Function at 0x4a37f6
Capabilities:
Bypass mark of the web
Delete file

Disassembly:
push 0x16c
mov eax, 0x52505b
call fcn.004d8af2
mov esi, edx
mov dword [ebp - 0x140], esi
mov ebx, ecx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x138], ebx
and dword [ebp - 0x13c], 0
mov eax, dword [esi + 0x70]
push 2
pop edi
cmp eax, 1
je 0x4a39c1
cmp eax, edi
je 0x4a39c1
cmp eax, 8
je 0x4a39c1
cmp eax, 3
je 0x4a39c1
cmp eax, 4
je 0x4a39c1
cmp byte [esi + 0x1f], 0
je 0x4a388f
cmp eax, 5
je 0x4a39c1
cmp eax, 6
je 0x4a39c1
push 0x5139
push 0x80004005
push ecx
mov ecx, esp
push str._nonadmin_switch_can_only_be_used_with__audit_or__list
call fcn.00406fea
mov ecx, ebx
call fcn.00406620
jmp 0x4a3c88
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x4a39c1
cmp byte [esi + 8], al
je 0x4a38b6
push 0x5140
push 0x80004005
push ecx
mov ecx, esp
push str.Administrator_rights_required
jmp 0x4a387e
lea ecx, [ebp - 0x12c]
call fcn.0042b0ee
cmp dword [eax + 4], 6
jb 0x4a3999
cmp byte [esi + 0x1c], 0
jne 0x4a3999
and dword [ebp - 0x130], 0
and dword [ebp - 4], 0
push ecx
mov ecx, esp
call fcn.0040687a
lea edx, [ebp - 0x130]
lea ecx, [ebp - 0x150]
call fcn.0043ad0c
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x150], 0
jge 0x4a3955
cmp dword [ebp - 0x150], 0x800704c7
jne 0x4a3945
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
mov ecx, dword [ebp - 0x148]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp dword [ebp - 0x130], 0
je 0x4a3c88
push dword [ebp - 0x130]
jmp 0x4a398e
lea eax, [ebp - 0x150]
mov ecx, ebx
push eax
call fcn.0040121b
jmp 0x4a3922
mov esi, dword [ebp - 0x130]
test esi, esi
je 0x4a3968
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
mov ecx, dword [ebp - 0x148]
lea ecx, [ecx - 0x10]
call fcn.00407189
test esi, esi
je 0x4a3c88
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a3c88
push 0
push str.Administator_rights_required
push str.Please_log_in_as_an_administrator_to_run_this_program.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
and dword [ebx], 0
lea ecx, [ebx + 8]
and dword [ebx + 4], 0
call fcn.0040687a
jmp 0x4a3c88
lea edx, [esi + 0x5c]
mov eax, dword [edx]
cmp dword [eax - 0xc], 0
je 0x4a3a01
push str.:Zone.Identifier
lea ecx, [ebp - 0x130]
call fcn.00409442
pop ecx
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4a39f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x130]
lea ecx, [ecx - 0x10]
call fcn.00407189
cmp byte [esi + 8], 0
mov byte [ebp - 0x132], 0
je 0x4a3a9d
lea edx, [ebp - 0x132]
lea ecx, [ebp - 0x16c]
call fcn.004a249e
mov dword [ebp - 4], edi
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x131], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 3
call fcn.0044f24f
sub esp, 0xc
mov esi, eax
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x138], esp
mov ecx, esp
push eax
call fcn.0040121b
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push str.MoveToWinsta0
call fcn.00406fea
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0044ec8b
lea ecx, [ebp - 0x131]
call fcn.0044f694
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x164]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov esi, dword [ebp - 0x140]
mov edx, esi
lea ecx, [ebp - 0x178]
call fcn.004a2fe1
mov dword [ebp - 4], 5
cmp byte [ebp - 0x132], 0
je 0x4a3c6c
xor dl, dl
lea ecx, [ebp - 0x150]
call fcn.0046c9b6
mov eax, dword [0x57d3ec]
add eax, 0x54
mov byte [ebp - 0x131], 1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 7
call fcn.0044f24f
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x144], eax
test ecx, ecx
js 0x4a3b53
jne 0x4a3b12
push str.success
lea ecx, [ebp - 0x138]
call fcn.00406fea
mov byte [ebp - 4], 8
jmp 0x4a3b2c
push str.not_found__unexpected_
lea ecx, [ebp - 0x154]
call fcn.00406fea
push 4
mov dword [ebp - 4], 9
pop edi
mov ecx, dword [eax]
sub ecx, 0x10
mov dword [ebp - 0x13c], edi
call fcn.004070e7
lea esi, [eax + 0x10]
mov dword [ebp - 0x140], esi
mov dword [ebp - 4], 0xa
or edi, 8
mov ecx, esi
jmp 0x4a3b86
push dword [ebp - 0x14c]
lea eax, [ebp - 0x158]
push ecx
push dword [ebp - 0x148]
push str._ws_0x_08x___d
push eax
call fcn.004011e0
add esp, 0x14
mov dword [ebp - 4], 0xb
mov ecx, dword [eax]
mov esi, dword [ebp - 0x140]
push 0x10
pop edi
push ecx
mov dword [ebp - 0x13c], edi
add ecx, 0xfffffff0
mov dword [ebp - 0x130], edi
mov edi, esp
mov dword [ebp - 0x160], esp
mov dword [ebp - 0x15c], edi
call fcn.004070e7
add eax, 0x10
mov dword [edi], eax
push ecx
mov ecx, esp
mov dword [ebp - 4], 0xc
push str.Silent.WinSta0RemoveAce
call fcn.00406fea
mov ecx, dword [ebp - 0x144]
push 0
mov byte [ebp - 4], 0xb
call fcn.0044ed57
mov eax, dword [ebp - 0x130]
test al, 0x10
je 0x4a3bfa
mov ecx, dword [ebp - 0x158]
and eax, 0xffffffef
mov dword [ebp - 0x130], eax
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x130]
test al, 8
je 0x4a3c15
and eax, 0xfffffff7
lea ecx, [esi - 0x10]
mov dword [ebp - 0x130], eax
call fcn.00407189
mov eax, dword [ebp - 0x130]
test al, 4
je 0x4a3c36
mov ecx, dword [ebp - 0x154]
and eax, 0xfffffffb
mov dword [ebp - 0x130], eax
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x130]
mov dword [ebp - 4], 7
test al, 2
je 0x4a3c4f
mov ecx, dword [ebp - 0x138]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x131]
call fcn.0044f694
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x148]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea eax, [ebp - 0x178]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x170]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
call fcn.004d8aa1
ret