Function at 0x17d0cbfe
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0xdc
mov eax, 0x17d181d4
call fcn.17ce4c31
mov ebx, dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0xe8]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xe8], edi
mov dword [ebp - 4], esi
cmp ebx, esi
jne 0x17d0cc83
mov eax, dword [0x17d26008]
cmp eax, 0x17d26008
je 0x17d0cc68
test byte [eax + 0x1c], 1
je 0x17d0cc68
push 0x80070057
push 0x17c98c5c
push 0x81
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
mov dword [ebp - 0x8c], 0x80070057
push 0x17d23160
lea eax, [ebp - 0x8c]
push eax
call sub.msvcrt.dll__CxxThrowException
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x17d0ccc6
mov eax, dword [0x17d26008]
cmp eax, 0x17d26008
je 0x17d0ccb5
test byte [eax + 0x1c], 1
je 0x17d0ccb5
push 0x8007000d
push 0x17c98c5c
push 0x82
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
mov dword [ebp - 0x80], 0x8007000d
push 0x17d23160
lea eax, [ebp - 0x80]
jmp 0x17d0cc7d
push ebx
lea ecx, [ebp - 0x68]
call fcn.17cc2a62
lea ecx, [ebp - 0x4c]
call fcn.17cd1587
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 2
call fcn.17d0a778
mov edi, 0x17c98d5c
push edi
lea ecx, [ebp - 0x30]
call fcn.17cc2a62
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.17cc2715
push edi
lea ecx, [ebp - 0x30]
call fcn.17cc29aa
push 0x17c98d50
lea ecx, [ebp - 0x30]
call fcn.17cc29aa
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x30]
call fcn.17cc2715
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x17d0cd36
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0xe8]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x17d0cda7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x17d0cd67
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x17d26008]
cmp eax, 0x17d26008
je 0x17d0cd91
test byte [eax + 0x1c], 1
je 0x17d0cd91
push esi
push 0x17c98c5c
push 0x83
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
mov dword [ebp - 0x88], esi
push 0x17d23160
lea eax, [ebp - 0x88]
jmp 0x17d0cc7d
push 0xea60
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x17d0ce0c
mov eax, dword [0x17d26008]
cmp eax, 0x17d26008
je 0x17d0cde8
test byte [eax + 0x1c], 1
je 0x17d0cde8
push 0x80070102
push 0x17c98c5c
push 0x84
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
push esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x94], 0x80070102
push 0x17d23160
lea eax, [ebp - 0x94]
jmp 0x17d0cc7d
cmp eax, 0xffffffff
je 0x17d0ce41
cmp eax, 0x80
je 0x17d0ce41
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.17cc1dce
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.17cc1dce
push esi
push 1
lea ecx, [ebp - 0x68]
call fcn.17cc1dce
call fcn.17ce4c9c
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x17d0ce55
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x17d26008]
cmp eax, 0x17d26008
je 0x17d0ce7f
test byte [eax + 0x1c], 1
je 0x17d0ce7f
push esi
push 0x17c98c5c
push 0x85
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.17ca2c24
mov dword [ebp - 0x90], esi
push 0x17d23160
lea eax, [ebp - 0x90]
jmp 0x17d0cc7d