Function at 0x100173fb
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push ebp
lea ebp, [esp - 0x1fc]
sub esp, 0x27c
mov eax, dword [0x10274398]
xor eax, ebp
mov dword [ebp + 0x1f8], eax
mov eax, dword [0x1027ad90]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [ebp + 0x204]
xor esi, esi
mov dword [ebp - 0x20], edi
cmp eax, esi
je 0x1001746e
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1001744f
call ebx
push eax
push str.AIL:System64:GetExitCode_err_d
jmp 0x10017464
cmp dword [ebp - 0x1c], 0x103
je 0x10017613
push dword [ebp - 0x1c]
push str.AIL:System64:System64_is_terminated.__ExitCode_d__System64_will_be_created_again.
push 3
call fcn.101d1209
add esp, 0xc
cmp edi, esi
je 0x1001747a
cmp word [edi], si
jne 0x1001747a
mov dword [ebp - 0x20], esi
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1027ad88
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
jne 0x100174cc
call ebx
mov esi, eax
push esi
push str.AIL:System64:CreatePipe_err_d
push 1
call fcn.101d1209
push esi
call sym.AhnIEx.dll_AhnIEx_SetError
add esp, 0x10
xor eax, eax
jmp 0x10017616
push esi
lea eax, [ebp - 0x2c]
push eax
push 0x1027ad8c
lea eax, [ebp - 0x18]
push eax
call edi
test eax, eax
jne 0x1001750f
call ebx
mov esi, eax
push esi
push str.AIL:System64:CreatePipe_err_d
push 1
call fcn.101d1209
push esi
call sym.AhnIEx.dll_AhnIEx_SetError
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push dword [0x1027ad88]
call esi
push dword [ebp - 0x14]
call esi
jmp 0x100174c5
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.101d19d0
xor eax, eax
mov word [ebp - 0x50], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x101
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
call sym.AhnIEx.dll_AhnIEx_IsWow64Process
test eax, eax
je 0x1001757f
call sym.AhnIEx.dll_AhnIEx_IsProcessorIA64
test eax, eax
je 0x10017565
push str.__PluginDir_SysIA64.exe_
jmp 0x10017584
call sym.AhnIEx.dll_AhnIEx_IsProcessorARM64
test eax, eax
lea eax, [ebp - 0x10]
je 0x10017578
push str.__PluginDir_SysARM64.exe_
jmp 0x10017587
push str.__PluginDir_SysX64.exe_
jmp 0x10017587
push str.__PluginDir_Sys32.exe_
lea eax, [ebp - 0x10]
push 0x104
push eax
call fcn.1000a481
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push esi
push esi
push 1
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100175f6
call ebx
mov esi, eax
push esi
lea eax, [ebp - 0x10]
push eax
push str.AIL:System64:CreateProcess__s__err_d
push 1
call fcn.101d1209
push esi
call sym.AhnIEx.dll_AhnIEx_SetError
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
push dword [0x1027ad88]
call esi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call esi
push dword [0x1027ad8c]
jmp 0x1001750b
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x38]
call esi
mov eax, dword [ebp - 0x3c]
mov dword [0x1027ad90], eax
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1f8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d14d7
add ebp, 0x1fc
leave
ret