Function at 0x446b60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x4ea160]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x160], esi
mov byte [ebp - 0x131], 1
call fcn.00475ee0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x130]
push 0x600
push 0xffffffffffffffff
call fcn.00476190
mov bl, al
mov eax, dword [edi + 0x19d4]
push 0
push dword [eax + 0x14]
call fcn.004549a0
add esp, 8
test eax, eax
jne 0x446e3c
lea eax, [edi + 0x19d0]
push eax
lea ecx, [ebp - 0x140]
call fcn.00450260
mov byte [ebp - 4], 1
call fcn.00442f50
test bl, bl
je 0x446d0d
test al, al
jne 0x446c41
mov eax, dword [0x4f3994]
lea ecx, [ebp - 0x140]
push dword [eax + 0x14]
call fcn.00450850
mov eax, dword [ebp - 0x13c]
mov ecx, edi
push str.ExHIBIT
push dword [eax + 0x14]
push 0
call fcn.00442750
test al, al
jne 0x446c41
mov byte [ebp - 0x131], al
jmp 0x446e20
mov eax, dword [edi + 0x19d4]
push 0
push dword [eax + 0x14]
call fcn.004546a0
add esp, 8
test al, al
jne 0x446e20
mov eax, dword [edi + 0x19d4]
lea ecx, [ebp - 0x150]
push dword [eax + 0x14]
call fcn.00439070
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
push 1
push 0x8000
call fcn.00439290
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x148]
push str.ExHIBIT
push dword [eax + 0x14]
lea eax, [ebp - 0x15c]
push 2
push 0x2b
push eax
call fcn.00486ec0
mov byte [ebp - 4], 4
mov eax, dword [eax + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x68]
push eax
call fcn.00438180
add esp, 0x1c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x15c]
call fcn.00450480
mov eax, dword [ebp - 0x84]
mov ecx, edi
push str.ExHIBIT
push dword [eax + 0x14]
push 0
call fcn.00440e30
mov byte [ebp - 0x131], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.0043a2c0
mov byte [ebp - 4], 1
mov dword [ebp - method.FCPathName.virtual_0], vtable.FCPathName.0
jmp 0x446e11
test al, al
jne 0x446d4a
mov eax, dword [0x4f3994]
lea ecx, [ebp - 0x140]
push dword [eax + 0x14]
call fcn.00450850
mov eax, dword [ebp - 0x13c]
mov ecx, edi
push str.ExHIBIT
push dword [eax + 0x14]
push 0
call fcn.00442750
test al, al
jne 0x446d4a
mov byte [ebp - 0x131], al
jmp 0x446e20
mov eax, dword [edi + 0x19d4]
push 0
push dword [eax + 0x14]
call fcn.004546a0
add esp, 8
test al, al
jne 0x446e20
mov eax, dword [edi + 0x19d4]
lea ecx, [ebp - 0x150]
push dword [eax + 0x14]
call fcn.00439070
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
push 1
push 0x8000
call fcn.00439290
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x84]
push str.ExHIBIT
push dword [eax + 0x14]
lea eax, [ebp - 0x15c]
push 2
push 0x2c
push eax
call fcn.00486ec0
mov byte [ebp - 4], 8
mov eax, dword [eax + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x68]
push eax
call fcn.00438180
add esp, 0x1c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x15c]
call fcn.00450480
mov eax, dword [ebp - 0x84]
mov ecx, edi
push str.ExHIBIT
push dword [eax + 0x14]
push 0
call fcn.00440e30
mov byte [ebp - 0x131], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
call fcn.0043a2c0
mov byte [ebp - 4], 1
mov dword [ebp - method.FCPathName.virtual_0], vtable.FCPathName.0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14c]
call fcn.00450480
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.00450480
cmp byte [ebp - 0x131], 0
je 0x447332
test bl, bl
je 0x447332
xor bl, bl
test esi, esi
je 0x446f15
mov eax, dword [edi + 0x19d4]
lea ecx, [ebp - 0x140]
mov esi, dword [eax + 0x14]
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push esi
push 0x100
lea ecx, [ebp - 0x140]
call fcn.00450e40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x140]
push dword [ebp - 0x160]
call fcn.00450850
mov eax, dword [ebp - 0x13c]
push 0
push dword [eax + 0x14]
call fcn.004549a0
add esp, 8
test eax, eax
je 0x446efe
lea ecx, [ebp - 0x40]
call fcn.00438e90
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x40]
mov eax, dword [ebp - 0x13c]
push 1
push 0x80
push 1
push 0x40000000
push 4
push dword [eax + 0x14]
call fcn.00454560
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.00454a60
test al, al
jne 0x446ef2
cmp esi, 5
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x40]
call fcn.00439dd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.00450480
test bl, bl
jne 0x446fd3
mov eax, dword [edi + 0x19d4]
lea ecx, [ebp - 0x140]
mov esi, dword [eax + 0x14]
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push esi
push 0x100
lea ecx, [ebp - 0x140]
call fcn.00450e40
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x140]
push str.__dummy.write.check__
