Function at 0x10030f90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7b4
mov eax, dword [0x1006de68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
cmp dword [ebp + 0x10], 0
je 0x10030ff9
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
cmp eax, 0x400
ja 0x10030ff9
cmp dword [ebp + 0xc], 0
je 0x10030ff9
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR120.dll_strlen
add esp, 4
test eax, eax
jbe 0x10030ff9
mov edx, dword [ebp + 0x10]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
mov esi, eax
mov eax, dword [ebp + 0x14]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
lea ecx, [esi + eax + 2]
cmp ecx, 0x50d
jbe 0x10031064
push str._Cannot_start_process_with_bad_arguments.
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 8
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str._nExecutable_____s__nVerb_____s__nArguments_____s__nWork_Directory_____s__n
lea eax, [ebp - 0x204]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
lea ecx, [ebp + eax - 0x204]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x14
lea edx, [ebp - 0x204]
push edx
push 0x1c38
push 0x1059c3b2
push 0x1006b268
call sym.CIMIO_NO_WRITE.dll_CIMIO_MGMT_LogMessage
add esp, 0x10
xor al, al
jmp 0x10031716
push 0x3c
push 0
lea eax, [ebp - 0x760]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x770]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x1006b288
lea edx, [ebp - 0x714]
push edx
call sub.MSVCR120.dll_strcpy
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x714]
push ecx
call sub.MSVCR120.dll_strcat
add esp, 8
push 0x1006b28c
lea edx, [ebp - 0x714]
push edx
call sub.MSVCR120.dll_strcat
add esp, 8
cmp dword [ebp + 0x14], 0
je 0x10031102
mov eax, dword [ebp + 0x14]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
test eax, eax
je 0x10031102
push 0x1006b290
lea ecx, [ebp - 0x714]
push ecx
call sub.MSVCR120.dll_strcat
add esp, 8
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x714]
push eax
call sub.MSVCR120.dll_strcat
add esp, 8
cmp dword [ebp + 0x18], 0
je 0x10031117
mov ecx, dword [ebp + 0x18]
movsx edx, byte [ecx + 4]
test edx, edx
je 0x100311bf
mov dword [ebp - 0x760], 0x3c
mov dword [ebp - 0x75c], 0x440
mov dword [ebp - 0x758], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x754], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x750], ecx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x74c], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x748], eax
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x744], ecx
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x72c], 0
mov dword [ebp - 0x728], 0
lea edx, [ebp - 0x760]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x100311b0
cmp dword [ebp - 0x740], 0x20
jle 0x100311b0
mov dword [ebp - 0x718], 1
jmp 0x100311ba
mov dword [ebp - 0x718], 0
jmp 0x10031244
lea eax, [ebp - 0x7b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
je 0x10031210
lea edx, [ebp - 0x770]
push edx
lea eax, [ebp - 0x7b4]
push eax
push 0
push 0
push 0x208
push 0
push 0
push 0
lea ecx, [ebp - 0x714]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [ebp - 0x718], eax
jmp 0x10031244
lea edx, [ebp - 0x770]
push edx
lea eax, [ebp - 0x7b4]
push eax
push 0
push 0
push 0x208
push 0
push 0
push 0
lea ecx, [ebp - 0x714]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 0
jne 0x100315cb
cmp dword [ebp + 0x18], 0
je 0x10031266
mov eax, dword [ebp + 0x18]
movsx ecx, byte [eax + 4]
test ecx, ecx
je 0x10031597
mov edx, dword [ebp + 0x2c]
push edx
mov eax, dword [ebp - 0x740]
push eax
push 0x79
call sym.CIMIO_NO_WRITE.dll_CIMIO_SERVER_LDBLK
add esp, 0xc
push str._PID_of_process_just_created_is_not_longer_ACTIVE:
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 8
mov edx, dword [ebp - 0x740]
mov dword [ebp - 0x720], edx
cmp dword [ebp - 0x720], 0x20
ja case.0x100312b6.1
mov eax, dword [ebp - 0x720]
movzx ecx, byte [eax + 0x10031760]
jmp dword [ecx*4 + 0x10031728]
push str.The_operating_system_is_out_of_memory_or_resources.
push 0x1006b30c
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.The_specified_file_was_not_found.
push 0x1006b338
lea ecx, [ebp - 0x204]
push ecx
call sub.MSVCR120.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x204]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.The_specified_path_was_not_found.
