Function at 0x100328a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
push str.Kernel32
xor ebp, ebp
xor edi, edi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebp
je 0x100328d7
push str.GetProductInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100328d0
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
push 0x40
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x3c]
push ebp
push eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x40], ebp
call fcn.10072920
add esp, 0xc
test bl, bl
je 0x10032af8
push ebp
mov esi, 0x3000
push str.Progman
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], esi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebp
je 0x10032932
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.10032740
add esp, 8
cmp eax, ebp
jl 0x10032b5f
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10032740
mov edi, eax
add esp, 8
cmp edi, ebp
jl 0x10032b5d
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov edx, ebx
and edx, esi
cmp edx, esi
jne 0x10032b44
test ebp, 0x2000
je 0x10032b44
mov eax, dword [esp + 0x10]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x1c], esi
test esi, esi
je 0x10032af2
lea ecx, [esp + 0x20]
push ecx
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10032ad5
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 1
push 2
push 0
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x100329f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100329f3
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x10032ab2
cmp ebx, 0x2000
jne 0x10032a18
cmp ebp, ebx
jne 0x10032a18
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10032640
add esp, 4
mov edi, eax
test edi, edi
jl 0x10032a9a
push str.AdvApi32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10032a86
push str.CreateProcessWithTokenW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10032a86
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x84]
push 0
push 0
push 0
push edx
mov edx, dword [esp + 0x2c]
push ecx
push 0
push edx
call eax
test eax, eax
jne 0x10032a8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x10032a78
mov edi, eax
jmp 0x10032a8b
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10032a8b
mov edi, 0x8000ffff
test esi, esi
je 0x10032a96
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10032aeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10032ac6
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [esp + 0x20]
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10032aeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10032ae9
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jl 0x10032b5d
xor ebp, ebp
cmp dword [esp + 0x2c], ebp
jne 0x10032b5d
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x80]
lea eax, [esp + 0x38]
push eax
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10032b5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
jle 0x10032b5f
pop edi
pop esi
and eax, 0xffff
pop ebp
or eax, 0x80070000
pop ebx
add esp, 0x68
ret
cmp ebx, 0x2000
jne 0x10032af2
cmp ebp, esi
jne 0x10032af2
pop edi
pop esi
pop ebp
mov eax, 0x80070005
pop ebx
add esp, 0x68
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret