Function at 0x10073ef9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100a5d5a
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x100cd130]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x100cd130]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
and dword [esp + 0x18], 0
mov edi, ecx
mov dword [esp + 0x1c], str.Execute
and dword [esp + 0xa0], 0
lea ebx, [edi + 4]
lea esi, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.10014253
mov ecx, dword [edi + 0x40]
mov eax, dword [ecx]
call dword [eax]
xor ebx, ebx
cmp eax, ebx
je 0x1007412a
lea ecx, [esp + 0x74]
push ecx
push eax
call fcn.10020df8
mov byte [esp + 0xa0], 1
cmp dword [esp + 0x88], ebx
jne 0x10073ff0
push 0x100ba168
lea esi, [esp + 0x24]
call fcn.10003bd6
mov edi, esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 2
call fcn.1002dba6
mov byte [esp + 0xa0], 3
cmp dword [eax + 0x18], 8
jb 0x10073fc1
mov eax, dword [eax + 4]
jmp 0x10073fc4
add eax, 4
mov ecx, dword [esp + 0x14]
push eax
call fcn.10014283
pop ecx
push ebx
push 1
lea esi, [esp + 0x44]
call fcn.10001b5a
push ebx
push 1
lea esi, [esp + 0x28]
call fcn.10001b5a
lea esi, [esp + 0x74]
jmp 0x1007417c
push str._x__
lea esi, [esp + 0x5c]
call fcn.10003bd6
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x7c]
mov ecx, esi
mov byte [esp + 0xa8], 4
call fcn.10004149
push 0x100b3e48
mov eax, esi
push eax
call fcn.10003e0b
push str._zvkvpvkv
lea esi, [esp + 0x24]
call fcn.10003bd6
mov edi, esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 5
call fcn.1002dba6
cmp dword [esp + 0x70], 8
mov ecx, dword [esp + 0x5c]
jae 0x10074051
lea ecx, [esp + 0x5c]
cmp dword [eax + 0x18], 8
jb 0x1007405c
mov eax, dword [eax + 4]
jmp 0x1007405f
add eax, 4
push 5
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
neg ebx
sbb bl, bl
xor edi, edi
push edi
push 1
lea esi, [esp + 0x44]
inc bl
call fcn.10001b5a
push edi
push 1
lea esi, [esp + 0x28]
mov byte [esp + 0xa8], 4
call fcn.10001b5a
test bl, bl
je 0x1007410e
push 0x100ba1c8
lea esi, [esp + 0x24]
call fcn.10003bd6
mov edi, esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 6
call fcn.1002dba6
mov byte [esp + 0xa0], 7
cmp dword [eax + 0x18], 8
jb 0x100740d2
mov eax, dword [eax + 4]
jmp 0x100740d5
add eax, 4
mov ecx, dword [esp + 0x14]
push eax
call fcn.10014283
pop ecx
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea esi, [esp + 0x44]
call fcn.10001b5a
push ebx
push edi
lea esi, [esp + 0x28]
call fcn.10001b5a
push ebx
push edi
lea esi, [esp + 0x60]
call fcn.10001b5a
push ebx
push edi
lea esi, [esp + 0x7c]
jmp 0x1007417f
push edi
push 1
lea esi, [esp + 0x60]
call fcn.10001b5a
push edi
push 1
lea esi, [esp + 0x7c]
call fcn.10001b5a
xor ebx, ebx
jmp 0x10074184
push 0x100ba240
lea esi, [esp + 0x24]
call fcn.10003bd6
mov edi, esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 8
call fcn.1002dba6
mov byte [esp + 0xa0], 9
cmp dword [eax + 0x18], 8
jb 0x1007415e
mov eax, dword [eax + 4]
jmp 0x10074161
add eax, 4
mov ecx, dword [esp + 0x14]
push eax
call fcn.10014283
pop ecx
push ebx
push 1
lea esi, [esp + 0x44]
call fcn.10001b5a
lea esi, [esp + 0x20]
push ebx
push 1
call fcn.10001b5a
or dword [esp + 0xa0], 0xffffffff
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x10074198
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.100848d4
mov esp, ebp
pop ebp
ret