push 0x1006b364
lea eax, [ebp - 0x204]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
lea ecx, [ebp + eax - 0x204]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.The_.exe_file_is_invalid__non_Microsoft_Win32_.exe_or_error_in_.exe_image_
push 0x1006b404
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.Access_denied.
push 0x1006b40c
lea ecx, [ebp - 0x204]
push ecx
call sub.MSVCR120.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x204]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.Out_of_memory.
push 0x1006b424
lea eax, [ebp - 0x204]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
lea ecx, [ebp + eax - 0x204]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.Dynamic_link_library_not_found.
push 0x1006b42c
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.Cannot_share_an_open_file.
push 0x1006b434
lea ecx, [ebp - 0x204]
push ecx
call sub.MSVCR120.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x204]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.File_association_information_not_complete.
push 0x1006b468
lea eax, [ebp - 0x204]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
lea ecx, [ebp + eax - 0x204]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.DDE_operation_timed_out.
push 0x1006b48c
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.DDE_operation_failed.
push 0x1006b4ac
lea ecx, [ebp - 0x204]
push ecx
call sub.MSVCR120.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x204]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.DDE_operation_is_busy.
push 0x1006b4cc
lea eax, [ebp - 0x204]
push eax
call sub.MSVCR120.dll_strlen
add esp, 4
lea ecx, [ebp + eax - 0x204]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
push str.File_association_not_available.
push str.__s_
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x10031546
mov ecx, dword [ebp - 0x740]
push ecx
push str.Unknown_Error____l_
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0x1006b514
lea ecx, [ebp - 0x204]
push ecx
call sub.MSVCR120.dll_strlen
add esp, 4
lea edx, [ebp + eax - 0x204]
push edx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x204]
push eax
push 0x1d0c
push 0x1059c3b3
push 0x1006b550
call sym.CIMIO_NO_WRITE.dll_CIMIO_MGMT_LogMessage
add esp, 0x10
jmp 0x100315ac
mov ecx, dword [ebp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x79
call sym.CIMIO_NO_WRITE.dll_CIMIO_SERVER_LDBLK
add esp, 0xc
mov edx, dword [ebp + 0x2c]
push edx
push 0x3aa7
push 0xf
call sym.CIMIO_NO_WRITE.dll_CIMIO_SERVER_LDBLK
add esp, 0xc
xor al, al
jmp 0x10031716
cmp dword [ebp + 0x18], 0
je 0x1003160e
mov eax, dword [ebp + 0x18]
movsx ecx, byte [eax + 4]
test ecx, ecx
jne 0x1003160e
mov edx, dword [ebp - 0x76c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x24], 0
je 0x100315fc
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp - 0x770]
mov dword [eax], ecx
jmp 0x10031609
mov edx, dword [ebp - 0x770]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10031714
cmp dword [ebp + 0x24], 0
je 0x10031714
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp - 0x728]
mov dword [eax], ecx
cmp dword [ebp + 0x28], 0
je 0x10031714
cmp dword [ebp - 0x728], 0
je 0x10031714
lea edx, [ebp - 0x71c]
push edx
mov eax, dword [ebp - 0x728]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 0
je 0x10031714
cmp dword [ebp - 0x71c], 0x103
jne 0x1003167d
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp - 0x728]
mov dword [ecx], edx
jmp 0x10031714
mov eax, dword [ebp - 0x71c]
push eax
push str._PID_of_process_just_created_is_not_longer_ACTIVE._Exit_code_____d_
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str._nExecutable_____s__Arguments____s__Work_Directory____s__n
lea edx, [ebp - 0x204]
push edx
call sub.MSVCR120.dll_strlen
add esp, 4
lea eax, [ebp + eax - 0x204]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x14
lea ecx, [ebp - 0x204]
push ecx
push 0x1d46
push 0x1059c3b6
push str.......kernelcimio_k_mgmt.c
call sym.CIMIO_NO_WRITE.dll_CIMIO_MGMT_LogMessage
add esp, 0x10
mov edx, dword [ebp + 0x2c]
push edx
mov eax, dword [ebp - 0x740]
push eax
push 0x79
call sym.CIMIO_NO_WRITE.dll_CIMIO_SERVER_LDBLK
add esp, 0xc
mov ecx, dword [ebp + 0x2c]
push ecx
push 0x3aa7
push 0xf
call sym.CIMIO_NO_WRITE.dll_CIMIO_SERVER_LDBLK
add esp, 0xc
xor al, al
jmp 0x10031716
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10059cde
mov esp, ebp
pop ebp
ret