Function at 0x10017e11
Capabilities:
Create process on windows

Disassembly:
push 0x31c
mov eax, 0x10033696
call fcn.10022f92
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
test eax, 0xffffffe0
jne 0x10017e43
xor eax, eax
call fcn.10023015
ret 8
push 4
call fcn.10021e48
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x10017e5b
lea edx, [ebp - 0x284]
mov dword [eax], edx
jmp 0x10017e5d
xor eax, eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 4], 1
mov ebx, dword [edi + 0xc]
lea esi, [ebp - 0x268]
call fcn.100108bd
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi + 0x10]
lea esi, [ebp - 0x2e8]
call fcn.100108bd
mov edi, esi
lea esi, [ebp - 0x268]
call fcn.10014778
test al, al
je 0x10017f8a
push str.Sequence
lea ecx, [ebp - 0x304]
call fcn.1000902f
lea eax, [ebp - 0x304]
push eax
lea esi, [ebp - 0x268]
mov byte [ebp - 4], 2
call fcn.1000a876
mov ebx, eax
call fcn.1001d311
call fcn.10019228
mov esi, dword [ebp - 0x278]
add eax, 0x64
xor ebx, ebx
mov dword [ebp - 0x260], eax
cmp esi, ebx
jne 0x10017efb
xor ecx, ecx
jmp 0x10017f06
mov ecx, dword [ebp - 0x270]
sub ecx, esi
sar ecx, 2
mov edx, dword [ebp - 0x274]
mov edi, edx
sub edi, esi
sar edi, 2
cmp edi, ecx
jae 0x10017f26
mov ecx, edx
add ecx, 4
mov dword [edx], eax
mov dword [ebp - 0x274], ecx
jmp 0x10017f52
mov edi, edx
cmp esi, edx
jbe 0x10017f31
call fcn.1002200a
mov eax, dword [ebp - 0x284]
push edi
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x284]
call fcn.1001ad4f
push ebx
push 1
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 1
call fcn.10008661
lea edi, [ebp - 0x320]
lea esi, [ebp - 0x268]
call fcn.10014743
lea edi, [ebp - 0x2e8]
call fcn.10014778
test al, al
jne 0x10017eb0
jmp 0x10017f8c
xor ebx, ebx
push str._groupsextract:
lea eax, [ebp - 0x260]
push eax
call fcn.100021bd
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 3
call fcn.1001030b
pop ecx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.100024ba
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x278]
mov dword [ebp - 0x264], ebx
sar eax, 2
cmp eax, ebx
jbe 0x1001805d
mov edi, 0x10038304
mov esi, dword [ebp - 0x264]
cmp esi, eax
jb 0x10017ff3
call fcn.1002200a
mov eax, dword [ebp - 0x278]
lea eax, [eax + esi*4]
push dword [eax]
lea esi, [ebp - 0x2e0]
call fcn.10010236
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 6
call fcn.1000b621
push ebx
push 1
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.10008661
push edi
call fcn.10020d18
pop ecx
push eax
mov eax, edi
lea esi, [ebp - 0x240]
call fcn.1000b6ca
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x278]
inc dword [ebp - 0x264]
sar eax, 2
cmp dword [ebp - 0x264], eax
jb 0x10017fe4
push str.__out:
lea eax, [ebp - 0x264]
push eax
call fcn.100021bd
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 7
call fcn.1001030b
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 8
call fcn.1000b621
push ebx
push 1
lea ecx, [ebp - 0x2e0]
call fcn.10008661
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.100024ba
mov edi, 0x10038328
push edi
call fcn.10020d18
pop ecx
push eax
mov eax, edi
lea esi, [ebp - 0x240]
call fcn.1000b6ca
mov eax, dword [ebp - 0x26c]
push 0xffffffffffffffff
push ebx
add eax, 0xc
push eax
mov ecx, esi
call fcn.1000b621
push edi
call fcn.10020d18
pop ecx
push eax
mov eax, edi
call fcn.1000b6ca
push str.__callbackid:
lea eax, [ebp - 0x264]
push eax
call fcn.100021bd
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 9
call fcn.1001030b
pop ecx
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.1000b621
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x2e0]
call fcn.10008661
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x264]
add eax, 0xfffffff0
call fcn.100024ba
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x2e0]
call fcn.100102ce
pop ecx
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 0xb
call fcn.1000b621
push ebx
push edi
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 5
call fcn.10008661
mov esi, str.AI_SETUPEXEPATH
push esi
