Function at 0x10017923
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov edi, dword [esp + 0x74]
push edi
call fcn.10002e5f
add esp, 4
mov esi, eax
cmp dword [0x1002d1c0], 0xa
jl 0x1001798a
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1001798a
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
jne 0x1001797f
push edi
call fcn.10002e5f
add esp, 4
cmp dword [0x1002d1c0], 0xa
jl 0x1001792e
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1001792e
push edi
call fcn.10002e5f
add esp, 4
jmp 0x1001795d
test esi, esi
je 0x10017bee
xor eax, eax
mov ecx, esp
mov dword [ecx], eax
push eax
push esi
push ecx
call sub.USERENV.dll_CreateEnvironmentBlock
xor ebx, ebx
test eax, eax
setne bl
mov edi, 0x44
lea ebp, [esp + 0x18]
push edi
push ebp
call sub.NTDLL.dll_RtlZeroMemory
mov dword [ebp], edi
cmp dword [0x1002d1c0], 0xa
jl 0x10017a0b
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10017a0b
mov edi, 0x44
push edi
lea ebp, [esp + 0x1c]
push ebp
call sub.NTDLL.dll_RtlZeroMemory
mov dword [esp + 0x18], edi
push edi
push ebp
call sub.NTDLL.dll_RtlZeroMemory
mov dword [esp + 0x18], edi
cmp dword [0x1002d1c0], 0xa
jl 0x10017a0b
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100179d8
shl ebx, 0xa
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], str.Winsta0Default
lea eax, [esp + 4]
push 0x10
push eax
call sub.NTDLL.dll_RtlZeroMemory
cmp dword [0x1002d1c0], 0xa
jl 0x10017a7c
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10017a7c
mov edi, str.Winsta0Default
mov ebx, 0x10
mov dword [esp + 0x20], edi
push ebx
lea ebp, [esp + 8]
push ebp
call sub.NTDLL.dll_RtlZeroMemory
mov dword [esp + 0x20], edi
push ebx
push ebp
call sub.NTDLL.dll_RtlZeroMemory
cmp dword [0x1002d1c0], 0xa
jl 0x10017a7c
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10017a49
mov ebp, dword [esp + 0x14]
or ebp, 0x20
mov ebx, pe_nt_image_headers32
xor edi, edi
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esp + 0xc]
push ebp
push edi
push edi
push edi
push dword [esp + 0x90]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10017ac3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
jne 0x10017a8a
jmp 0x10017b5f
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1c0], 0xa
jl 0x10017b11
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10017b11
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 8]
call edi
push dword [esp + 8]
call edi
cmp dword [0x1002d1c0], 0xa
jl 0x10017b11
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10017aec
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1c0], 0xa
jl 0x10017b5f
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10017b5f
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 4]
call edi
push dword [esp + 4]
call edi
cmp dword [0x1002d1c0], 0xa
jl 0x10017b5f
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10017b3a
mov edi, dword [esp]
test edi, edi
je 0x10017b8d
push edi
call sub.USERENV.dll_DestroyEnvironmentBlock
cmp dword [0x1002d1c0], 0xa
jl 0x10017b8d
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10017b8d
push edi
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x10017b66
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d1c0], 0xa
jl 0x10017bee
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10017bee
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
push esi
call edi
cmp dword [0x1002d1c0], 0xa
jl 0x10017bd2
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10017bb3
push esi
call edi
cmp dword [0x1002d1c0], 0xa
jl 0x10017bee
mov eax, dword [0x1002d1c4]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10017bb3
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret