Function at 0x464322
Capabilities:
Check os version
Create process on windows
Get hostname
Get session user name
Terminate process

Disassembly:
push 0x3d0
mov eax, 0x4e0cc6
call fcn.004bed19
lea eax, [ebp - 0x29c]
mov ebx, ecx
call fcn.00463a78
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00499991
push eax
lea ecx, [ebp - 0x3b8]
call fcn.004727f7
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.004be850
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x464504
call fcn.00407002
cmp eax, edi
jne 0x4644a2
call fcn.004729c0
cmp eax, 6
jae 0x4643e6
push edi
push 0x10
push 0x523938
push ecx
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x54d550
call fcn.004024df
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 3
jmp 0x46446d
mov eax, dword [0x583bbc]
push 1
mov esi, 0x523938
push esi
push str.arovistaschedule
push dword [eax]
push str.runas
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jl 0x46442b
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.ExitProcess_:_Elevated_now_restarting
call fcn.004024df
call fcn.0045c866
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push 0x10
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push 0x54d550
call fcn.004024df
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 5
push dword [eax]
call fcn.004995c6
mov ecx, dword [ebp - 0x3c0]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.004027b0
lea ecx, [ebp - 0x29c]
call fcn.00463aee
xor al, al
jmp 0x464835
call fcn.00464081
test al, al
jne 0x464504
call fcn.004640f1
test al, al
jne 0x464504
cmp byte [ebp + 8], al
jne 0x464482
push edi
push 0x40
push 0x523938
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.IDS_SERVICENORUN
call fcn.004024df
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 7
jmp 0x46446d
mov eax, dword [0x583bbc]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x464511
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.004026bd
cmp byte [0x5858da], 0
je 0x464542
push str._default
jmp 0x464554
cmp byte [ebp + 8], 0
je 0x46454f
push str._updatecheck
jmp 0x464554
push str.scan
lea ecx, [ebp - 0x3b8]
call fcn.004026bd
lea ecx, [ebp - 0x3b8]
call fcn.00406d40
push eax
lea ecx, [ebp - 0x260]
call fcn.004026bd
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.004160af
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebx + 0x24]
call fcn.004535c7
lea esi, [ebp - 0x3dc]
lea edi, [ebp - 0x298]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x28c], ax
mov word [ebp - 0x28a], ax
lea eax, [ebp - 0x3b4]
push eax
mov dword [ebp - 0x3b4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x3b0], 5
mov esi, 0x100
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x3c8], esi
lea ecx, [ebp - 0x3b8]
push eax
jb 0x4645fa
push esi
call fcn.00453502
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
jmp 0x464644
push 0x104
mov dword [ebp - 0x3c8], esi
call fcn.00453502
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x3c8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00406d40
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x3b8]
call fcn.00406d40
push eax
lea ecx, [ebp - 0x258]
call fcn.004026bd
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.004160af
lea ecx, [ebx + 0x14]
mov dword [ebp - 0x3bc], ecx
call fcn.00406d40
push eax
lea ecx, [ebp - 0x24c]
call fcn.004026bd
mov eax, dword [ebx + 0x30]
xor esi, esi
sub eax, esi
je 0x46476d
dec eax
je 0x46475d
dec eax
je 0x46471e
dec eax
je 0x4646eb
push esi
push 0x10
push 0x523938
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.IDS_NEWTASKERROR
call fcn.004024df
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 9
jmp 0x46446d
add ebx, 0x38
push 4
pop edi
cmp ebx, esi
je 0x464770
lea eax, [ebp - 0x243]
xor ecx, ecx
sub ebx, eax
lea eax, [ebp + ecx - 0x243]
cmp byte [ebx + eax], 1
jne 0x464716
mov byte [eax], 1
mov byte [ebp - 0x244], 1
inc ecx
cmp ecx, 0x1f
jl 0x4646ff
jmp 0x464770
push 3
lea eax, [ebx + 0x38]
pop edi
mov dword [ebp - 0x3c0], edi
cmp eax, esi
je 0x464760
xor edx, edx
push 7
inc edx
pop esi
cmp byte [eax], 1
jne 0x464756
movzx ecx, dx
cmp dx, 7
jne 0x464744
xor ecx, ecx
xor edi, edi
inc edi
shl edi, cl
add word [ebp - 0x246], di
mov edi, dword [ebp - 0x3c0]
inc eax
inc edx
dec esi
jne 0x464734
jmp 0x464760
push 2
pop edi
mov ax, word [ebx + 0x34]
mov word [ebp - 0x248], ax
jmp 0x464770
xor edi, edi
inc edi
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x268], edi
call fcn.00463b98
cmp eax, 0x80070050
jne 0x46483d
push esi
push 0x24
push 0x523938
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.IDS_FILEEXIST
call fcn.004024df
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 0xb
push dword [eax]
call fcn.004995c6
cmp eax, 6
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3c0]
sete bl
add ecx, 0xfffffff0
call fcn.004027b0
test bl, bl
je 0x464482
mov ecx, dword [ebp - 0x3bc]
call fcn.00406d40
push eax
call fcn.00463f56
pop ecx
test eax, eax
jl 0x46481a
lea eax, [ebp - 0x29c]
call fcn.00463b98
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.004027b0
lea ecx, [ebp - 0x29c]
call fcn.00463aee
mov al, 1
call fcn.004bed9c
ret 4
cmp eax, 0x80070005
jne 0x46489c
push esi
push 0x40
push 0x523938
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x54d550
call fcn.004024df
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 0xd
push dword [eax]
call fcn.004995c6
mov ecx, dword [ebp - 0x3bc]
jmp 0x46447a
cmp eax, 0x8007007b
jne 0x4648eb
push esi
push 0x40
push 0x523938
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.IDS_VALIDFILE
call fcn.004024df
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 0xf
jmp 0x46488a
cmp eax, esi
jge 0x46481a
push esi
push 0x10
push 0x523938
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.004024df
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.IDS_NEWTASKERROR
call fcn.004024df
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.004068e2
mov byte [ebp - 4], 0x11
jmp 0x46488a