Function at 0x10016a30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.1006ad60
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x10016d4b
test edi, edi
je 0x10016d4b
push 4
push esi
call fcn.100889f2
add esp, 8
test eax, eax
je 0x10016a95
push str.file_not_access
call fcn.1001f0d0
add esp, 4
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 0
je 0x10016acb
push esi
call fcn.1005e7a0
add esp, 4
test eax, eax
jne 0x10016acb
push str.file_sign_error
call fcn.1001f0d0
add esp, 4
mov eax, 5
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
call fcn.100121b0
test al, al
jne 0x10016c53
call fcn.10012130
test eax, eax
je 0x10016c53
xorps xmm0, xmm0
mov dword [ebp - 0x1048], 0x44
lea eax, [ebp - 0x1048]
movlpd qword [ebp - 0x1044], xmm0
push eax
movlpd qword [ebp - 0x103c], xmm0
movlpd qword [ebp - 0x1034], xmm0
movlpd qword [ebp - 0x102c], xmm0
movlpd qword [ebp - 0x1024], xmm0
movlpd qword [ebp - 0x101c], xmm0
movlpd qword [ebp - 0x1014], xmm0
movlpd qword [ebp - 0x100c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x10]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x1018], ax
lea eax, [ebp - 0x1004]
push 0
push eax
mov dword [ebp - 0x101c], 1
movups xmmword [ebp - 0x1058], xmm0
call fcn.10076710
add esp, 0xc
lea eax, [ebp - 0x1004]
cmp word [edi], 0
je 0x10016b92
push edi
push esi
push str.__s___s
push eax
call fcn.10013300
add esp, 0x10
jmp 0x10016ba1
push esi
push 0x100b0dd8
push eax
call fcn.10013300
add esp, 0xc
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10016c2e
cmp dword [ebp + 0x18], 0
je 0x10016be8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 0x1058]
call fcn.10017fd0
add esp, 0xc
xor ecx, ecx
mov edi, 3
test eax, eax
cmovne edi, ecx
test ebx, ebx
je 0x10016c05
push ebx
push dword [ebp - 0x1058]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1058]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1054]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
push str.create_process_error
mov edi, 4
call fcn.1001f0d0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
mov dword [ebp - 0x1024], eax
lea eax, [ebp - 0x1040]
push eax
mov dword [ebp - 0x1028], 0
movlpd qword [ebp - 0x1020], xmm0
movlpd qword [ebp - 0x1018], xmm0
movlpd qword [ebp - 0x1010], xmm0
mov dword [ebp - 0x1008], 0
mov dword [ebp - 0x1040], 0x3c
mov dword [ebp - 0x1038], 0
mov dword [ebp - 0x1030], esi
mov dword [ebp - 0x103c], 0x1140
mov dword [ebp - 0x102c], edi
mov dword [ebp - 0x1034], str.runas
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x10016d26
cmp dword [ebp + 0x18], 0
je 0x10016cea
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 0x1008]
call fcn.10017fd0
add esp, 0xc
xor ecx, ecx
mov esi, 3
test eax, eax
cmovne esi, ecx
test ebx, ebx
je 0x10016d07
push ebx
push dword [ebp - 0x1008]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1008]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
push str.shell_exec_runas_error
mov esi, 4
call fcn.1001f0d0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
push str.invalid_param
call fcn.1001f0d0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret