Function at 0x10016d20
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100338ed
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x10040150]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
mov eax, dword [0x10040150]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x30], edi
cmp byte [ebx + 0xc], 0
mov dword [esp + 0x20], ebx
je 0x100173d8
push str.vP_F
mov byte [ebx + 0xc], 0
call fcn.10002070
add esp, 4
cmp eax, edi
jne 0x10016e02
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x258], edi
lea eax, [esp + 0x24]
lea ecx, [ebx + 8]
push eax
mov edx, esi
mov dword [esp + 0x1c], ecx
call fcn.100062b0
add esp, 4
mov byte [esp + 0x258], 2
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call edi
push str.qo.Ev
call fcn.10002070
add esp, 4
test eax, eax
jne 0x10016e21
xor esi, esi
mov dword [esp + 0x14], esi
mov byte [esp + 0x258], 3
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov dword [esp + 0x34], 1
call fcn.10017540
add esp, 4
test al, al
je 0x10016e3c
cmp byte [ebx], 1
jne 0x10016e3c
mov bl, 1
jmp 0x10016e3e
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, edi
jne 0x10016d91
push 0x8007000e
call fcn.10001e20
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jne 0x10016dd6
push 0x8007000e
call fcn.10001e20
xor bl, bl
mov dword [esp + 0x258], 2
mov eax, 1
mov dword [esp + 0x30], eax
and eax, 0xfffffffe
push esi
mov dword [esp + 0x34], eax
call edi
test bl, bl
je 0x10017167
push str.qo.Ev2s8
call fcn.10002070
add esp, 4
test eax, eax
jne 0x10016fd0
xor esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x258], 4
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x2c]
push edx
mov edx, esi
mov ecx, ebx
call fcn.100062b0
add esp, 4
mov byte [esp + 0x258], 6
push esi
call edi
push str.qo.Ev_p7P
call fcn.10002070
add esp, 4
test eax, eax
jne 0x10016fef
xor esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x258], 7
lea eax, [esp + 0x14]
push eax
mov edx, esi
mov ecx, ebx
call fcn.100062b0
add esp, 4
mov byte [esp + 0x258], 9
push esi
call edi
push str.vb_q7
call fcn.10002070
add esp, 4
test eax, eax
jne 0x1001700e
xor esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x258], 0xa
lea ecx, [esp + 0x28]
push ecx
mov edx, esi
mov ecx, ebx
call fcn.100062b0
add esp, 4
mov byte [esp + 0x258], 0xc
push esi
call edi
mov edx, dword [esp + 0x2c]
cmp dword [edx - 0xc], 5
mov ecx, dword [esp + 0x28]
push 3
push ecx
jle 0x1001702d
lea edx, [esp + 0x3c]
lea eax, [esp + 0x40]
push edx
mov dword [esp + 0x40], eax
call fcn.10002a00
mov bl, 0xd
mov byte [esp + 0x258], bl
mov ecx, dword [esp + 0x2c]
push 3
push ecx
lea edx, [esp + 0x144]
lea eax, [esp + 0x148]
push edx
mov dword [esp + 0x148], eax
call fcn.10002a00
mov byte [esp + 0x258], 0xe
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x13c]
push 0
add eax, 0x10
push eax
call fcn.10015d00
mov byte [esp + 0x258], bl
mov eax, dword [esp + 0x13c]
lea ecx, [esp + 0x140]
cmp eax, ecx
je 0x10016fbb
push eax
call fcn.1001d219
add esp, 4
mov byte [esp + 0x258], 0xc
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x38]
jmp 0x100170be
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x10016e7f
push 0x8007000e
call fcn.10001e20
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x10016ec2
push 0x8007000e
call fcn.10001e20
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x10016f01
push 0x8007000e
call fcn.10001e20
lea edx, [esp + 0x144]
lea eax, [esp + 0x148]
push edx
mov dword [esp + 0x148], eax
call fcn.10002a00
mov bl, 0xf
mov byte [esp + 0x258], bl
mov ecx, dword [esp + 0x14]
push 3
push ecx
lea edx, [esp + 0x3c]
lea eax, [esp + 0x40]
push edx
mov dword [esp + 0x40], eax
call fcn.10002a00
mov byte [esp + 0x258], 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x13c]
mov edx, dword [esp + 0x34]
push 1
add eax, 0x10
push eax
call fcn.10015d00
mov byte [esp + 0x258], bl
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x100170a8
push eax
call fcn.1001d219
add esp, 4
mov byte [esp + 0x258], 0xc
mov eax, dword [esp + 0x13c]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x100170cb
push eax
call fcn.1001d219
add esp, 4
mov byte [esp + 0x258], 9
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100170f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x258], 6
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001711b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x258], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10017143
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x258], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x100173cc
push str.ow_v
call fcn.10002070
add esp, 4
test eax, eax
jne 0x10017288
xor esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x258], 0x15
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.10017540
add esp, 4
mov bl, al
mov byte [esp + 0x258], 2
push esi
call edi
test bl, bl
je 0x100172a7
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
mov edx, 0x1003898c
call fcn.100062b0
add esp, 4
mov byte [esp + 0x258], 0x16
mov ecx, dword [esp + 0x18]
push 3
push ecx
lea edx, [esp + 0x3c]
lea eax, [esp + 0x40]
push edx
mov dword [esp + 0x40], eax
call fcn.10002a00
mov bl, 0x17
mov byte [esp + 0x258], bl
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
call fcn.100024d0
mov byte [esp + 0x258], 0x18
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push edx
call fcn.10017420
mov byte [esp + 0x258], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001723a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x258], 0x16
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
cmp eax, ecx
je 0x10017257
push eax
call fcn.1001d219
add esp, 4
mov byte [esp + 0x258], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100173ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x100173ad
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x10017182
push 0x8007000e
call fcn.10001e20
push str.ow_v5FxUbr
call fcn.10002070
add esp, 4
test eax, eax
jne 0x100173fc
xor esi, esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x258], 0x1b
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.10017540
add esp, 4
mov bl, al
mov byte [esp + 0x258], 2
push esi
call edi
test bl, bl
je 0x100173ad
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x18]
push edx
mov edx, 0x1003898c
call fcn.100062b0
add esp, 4
mov byte [esp + 0x258], 0x1c
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
call section..text
mov byte [esp + 0x258], 0x1d
push str.gqsFgpyFyF
call fcn.10001ea0
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
call section..text
mov byte [esp + 0x258], 0x1e
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.10005920
add esp, 8
cmp eax, 0xffffffff
sete bl
mov byte [esp + 0x258], 0x1d
lea ecx, [esp + 0x14]
push ecx
call fcn.10002580
mov byte [esp + 0x258], 0x1c
lea edx, [esp + 0x20]
push edx
call fcn.10002580
test bl, bl
je 0x1001739b
mov eax, dword [esp + 0x18]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [esp + 0x258], 2
lea ecx, [esp + 0x18]
push ecx
call fcn.10002580
mov dword [esp + 0x258], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100173d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.1001d07f
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x100172c2
push 0x8007000e
call fcn.10001e20
int3