Function at 0x1005fa20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3b67
mov eax, dword fs:[0]
push eax
mov eax, 0x43bc
call fcn.10066330
mov eax, dword [0x1013dd8c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
lea eax, [ebp - 0x240]
push eax
call fcn.10051e50
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.10039400
movzx ecx, al
test ecx, ecx
je 0x1005fab3
push str._TEMP_
lea ecx, [ebp - 0x270]
call fcn.10012560
mov byte [ebp - 4], 1
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp - 0x270]
push eax
call fcn.1005e310
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.10012470
lea ecx, [ebp - 0x240]
call fcn.10039400
movzx ecx, al
test ecx, ecx
je 0x1005fafa
mov edx, dword [ebp + 0x10]
push edx
push str.select_random_directory_for_package_exec:_s__fail
call fcn.1005b550
add esp, 8
mov byte [ebp - 0x4342], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.10012470
mov al, byte [ebp - 0x4342]
jmp 0x1005fe9d
lea eax, [ebp - 0x258]
push eax
call fcn.10052390
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x258]
call fcn.10039400
movzx ecx, al
test ecx, ecx
je 0x1005fb2e
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x258]
call fcn.10022ed0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x4340]
call fcn.1005d0a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4340]
call fcn.1005d820
movzx edx, al
test edx, edx
jne 0x1005fbaa
mov eax, dword [ebp + 0x10]
push eax
push str.open_package_exec:_s__as_7z_fail
call fcn.1005b550
add esp, 8
mov byte [ebp - 0x4343], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4340]
call fcn.1005d1d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.10012470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.10012470
mov al, byte [ebp - 0x4343]
jmp 0x1005fe9d
mov byte [ebp - 0x4341], 0
push 0x100fc6d9
lea ecx, [ebp - 0x228]
call fcn.10012560
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp - 0x4341]
push edx
lea eax, [ebp - 0x4340]
push eax
lea ecx, [ebp - 0x43c8]
call fcn.1005f6a0
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x4368], esp
sub esp, 0x18
mov edx, esp
mov esi, dword [eax]
mov dword [edx], esi
mov esi, dword [eax + 4]
mov dword [edx + 4], esi
mov esi, dword [eax + 8]
mov dword [edx + 8], esi
mov esi, dword [eax + 0xc]
mov dword [edx + 0xc], esi
mov esi, dword [eax + 0x10]
mov dword [edx + 0x10], esi
mov eax, dword [eax + 0x14]
mov dword [edx + 0x14], eax
call fcn.1005f270
mov dword [ebp - 0x436c], eax
lea ecx, [ebp - 0x4340]
call fcn.1005d880
movzx ecx, byte [ebp - 0x4341]
test ecx, ecx
jne 0x1005fc5c
lea ecx, [ebp - 0x228]
call fcn.10039400
movzx edx, al
test edx, edx
je 0x1005fcbe
mov eax, dword [ebp + 0x10]
push eax
push str.extract_package_exec:_s__fail
call fcn.1005b550
add esp, 8
mov byte [ebp - 0x4344], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x228]
call fcn.10012470
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4340]
call fcn.1005d1d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.10012470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.10012470
mov al, byte [ebp - 0x4344]
jmp 0x1005fe9d
call fcn.1005e290
mov dword [ebp - 0x434c], eax
mov byte [ebp - 0x210], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x20f]
push ecx
call fcn.100a57f0
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
lea ecx, [ebp - 0x228]
call fcn.10012400
push eax
push str.__s___s
push 0x1ff
lea eax, [ebp - 0x210]
push eax
call fcn.1004db60
add esp, 0x14
mov dword [ebp - 0x43b0], 0
push 0x40
push 0
lea ecx, [ebp - 0x43ac]
push ecx
call fcn.100a57f0
add esp, 0xc
mov dword [ebp - 0x4364], 0
xor edx, edx
mov dword [ebp - 0x4360], edx
mov dword [ebp - 0x435c], edx
mov dword [ebp - 0x4358], edx
xor eax, eax
mov word [ebp - 0x4380], ax
mov ecx, dword [ebp - 0x4384]
or ecx, 1
mov dword [ebp - 0x4384], ecx
cmp dword [0x101466c0], 6
jb 0x1005fdad
cmp dword [ebp - 0x434c], 0
je 0x1005fdad
lea edx, [ebp - 0x4364]
push edx
lea eax, [ebp - 0x43b0]
push eax
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x228]
call fcn.10012400
push eax
mov edx, dword [ebp - 0x434c]
push edx
call fcn.1005af70
mov dword [ebp - 0x4350], eax
jmp 0x1005fde6
lea eax, [ebp - 0x4364]
push eax
lea ecx, [ebp - 0x43b0]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x228]
call fcn.10012400
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x4350], eax
cmp dword [ebp - 0x4350], 0
je 0x1005fe1c
mov eax, dword [ebp - 0x434c]
push eax
mov ecx, dword [ebp - 0x435c]
push ecx
lea ecx, [ebp - 0x228]
call fcn.10012400
push eax
mov edx, dword [ebp + 0x10]
push edx
push str.launch_package_exec:_s___path_s_pid_d_parent_d
call fcn.1005b550
add esp, 0x14
jmp 0x1005fe2d
mov eax, dword [ebp + 0x10]
push eax
push str.launch_package_exec:_s__fail
call fcn.1005b550
add esp, 8
cmp dword [ebp - 0x4350], 0
je 0x1005fe42
mov dword [ebp - 0x4354], 1
jmp 0x1005fe4c
mov dword [ebp - 0x4354], 0
mov cl, byte [ebp - 0x4354]
mov byte [ebp - 0x4345], cl
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x228]
call fcn.10012470
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4340]
call fcn.1005d1d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.10012470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.10012470
mov al, byte [ebp - 0x4345]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10065961
mov esp, ebp
pop ebp
ret