call fcn.00450850
lea ecx, [ebp - 0x40]
call fcn.00438e90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x40]
mov eax, dword [ebp - 0x13c]
push 1
push 0x80
push 1
push 0x40000000
push 4
push dword [eax + 0x14]
call fcn.00454560
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.00454a60
test al, al
jne 0x446fa1
cmp esi, 5
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x40], vtable.FCFile.0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x40]
call fcn.00454950
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x34]
call fcn.00450480
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.00450480
mov eax, dword [edi + 0x19d4]
lea ecx, [ebp - 0x140]
mov esi, dword [eax + 0x14]
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push esi
push 0x100
lea ecx, [ebp - 0x140]
call fcn.00450e40
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x140]
push str.__dummy.write.check__
call fcn.00450850
mov eax, dword [ebp - 0x13c]
push 0
push dword [eax + 0x14]
call fcn.004549a0
add esp, 8
test eax, eax
je 0x447046
mov eax, dword [ebp - 0x13c]
push 0
push 0
push 0
push 1
push dword [eax + 0x14]
call fcn.00471420
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x140]
call fcn.00450480
test bl, bl
je 0x447332
lea ecx, [ebp - 0x140]
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebp - 0x140]
call fcn.00450e40
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x140]
push eax
lea ecx, [edi + 0xb40]
call fcn.00475f60
mov eax, dword [ebp - 0x13c]
push dword [eax + 0x14]
lea eax, [ebp - 0x15c]
push 1
push 0x48
push eax
call fcn.00486ec0
add esp, 0x10
mov byte [ebp - 4], 0x11
mov ecx, edi
mov eax, dword [ebp - 0x158]
push str.ExHIBIT_UAC_Manager
push dword [eax + 0x14]
push dword [edi + 4]
call fcn.00440e30
nop dword [eax]
nop word [eax + eax]
mov eax, dword [edi + 0x19d4]
lea ecx, [ebp - 0x14c]
mov esi, dword [eax + 0x14]
mov dword [ebp - method.FCPathName.virtual_0], vtable.FCPathName.0
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push 0
push 0x200
lea ecx, [ebp - 0x14c]
call fcn.00450e40
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x150]
push esi
call fcn.00453660
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x16c]
mov dword [ebp - method.FCPathName.virtual_0], vtable.FCPathName.0
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push 0
push 0x200
lea ecx, [ebp - 0x16c]
call fcn.00450e40
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x170]
push str.acmp.exe
call fcn.00453660
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x17c]
mov dword [ebp - method.FCString.virtual_0], vtable.FCString.0
call fcn.00451b70
push str.open
push 0x100
lea ecx, [ebp - 0x17c]
call fcn.00450e40
mov byte [ebp - 4], 0x16
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0x3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x48], 0x40
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x44722e
cmp dword [ebp - 0x2c], 0x20
jle 0x44722e
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor bl, bl
jmp 0x4472c4
push str.ExHIBIT.exe
push 1
lea eax, [ebp - 0x188]
push 0x49
push eax
call fcn.00486ec0
add esp, 0x10
mov byte [ebp - 4], 0x17
mov ecx, edi
mov eax, dword [ebp - 0x184]
push str.ExHIBIT_UAC_Manager
push dword [eax + 0x14]
push dword [edi + 4]
call fcn.00440e30
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x188]
call fcn.00450480
push str.ExHIBIT.exe
push 1
lea eax, [ebp - 0x194]
push 0x4a
push eax
call fcn.00486ec0
add esp, 0x10
mov byte [ebp - 4], 0x18
mov ecx, edi
mov eax, dword [ebp - 0x190]
push str.ExHIBIT_UAC_Manager
push dword [eax + 0x14]
push dword [edi + 4]
call fcn.00442750
test al, al
je 0x4472ad
mov bl, 1
jmp 0x4472b5
xor bl, bl
mov byte [ebp - 0x131], bl
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x194]
call fcn.00450480
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x17c]
call fcn.00450480
mov byte [ebp - 4], 0x13
mov dword [ebp - method.FCPathName.virtual_0], vtable.FCPathName.0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x16c]
call fcn.00450480
mov byte [ebp - 4], 0x11
mov dword [ebp - method.FCPathName.virtual_0], vtable.FCPathName.0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x14c]
call fcn.00450480
test bl, bl
jne 0x4470e0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x15c]
call fcn.00450480
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x140]
call fcn.00450480
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.00475f20
mov al, byte [ebp - 0x131]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f18f
mov esp, ebp
pop ebp
ret 0xc