Function at 0x469dc2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov byte [ebp - 0x11], cl
xor ebx, ebx
mov dword [ebp - 0x1c], esi
push edi
inc ebx
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push esi
push esi
push esi
push 0x10
push 6
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov edi, eax
test edi, edi
je 0x469e54
mov eax, dword [section..data]
cmp eax, section..data
je 0x469e3e
test byte [eax + 0x1c], 8
je 0x469e3e
cmp byte [eax + 0x19], 2
jb 0x469e3e
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
mov edx, 0x40f87c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.00421fda
test edi, edi
jle 0x46a100
movzx edi, di
or edi, 0x80070000
jmp 0x46a100
cmp dword [ebp - 0x1c], esi
je 0x469fcf
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push 2
push 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x469ed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x469eb9
test byte [eax + 0x1c], 8
je 0x469eb9
cmp byte [eax + 0x19], 2
jb 0x469eb9
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x26
mov edx, 0x40f87c
pop ecx
call fcn.00421fda
test edi, edi
jle 0x469ec8
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x46a100
mov edi, 0x80004005
jmp 0x46a100
cmp dword [ebp - 0x10], esi
jbe 0x469fcd
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x469f88
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0x11
jne 0x469f25
lea edi, [eax + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
cmp byte [eax], 1
jne 0x469f3b
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
cmp dword [eax], 0x3000
sbb ebx, ebx
neg ebx
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x469ee1
test ebx, ebx
jne 0x469fcd
xor edi, edi
inc edi
jmp 0x46a100
mov eax, dword [section..data]
mov edi, 0x8000ffff
cmp eax, section..data
je 0x46a100
test byte [eax + 0x1c], 8
je 0x46a100
cmp byte [eax + 0x19], 2
jb 0x46a100
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
mov edx, 0x40f87c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x28
pop ecx
call fcn.00421fda
jmp 0x46a100
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x469eb9
test byte [eax + 0x1c], 8
je 0x469eb9
cmp byte [eax + 0x19], 2
jb 0x469eb9
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x27
jmp 0x469eae
xor esi, esi
sub esp, 0x48
mov dword [ebp - 0x28], esi
mov ecx, esp
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
lea edx, [ebp - 0x24]
lea esi, [ebp - 0x28]
lea eax, [ecx + 8]
mov dword [eax], 0x4017d4
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [ecx + 0x40], eax
lea ecx, [ebp - 0x18]
call fcn.0046bf65
mov edi, eax
test edi, edi
jns 0x46a051
mov eax, dword [section..data]
cmp eax, section..data
je 0x46a03f
test byte [eax + 0x1c], 8
je 0x46a03f
cmp byte [eax + 0x19], 2
jb 0x46a03f
call fcn.0042386b
push edi
push 0x40f518
push eax
mov eax, dword [section..data]
mov edx, 0x40f87c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.0042371b
cmp dword [ebp - 0x18], 0
je 0x46a100
push dword [ebp - 0x18]
jmp 0x46a0fa
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x64]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x64], esi
cmp byte [ebp - 0x11], 0
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x58], 0x40f538
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x41c968
jne 0x46a087
mov dword [ebp - 0x50], 0x41c980
lea eax, [ebp - 0x64]
mov dword [ebp - 0x48], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x46a0f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x46a0db
test byte [eax + 0x1c], 8
je 0x46a0db
cmp byte [eax + 0x19], 2
jb 0x46a0db
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
mov edx, 0x40f87c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
pop ecx
call fcn.00421fda
test edi, edi
jle 0x46a0ea
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x46a0f5
mov edi, 0x80004005
jmp 0x46a0f5
xor edi, edi
test esi, esi
je 0x46a100
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x20], 0
je 0x46a10f
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret