Function at 0x1004a730
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c72e4
mov eax, dword fs:[0]
push eax
sub esp, 0x3bc
mov eax, dword [0x1022b584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x290], edi
mov dword [ebp - 0x28c], ebx
mov dword [ebp - 0x298], eax
test edi, edi
je 0x1004b0c2
xor eax, eax
cmp ax, word [edi]
je 0x1004b0c2
test ebx, ebx
jne 0x1004a87a
push str.invalid_param
call fcn.1005eb00
add esp, 4
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004b1ad
push 0xf
push str.CommonUtil.cpp
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 3
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], bl
call fcn.1000cf00
mov byte [ebp - 4], 4
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x17a
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.10007f90
mov esi, eax
push str.CreateAdminProcessTryServiceIfNeeded_pszCmdLine_null
push esi
mov byte [ebp - 4], 5
call fcn.10008dd0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x330]
call fcn.10008e90
lea ecx, [ebp - 0x238]
call fcn.10007310
lea ecx, [ebp - 0x250]
jmp 0x1004b1a8
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1004a954
push edi
call fcn.1015b3b0
add esp, 4
test eax, eax
jne 0x1004a954
push str.file_sign_error
call fcn.1005eb00
add esp, 4
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004b1ad
push 0xf
push str.CommonUtil.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 6
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cf00
mov byte [ebp - 4], 7
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x183
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10007f90
mov esi, eax
mov byte [ebp - 4], 8
push str.CreateAdminProcessTryServiceIfNeeded_HasMsSign_check_FAILED
jmp 0x1004b17b
lea eax, [ebp - 0x294]
mov dword [ebp - 0x288], 0
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x294], 0
push eax
call fcn.1004a200
cmp dword [ebp - 0x288], 0
jne 0x1004aa4c
push str.isnot_admin_user
call fcn.1005eb00
add esp, 4
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004b1ad
push 0xf
push str.CommonUtil.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 9
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cf00
mov byte [ebp - 4], 0xa
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x190
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10007f90
mov esi, eax
push 0x101d8528
push esi
mov byte [ebp - 4], 0xb
call fcn.1000fad0
jmp 0x1004b181
cmp dword [ebp - 0x294], 0
je 0x1004ab68
push 0
push dword [ebp + 0x18]
push dword [ebp - 0x298]
push dword [ebp + 0x14]
push esi
push 5
push ebx
push edi
call fcn.1004dfa0
add esp, 0x20
mov ebx, eax
call fcn.100a97a0
push 1
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 8]
call edx
movzx ecx, al
sub ecx, 1
jne 0x1004ab5c
push 0xf
mov dword [ebp - 0x228], ecx
mov byte [ebp - 0x238], cl
lea ecx, [ebp - 0x238]
push str.CommonUtil.cpp
mov dword [ebp - 0x224], 0xf
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cf00
mov byte [ebp - 4], 0xd
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x19a
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10007f90
mov esi, eax
push str.CreateAdminProcessTryServiceIfNeeded
push esi
mov byte [ebp - 4], 0xe
call fcn.10008dd0
add esp, 8
mov ecx, esi
push ebx
call fcn.1001ae40
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x330]
call fcn.10008e90
lea ecx, [ebp - 0x250]
call fcn.10007310
lea ecx, [ebp - 0x238]
call fcn.10007310
xor eax, eax
test ebx, ebx
sete al
jmp 0x1004b1af
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004ac53
push 0xf
push str.CommonUtil.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cf00
mov byte [ebp - 4], 0x10
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x1a1
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10007f90
mov esi, eax
push str.CreateAdminProcessTryServiceIfNeeded_try_launch_by_svc
push esi
mov byte [ebp - 4], 0x11
call fcn.10008dd0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x330]
call fcn.10008e90
lea ecx, [ebp - 0x250]
call fcn.10007310
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 0xffffffff
call fcn.10007310
mov edi, dword [ebp - 0x290]
mov eax, dword [0x1022ea70]
test al, 1
jne 0x1004ac93
or eax, 1
lea ecx, [ebp - 0x281]
mov dword [0x1022ea70], eax
call fcn.1004a010
mov ebx, eax
lea ecx, [ebp - 0x281]
mov dword [0x1022ea4c], ebx
call fcn.10049f90
mov dword [0x1022ea50], eax
mov dword [0x1022ea54], 0
jmp 0x1004ac99
mov ebx, dword [0x1022ea4c]
xor esi, esi
test ebx, ebx
je 0x1004ad81
push ebx
call fcn.1004dd20
