000ba60
add esp, 0xc
lea ecx, [ebp - 0x278]
push eax
call fcn.1000d4e0
lea ecx, [ebp - 0x294]
call fcn.10002200
lea ecx, [ebp - 0x230]
call fcn.10002200
lea ecx, [ebp - 0x39c]
mov byte [ebp - 4], 0x24
call fcn.10002200
push 2
push dword [ebx + 8]
lea ecx, [ebp - 0x400]
call fcn.10001130
lea ecx, [ebp - 0x3e4]
mov byte [ebp - 4], 0x29
push ecx
mov ecx, eax
call fcn.10004940
push eax
lea ecx, [ebp - 0x39c]
mov byte [ebp - 4], 0x2a
call fcn.10001ea0
cmp dword [ebp - 0x3a4], 2
mov ecx, str..zip
mov eax, 0x10031ef8
mov byte [ebp - 4], 0x2b
cmovne eax, ecx
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.1000b7a0
add esp, 0xc
lea ecx, [ebp - 0x260]
push eax
call fcn.1000d4e0
lea ecx, [ebp - 0x230]
call fcn.10002200
lea ecx, [ebp - 0x39c]
call fcn.10002200
lea ecx, [ebp - 0x3e4]
call fcn.10002200
lea ecx, [ebp - 0x400]
call fcn.10002200
lea ecx, [ebp - 0x380]
call fcn.1000d550
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x16
call fcn.10002200
push str._c_add__i___s___a___s___s_4
lea ecx, [ebp - 0x3c0]
call fcn.10001f30
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x260]
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0x2c
cmovae ecx, dword [ebp - 0x260]
cmp dword [ebp - 0x264], 8
push ecx
cmovae eax, dword [ebp - 0x278]
push eax
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.1000bb60
add esp, 0x10
lea ecx, [ebp - 0x3c0]
call fcn.10002200
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
push 1
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x2b4]
cmp dword [ebp - 0x2a0], 8
push 0
cmovae eax, dword [ebp - 0x2b4]
push ecx
push eax
push str.open
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x248]
call fcn.10002200
lea ecx, [ebp - 0x260]
call fcn.10002200
lea ecx, [ebp - 0x278]
call fcn.10002200
xor esi, esi
jmp 0x1000b286
push dword [ebx + 8]
lea ecx, [ebp - 0x230]
call fcn.10001ea0
push str._c_preview__a___s___s_2
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x2d
call fcn.10001f30
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 0x2e
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.1000ba60
add esp, 0xc
lea ecx, [ebp - 0x3c0]
call fcn.10002200
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
push 1
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x2b4]
cmp dword [ebp - 0x2a0], 8
push 0
cmovae eax, dword [ebp - 0x2b4]
push ecx
push eax
push str.open
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x248]
call fcn.10002200
lea ecx, [ebp - 0x230]
call fcn.10002200
xor esi, esi
jmp 0x1000b286
push dword [ebx + 8]
lea ecx, [ebp - 0x294]
call fcn.10001ea0
push 2
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x400]
call fcn.10001130
lea ecx, [ebp - 0x3e4]
mov byte [ebp - 4], 0x30
push ecx
mov ecx, eax
call fcn.10004940
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x31
call fcn.10001ea0
lea ecx, [ebp - 0x3e4]
call fcn.10002200
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x34
call fcn.10002200
push str._c_extract__a___s___o___s___s_3
lea ecx, [ebp - 0x3c0]
call fcn.10001f30
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 0x35
cmovae ecx, dword [ebp - 0x230]
cmp dword [ebp - 0x280], 8
push ecx
cmovae eax, dword [ebp - 0x294]
push eax
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.1000bb60
add esp, 0x10
lea ecx, [ebp - 0x3c0]
call fcn.10002200
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
push 1
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x2b4]
cmp dword [ebp - 0x2a0], 8
push 0
cmovae eax, dword [ebp - 0x2b4]
push ecx
push eax
push str.open
push dword [esi + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x248]
call fcn.10002200
lea ecx, [ebp - 0x230]
call fcn.10002200
lea ecx, [ebp - 0x294]
call fcn.10002200
xor esi, esi
jmp 0x1000b286
push dword [ebx + 8]
lea ecx, [ebp - 0x260]
call fcn.10001ea0
push 2
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0x2d0]
call fcn.10001130
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 0x37
push ecx
mov ecx, eax
call fcn.1000f330
mov esi, eax
push 2
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 0x38
push eax
lea ecx, [ebp - 0x438]
call fcn.10001130
lea ecx, [ebp - 0x400]
mov byte [ebp - 4], 0x39
push ecx
mov ecx, eax
call fcn.10004940
push esi
push eax
lea eax, [ebp - 0x3e4]
mov byte [ebp - 4], 0x3a
push eax
call fcn.100024a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0x3b
call fcn.10001ea0
lea ecx, [ebp - 0x3e4]
call fcn.10002200
lea ecx, [ebp - 0x400]
call fcn.10002200
lea ecx, [ebp - 0x438]
call fcn.10002200
lea ecx, [ebp - 0x41c]
call fcn.10002200
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 0x41
call fcn.10002200
push str._c_extract__a___s___o___s___s_3
lea ecx, [ebp - 0x3c0]
call fcn.10001f30
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 0x42
cmovae ecx, dword [ebp - 0x230]
cmp dword [ebp - 0x24c], 8
push ecx
cmovae eax, dword [ebp - 0x260]
push eax
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.1000bb60
add esp, 0x10
lea ecx, [ebp - 0x3c0]
call fcn.10002200
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
push 1
cmovae ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x2b4]
cmp dword [ebp - 0x2a0], 8
push 0
cmovae eax, dword [ebp - 0x2b4]
push ecx
push eax
mov eax, dword [ebp - 0x384]
push str.open
push dword [eax + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x248]
call fcn.10002200
lea ecx, [ebp - 0x230]
call fcn.10002200
lea ecx, [ebp - 0x260]
call fcn.10002200
xor esi, esi
jmp 0x1000b286
mov esi, 0x80070057
lea ecx, [ebp - 0x2b4]
call fcn.10002200
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001195d
mov esp, ebp
pop ebp
ret 8