Function at 0x10003010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10028cb1
mov eax, dword fs:[0]
push eax
sub esp, 0x2d0
mov eax, dword [0x1003230c]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
push esi
push edi
mov eax, dword [0x1003230c]
xor eax, esp
push eax
lea eax, [esp + 0x2e0]
mov dword fs:[0], eax
xor edi, edi
mov ebx, 7
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0xac], ebx
mov dword [esp + 0xa8], edi
mov word [esp + 0x98], ax
mov dword [esp + 0x2e8], edi
push 1
push 1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call fcn.100029d0
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x100030b7
push 1
push edi
lea ecx, [esp + 0x1c]
call fcn.100029d0
add esp, 8
test eax, eax
je 0x100032fd
call fcn.10006a70
test eax, eax
je 0x100030d8
lea ecx, [esp + 0x94]
push ecx
call fcn.100067b0
add esp, 4
test eax, eax
jne 0x100032fd
push 9
mov eax, str.Software
lea ecx, [esp + 0x98]
call fcn.10005c60
cmp esi, edi
je 0x10003120
cmp dword [esp + 0xac], 8
mov esi, dword [esp + 0x98]
jae 0x10003107
lea esi, [esp + 0x98]
call fcn.10006bb0
push edi
push 1
lea ecx, [esp + 0x1c]
call fcn.100029d0
add esp, 8
jmp 0x100032fd
xor edx, edx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xc4], edi
mov word [esp + 0xb4], dx
xor eax, eax
mov dword [esp + 0x90], ebx
mov dword [esp + 0x8c], edi
mov word [esp + 0x7c], ax
lea ecx, [esp + 0xb0]
push ecx
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x308], 2
mov dword [esp + 0x48], esp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
push 0x10
mov eax, str.CustomActionData
mov word [esi + 4], dx
call fcn.10005d40
mov ecx, dword [ebp + 8]
call fcn.10006950
add esp, 0x20
cmp dword [esp + 0xc4], edi
je 0x100032b4
push 1
mov eax, 0x1002c79c
lea ecx, [esp + 0x7c]
call fcn.10005c60
push edi
lea eax, [esp + 0xb4]
push eax
or eax, 0xffffffff
lea esi, [esp + 0x80]
call fcn.10005ba0
push 0xc
mov eax, 0x1002c7a0
mov ecx, esi
call fcn.10005c60
push 2
mov eax, 0x1002c7bc
mov ecx, esi
call fcn.10005c60
push edi
lea ecx, [esp + 0x98]
push ecx
or eax, 0xffffffff
call fcn.10005ba0
push 0x40
lea edx, [esp + 0x34]
push edi
push edx
call fcn.10017160
xor eax, eax
mov esi, 8
add esp, 0xc
mov word [esp + 0x5c], ax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], 0x44
cmp dword [esp + 0x90], esi
jae 0x10003222
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push edi
push 0x20
push edi
push edi
push edi
push eax
mov eax, dword [esp + 0x38]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x10003264
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100032b9
push str.Wait_failed
call fcn.10001180
add esp, 4
jmp 0x100032b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x206
mov esi, eax
lea eax, [esp + 0xd2]
xor edx, edx
push edi
push eax
mov word [esp + 0xd8], dx
call fcn.10017160
add esp, 0xc
push esi
push str.CreateProcessAsUser_failed._Last_error:__d
lea ecx, [esp + 0xd4]
push 0x104
push ecx
call fcn.10011853
lea edx, [esp + 0xdc]
push edx
call fcn.10001180
add esp, 0x14
mov esi, 8
cmp dword [esp + 0x90], esi
jb 0x100032cf
mov eax, dword [esp + 0x7c]
push eax
call fcn.10011720
add esp, 4
xor ecx, ecx
mov word [esp + 0x7c], cx
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], ebx
cmp dword [esp + 0xc8], esi
jb 0x100032fd
mov edx, dword [esp + 0xb4]
push edx
call fcn.10011720
add esp, 4
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x1000330e
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x10003319
push eax
call esi
cmp dword [esp + 0xac], 8
jb 0x10003333
mov eax, dword [esp + 0x98]
push eax
call fcn.10011720
add esp, 4
mov ecx, dword [esp + 0x2e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c8]
xor ecx, esp
call fcn.1001172b
mov esp, ebp
pop ebp
ret