cmp eax, 4
jne 0x1004ad71
push 0x210
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.1018d4b0
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x107
push eax
push ebx
call fcn.1004dbc0
cmp dword [ebp + 0x10], 0
je 0x1004acf3
lea eax, [ebp - 0x220]
push eax
call fcn.1015b3b0
add esp, 4
test eax, eax
je 0x1004ad71
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
lea ecx, [ebp - 0x288]
call fcn.1003b6a0
lea ecx, [ebp - 0x288]
mov dword [ebp - 4], 0x12
call fcn.1003b6d0
test eax, eax
je 0x1004ad5f
push 0x101d8624
lea ecx, [ebp - 0x288]
call fcn.1003b6d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004ad5f
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x290], 0
push ecx
push dword [ebp - 0x28c]
push edi
call eax
test eax, eax
jne 0x1004afb4
lea ecx, [ebp - 0x288]
mov dword [ebp - 4], 0xffffffff
call fcn.1003b6b0
mov ebx, dword [esi*4 + 0x1022ea50]
inc esi
test ebx, ebx
jne 0x1004aca3
push 1
push 0
push dword [ebp - 0x28c]
push edi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
mov eax, 0x20
cmp eax, ebx
sbb esi, esi
neg esi
mov dword [ebp - 0x28c], esi
cmp ebx, eax
ja 0x1004adbd
push str.shell_exec_direct_error
call fcn.1005eb00
add esp, 4
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004aeb0
push 0xf
push str.CommonUtil.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cf00
mov byte [ebp - 4], 0x17
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x1ca
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10007f90
mov esi, eax
push str.ShellExecute_return:
push esi
mov byte [ebp - 4], 0x18
call fcn.10008dd0
add esp, 8
mov ecx, esi
push ebx
call fcn.1002c180
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x330]
call fcn.10008e90
lea ecx, [ebp - 0x250]
call fcn.10007310
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 0xffffffff
call fcn.10007310
mov esi, dword [ebp - 0x28c]
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004afa9
push 0xf
mov eax, str.FAILED
mov dword [ebp - 0x270], 0
test esi, esi
mov dword [ebp - 0x26c], 0xf
mov ebx, 0x101d86f0
mov byte [ebp - 0x280], 0
push str.CommonUtil.cpp
lea ecx, [ebp - 0x280]
cmove ebx, eax
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x268]
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0xf
mov byte [ebp - 0x268], 0
call fcn.1000cf00
mov byte [ebp - 4], 0x1a
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x3c8]
push 0x1cb
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.10007f90
mov esi, eax
push str.CreateAdminProcessTryServiceIfNeeded_ShellExecute_ret
push esi
mov byte [ebp - 4], 0x1b
call fcn.10008dd0
push ebx
push esi
call fcn.10008dd0
mov edx, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x3c8]
call fcn.10008e90
lea ecx, [ebp - 0x268]
call fcn.10007310
lea ecx, [ebp - 0x280]
call fcn.10007310
mov eax, dword [ebp - 0x28c]
jmp 0x1004b1af
push str.service_cp_ok
call fcn.1005eb00
add esp, 4
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004b0ad
push 0xf
push str.CommonUtil.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cf00
mov byte [ebp - 4], 0x14
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x1b9
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10007f90
mov esi, eax
push str.CreateAdminProcessTryServiceIfNeeded_CreateProcessAsAdmin_suc_by
push esi
mov byte [ebp - 4], 0x15
call fcn.10008dd0
test ebx, ebx
mov ecx, 0x101d2100
cmovne ecx, ebx
push ecx
push esi
call fcn.1000fad0
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x330]
call fcn.10008e90
lea ecx, [ebp - 0x250]
call fcn.10007310
lea ecx, [ebp - 0x238]
call fcn.10007310
lea ecx, [ebp - 0x288]
call fcn.1003b6b0
mov eax, 1
jmp 0x1004b1af
push str.invalid_param
call fcn.1005eb00
add esp, 4
call fcn.100a97a0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1004b1ad
push 0xf
push str.CommonUtil.cpp
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], al
call fcn.1000cf00
push 3
push 0x101d1fdc
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0xf
mov byte [ebp - 0x250], 0
call fcn.1000cf00
mov byte [ebp - 4], 1
call fcn.100a97a0
mov edi, eax
lea ecx, [ebp - 0x330]
push 0x174
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10007f90
mov esi, eax
mov byte [ebp - 4], 2
push str.CreateAdminProcessTryServiceIfNeeded_param_error
push esi
call fcn.10008dd0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0x330]
call fcn.10008e90
lea ecx, [ebp - 0x250]
call fcn.10007310
lea ecx, [ebp - 0x238]
call fcn.10007310
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101799ce
mov esp, ebp
pop ebp
ret