lea ecx, [ebp - 0x304]
call fcn.1000902f
mov eax, dword [ebp - 0x26c]
mov byte [ebp - 4], 0xc
push dword [eax]
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x304]
call fcn.1001d87c
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x304]
mov byte [ebp - 4], 0xe
call fcn.10008661
cmp dword [ebp - 0x248], ebx
jne 0x10018297
mov eax, dword [ebp - 0x26c]
push str.AI_FindExeLzma
push dword [eax]
call sub.msi.dll_MsiEnumComponentQualifiersA
push esi
lea ecx, [ebp - 0x2e0]
call fcn.1000902f
mov eax, dword [ebp - 0x26c]
mov byte [ebp - 4], 0xf
push dword [eax]
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.1001d87c
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0x10
call fcn.100085b0
push ebx
push edi
lea ecx, [ebp - 0x2a4]
call fcn.10008661
push ebx
push edi
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0xe
call fcn.10008661
cmp dword [ebp - 0x248], ebx
jne 0x10018297
push ebx
push edi
lea ecx, [ebp - 0x25c]
call fcn.10008661
push ebx
push edi
lea ecx, [ebp - 0x240]
call fcn.10008661
cmp dword [ebp - 0x278], ebx
je 0x10018274
push dword [ebp - 0x278]
call fcn.10020bad
pop ecx
push dword [ebp - 0x284]
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
call fcn.10020bad
pop ecx
jmp 0x10017e39
call fcn.1001c88f
test al, al
je 0x10018442
cmp dword [ebp - 0x228], 8
mov eax, dword [ebp - 0x23c]
jae 0x100182b9
lea eax, [ebp - 0x23c]
cmp dword [ebp - 0x244], 8
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x258]
jae 0x100182d4
lea eax, [ebp - 0x258]
push ebx
push 0x3c
pop esi
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x2c4]
push esi
push eax
call fcn.1001c783
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x2b0], eax
add esp, 0xc
lea eax, [ebp - 0x2c4]
push eax
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2c0], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x100184d0
lea eax, [ebp - 0x318]
push eax
call fcn.100088dd
mov byte [ebp - 4], 0x11
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x2a4]
call fcn.100102ce
pop ecx
lea ecx, [ebp - 0x260]
push ecx
mov byte [ebp - 4], 0x12
call fcn.100102e7
pop ecx
push eax
push edi
lea esi, [ebp - 0x318]
mov byte [ebp - 4], 0x13
call fcn.10008921
mov eax, dword [ebp - 0x260]
add eax, 0xfffffff0
call fcn.100024ba
push ebx
push edi
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 0x11
call fcn.10008661
fldz
mov eax, dword [ebp - 0x26c]
fstp qword [ebp - 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x2a0], eax
mov eax, esi
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x2bc]
push eax
mov dword [ebp - 0x2bc], ebx
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b4], ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x29c], ebx
call fcn.100178cd
xor eax, eax
cmp dword [ebp - 0x2a4], 2
sete al
mov dword [ebp - 0x260], eax
call fcn.100089ab
push ebx
push edi
lea ecx, [ebp - 0x25c]
call fcn.10008661
push ebx
push edi
lea ecx, [ebp - 0x240]
call fcn.10008661
cmp dword [ebp - 0x278], ebx
je 0x10018437
push dword [ebp - 0x278]
call fcn.10020bad
pop ecx
mov esi, dword [ebp - 0x260]
jmp 0x10018500
cmp dword [ebp - 0x244], 8
mov ecx, dword [ebp - 0x258]
jae 0x10018457
lea ecx, [ebp - 0x258]
lea edx, [ebp - 0x11c]
call fcn.1001c870
cmp dword [ebp - 0x228], 8
mov ecx, dword [ebp - 0x23c]
jae 0x10018477
lea ecx, [ebp - 0x23c]
lea edx, [ebp - 0x224]
call fcn.1001c870
push ebx
push 0x3c
pop esi
lea eax, [ebp - 0x2c4]
push esi
push eax
call fcn.1001c783
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x2b0], eax
add esp, 0xc
lea eax, [ebp - 0x2c4]
push eax
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2c0], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x10018323
push ebx
push edi
lea ecx, [ebp - 0x25c]
call fcn.10008661
push ebx
push edi
lea ecx, [ebp - 0x240]
call fcn.10008661
cmp dword [ebp - 0x278], ebx
je 0x100184fe
push dword [ebp - 0x278]
call fcn.10020bad
pop ecx
xor esi, esi
push dword [ebp - 0x284]
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
call fcn.10020bad
pop ecx
mov eax, esi
jmp 0x10017e3b