Function at 0x10002ec28
Capabilities:
Create process on windows
Parse url

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xb0
mov ecx, 8
mov r13, rdx
call fcn.100001710
mov rdi, rax
test rax, rax
je 0x10002ec5c
lea rax, vtable.CSecurity.0
mov qword [rdi], rax
jmp 0x10002ec5e
xor edi, edi
test rdi, rdi
je 0x10002eebb
xor ebp, ebp
xor r12d, r12d
mov dword [rsp + 0xf8], ebp
mov dword [rsp + 0xf0], r12d
call qword [sym.imp.USER32.dll_GetShellWindow]
test rax, rax
je 0x10002eebb
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x10002eebb
and qword [rsp + 0x30], rbp
lea r8, [rsp + 0x30]
lea edx, [rbp + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10002ecfc
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0xf0]
mov rcx, rdi
call fcn.10003b550
mov rcx, qword [rsp + 0x30]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rsp + 0xf0]
jmp 0x10002ed04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10002ed24
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x10002eecf
call qword [sym.imp.ole32.dll_CoImpersonateClient]
mov ebx, eax
test eax, eax
js 0x10002eecf
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
and qword [rsp + 0xf0], rbp
xor r8d, r8d
lea edx, [r8 + 8]
lea r9, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x10002ed8f
mov rdx, qword [rsp + 0xf0]
lea r8, [rsp + 0xf8]
mov rcx, rdi
call fcn.10003b550
mov rcx, qword [rsp + 0xf0]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [rsp + 0xf8]
jmp 0x10002ed97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x10002edae
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x10002eecf
cmp ebp, r12d
jae 0x10002edbd
mov ebx, 5
jmp 0x10002eecf
call qword [sym.imp.ole32.dll_CoRevertToSelf]
mov ebx, eax
test eax, eax
jne 0x10002eecf
lea ebp, [rax + 1]
lea rcx, [0x10006b200]
xor edx, edx
mov r9d, ebp
mov r8d, 0x1395
call fcn.100012410
lea ebx, [rbp + 0x67]
lea rcx, [rsp + 0x40]
mov r8, rbx
xor edx, edx
call sub.msvcrt.dll_memset
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], ebx
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x50], ebp
mov edi, ebp
mov ebx, ebp
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
mov r8, qword [rsp + 0x48]
mov esi, eax
test r8, r8
je 0x10002ee71
lea r9d, [rbp + 0xd]
lea rax, str.mk:_MSITStore:
mov edx, ebp
mov dword [rsp + 0x28], r9d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov r8, qword [rsp + 0x48]
lea r9d, [rbp + 6]
mov edi, eax
lea rax, str.ms_its:
mov dword [rsp + 0x28], r9d
mov edx, ebp
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov ebx, eax
test esi, esi
je 0x10002eeb4
cmp dword [rsp + 0x54], ebp
jl 0x10002ee82
cmp dword [rsp + 0x54], 0xb
jle 0x10002ee8c
cmp edi, 2
je 0x10002ee8c
cmp ebx, 2
jne 0x10002eeb4
mov ebx, 5
lea rdx, str.open
xor r9d, r9d
mov r8, r13
xor ecx, ecx
mov dword [rsp + 0x28], ebx
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
jmp 0x10002eecf
mov ebx, 0x80070057
jmp 0x10002eecf
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100090140]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10002eefe
mov rcx, qword [0x100090140]
lea edx, [rax + 0x10]
xor r9d, r9d
mov rcx, qword [rcx + 8]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret