Function at 0x10022ff4
Capabilities:
Create process on windows

Disassembly:
push 0x84
mov eax, 0x10080f76
call fcn.1006a09e
push dword [ebp + 8]
call fcn.100215e2
test al, al
je 0x1002329b
mov eax, dword [0x100b27b4]
mov ebx, 0x100b27b4
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
and dword [ebp - 4], 0
mov edi, dword [0x100b2774]
mov eax, 0x104
push eax
push eax
lea esi, [ebp - 0x20]
call fcn.10002938
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.10002668
mov eax, dword [0x100b27b4]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0
push str._OCPRD1379OpenCandy43_16
mov byte [ebp - 4], 1
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push str.RunDll32.exe___s___s__d
call fcn.1000261c
push 0x44
pop esi
push esi
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.10062b80
xor eax, eax
mov word [ebp - 0x60], ax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x100b27b4]
add esp, 0x1c
mov ecx, ebx
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x64], 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
xor edi, edi
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call fcn.1000997f
add esp, 0xc
cmp dword [ebp - 0x18], edi
je 0x10023119
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
lea esi, [ebp - 0x14]
call fcn.10002938
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne byte [ebp - 0xd]
call fcn.10002668
cmp byte [ebp - 0xd], 0
jne 0x1002318f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
lea esi, [ebp - 0x14]
call fcn.10002938
push eax
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
setne byte [ebp - 0xd]
call fcn.10002668
cmp byte [ebp - 0xd], 0
jne 0x1002318f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax - 0xc]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x90]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
call fcn.10002938
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne byte [ebp - 0xd]
call fcn.10002668
cmp byte [ebp - 0xd], 0
je 0x1002322b
mov eax, dword [0x100b27b4]
mov esi, dword [ebp - 0x34]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
push esi
push 0x10091420
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.1000261c
mov ebx, dword [ebp - 0x24]
pop ecx
pop ecx
push 0xfde9
lea eax, [ebp - 0x2c]
push eax
push ecx
add ebx, 0xfffffff0
mov eax, ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x4c], esp
mov esi, esp
call fcn.10002aac
add eax, 0x10
mov dword [esi], eax
call fcn.1000714f
mov esi, eax
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push edi
push 0x4a
push dword [eax + 8]
mov dword [ebp - 0x48], 0x22
mov dword [ebp - 0x40], esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, edi
je 0x10023212
push esi
call fcn.10060146
pop ecx
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov eax, ebx
call fcn.10002b29
jmp 0x10023266
mov eax, dword [0x100b27b4]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartDLMgr2DownloadRunasAdmin_last_error:__d
lea eax, [ebp + 8]
call fcn.1000261c
mov eax, dword [ebp + 8]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.10002b29
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], edi
je 0x10023270
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x18], edi
je 0x1002327a
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10002b29
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.10002b29
call fcn.1006a176
ret 4