Function at 0x407ba0
Capabilities:
Accept command line arguments
Create process on windows
Delete directory
Get token membership
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425500
mov eax, dword fs:[0]
push eax
sub esp, 0x688
mov eax, dword [0x443624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x684]
mov esi, dword [ebp + 8]
push eax
push ebx
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x684], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [ebp - 0x688], edi
test edi, edi
jne 0x407c13
call dword [sym.imp.KERNEL32.dll_GetLastError]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, eax
mov eax, ecx
jmp 0x40814d
test ebx, ebx
je 0x40813a
cmp word [ebx], 0
je 0x40813a
cmp dword [ebp - 0x684], 2
jl 0x40813a
push 0x104
lea eax, [ebp - 0x420]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x408125
cmp eax, 0x104
ja 0x408125
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push 0x426888
push dword [edi]
call ebx
test eax, eax
jne 0x407c77
mov dword [ebp - 0x68c], 1
jmp 0x407cb3
push 0x426890
push dword [edi]
call ebx
test eax, eax
je 0x407ca9
push 0x426898
push dword [edi]
call ebx
test eax, eax
je 0x407ca9
push edi
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x57
jmp 0x40814d
mov dword [ebp - 0x68c], 2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x40816b
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x640]
mov dword [ebp - 0x690], 0
push eax
mov dword [ebp - 0x640], 0
mov word [ebp - 0x63c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
or esi, 0xffffffff
test eax, eax
je 0x407d37
lea eax, [ebp - 0x690]
push eax
push dword [ebp - 0x680]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x407d37
push 0
jmp 0x407d45
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, esi
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x680]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test eax, eax
sete cl
test eax, eax
je 0x407d68
xor eax, eax
test cl, cl
je 0x407d62
mov dword [eax], eax
cmp dword [ebp - 0x690], 0
jne 0x407efe
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
je 0x407d9a
call ebx
mov esi, eax
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x40814d
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00413a20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jbe 0x407dda
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x407ee9
lea eax, [ebp - 0x218]
mov dword [ebp - 0x67c], 0x3c
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x668], eax
xor eax, eax
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], eax
lea eax, [ebp - 0x67c]
push eax
mov dword [ebp - 0x678], 0x540
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], str.runas
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x407ee2
mov esi, dword [ebp - 0x644]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push esi
call ebx
test eax, eax
je 0x407e97
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x407e97
push eax
push esi
call ebx
test eax, eax
je 0x407e97
jmp 0x407e95
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x407ee0
cmp dword [ebp - 0x680], 0x103
je 0x407ee0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne cl
test eax, eax
jne 0x407ed6
nop
test cl, cl
je 0x407ed0
mov dword [eax], eax
mov esi, dword [ebp - 0x680]
jmp 0x407ee9
jmp 0x407ee0
call ebx
test eax, eax
cmovne esi, eax
push edi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x40814d
mov eax, dword [ebp - 0x694]
push edi
push dword [ebp - 0x684]
push dword [edi + 4]
push dword [ebp - 0x68c]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00405e60
mov eax, dword [ebp - 0x684]
add esp, 0x18
shl eax, 2
mov esi, edi
mov dword [ebp - 0x690], eax
add eax, edi
cmp edi, eax
je 0x407f5a
mov edi, eax
lea ecx, [ecx]
push 0x4268a0
push dword [esi]
call ebx
test eax, eax
je 0x407f54
add esi, 4
cmp esi, edi
jne 0x407f40
mov edi, dword [ebp - 0x688]
mov eax, dword [ebp - 0x690]
xor ecx, ecx
add eax, edi
cmp eax, esi
mov esi, dword [ebp - 0x68c]
setne cl
push ecx
push dword [edi + 4]
push esi
call fcn.00406110
mov ebx, eax
mov eax, dword [edi + 4]
push 0x426810
mov dword [ebp - 0x688], eax
call fcn.004044c0
push str.kvpuins
call fcn.004044c0
add esp, 0x14
cmp esi, 2
jne 0x408078
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x638], str.setup.vbs
mov dword [ebp - 0x634], 0x426858
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], 0x4266f4
call fcn.00404900
mov dword [ebp - 0x688], eax
lea ecx, [ebp - 0x670]
lea eax, [ebp - 0x688]
push eax
call fcn.004012a0
mov eax, dword [ebp - 0x648]
test eax, eax
je 0x40806d
push str.3kvpuni
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x40806d
xor esi, esi
push dword [ebp + esi*4 - 0x638]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x408047
lea eax, [ebp - 0x628]
push eax
call fcn.00406570
add esp, 4
inc esi
cmp esi, 4
jb 0x408012
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x670]
call fcn.00402430
mov esi, dword [ebp - 0x68c]
jmp 0x408078
lea ecx, [ebp - 0x670]
call fcn.00402430
and esi, 1
je 0x4080bd
test ebx, ebx
jne 0x408085
xor eax, eax
jmp 0x4080b2
cmp ebx, 0xbb9
je 0x4080ad
cmp ebx, 0x10a
je 0x4080ad
cmp ebx, 0x70a
je 0x4080ad
xor eax, eax
cmp ebx, 0x666
setne al
add eax, 2
jmp 0x4080b2
mov eax, 1
push eax
push 0
call fcn.0040e9c0
add esp, 8
call fcn.0040e280
test eax, eax
setne cl
test eax, eax
jne 0x4080d6
jmp 0x4080d0
test cl, cl
je 0x4080d0
mov dword [eax], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x684], 2
jg 0x408113
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408175
push 0x40
test esi, esi
mov ecx, 0x4268cc
push str.qZ
mov eax, 0x4268c0
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
jmp 0x40814d
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x6f
jmp 0x40814d
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x667
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402cb0
test esi, esi
mov ecx, 0x4268e4
mov eax, 0x4268d8
cmove eax, ecx
push eax
call fcn.00407000
int3