Function at 0x453d80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d991
mov eax, dword fs:[0]
push eax
sub esp, 0x85c
mov eax, dword [0x4cf06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x453dbc
xor eax, eax
jmp 0x4541aa
cmp dword [edi + 4], 0
je 0x453dde
cmp dword [0x4d3d8c], 6
jb 0x453dde
call fcn.0045ac90
mov dword [ebp - 0x814], 1
test eax, eax
je 0x453de8
mov dword [ebp - 0x814], 0
mov ebx, dword [edi + 0x14]
mov ecx, ebx
push 0xd59
call fcn.00464620
cmp dword [edi + 8], 0
mov esi, eax
je 0x453db5
mov dword [edi + 8], 0
test esi, esi
je 0x453e21
push 0xc2e
mov ecx, ebx
call fcn.00464620
test eax, eax
je 0x453e21
mov ecx, 1
jmp 0x453e23
xor ecx, ecx
mov eax, dword [edi + 0x10]
mov dword [eax + 8], ecx
test esi, esi
je 0x453e44
push 0xc2c
mov ecx, ebx
call fcn.00464620
test eax, eax
je 0x453e44
mov ecx, 1
jmp 0x453e46
xor ecx, ecx
mov eax, dword [edi + 0x10]
mov dword [eax + 0xc], ecx
test esi, esi
je 0x453e67
push 0xbe7
mov ecx, ebx
call fcn.00464620
test eax, eax
je 0x453e67
mov ecx, 1
jmp 0x453e69
xor ecx, ecx
mov eax, dword [edi + 0x10]
mov dword [eax + 4], ecx
test esi, esi
je 0x453e8a
push 0xbe5
mov ecx, ebx
call fcn.00464620
test eax, eax
je 0x453e8a
mov ecx, 1
jmp 0x453e8c
xor ecx, ecx
mov eax, dword [edi + 0x10]
mov dword [eax], ecx
call fcn.0045ac80
test eax, eax
je 0x453fe7
or edx, 0xffffffff
mov ecx, str.FastEx64.dll
call fcn.0045d1d0
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], 0xffffffff
mov dword [ebp - 4], 0
mov eax, str.DllRegisterServerUser
cmp dword [edi + 4], 0
mov ecx, str.DllRegisterServer
cmove ecx, eax
or edx, 0xffffffff
call fcn.0045d1d0
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], 0xffffffff
mov byte [ebp - 4], 1
mov eax, str.DllUnregisterServerUser
cmp dword [edi + 4], 0
mov ecx, str.DllUnregisterServer
cmove ecx, eax
or edx, 0xffffffff
call fcn.0045d1d0
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x828], 0xffffffff
mov byte [ebp - 4], 2
test esi, esi
je 0x453f32
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x818], 0xffffffff
jmp 0x453f3c
mov dword [ebp - 0x828], 0xffffffff
push dword [edi + 4]
mov dword [ebp - 0x820], 0xffffffff
push eax
push dword [ebp - 0x824]
call fcn.0045bfb0
push eax
lea eax, [ebp - 0x810]
push str.__s_s___s__d
push eax
call fcn.0040e1d0
push 0x38
lea eax, [ebp - 0x864]
mov dword [ebp - 0x868], 0x3c
push 0
push eax
call fcn.00481280
add esp, 0x24
mov dword [ebp - 0x858], str.rundll32.exe
lea eax, [ebp - 0x810]
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x82c]
test eax, eax
je 0x453fba
push eax
call fcn.0047d4ed
add esp, 4
mov eax, dword [ebp - 0x81c]
test eax, eax
je 0x453fcd
push eax
call fcn.0047d4ed
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x824]
test eax, eax
je 0x453fe7
push eax
call fcn.0047d4ed
add esp, 4
test esi, esi
jne 0x45401d
cmp dword [edi + 4], esi
je 0x453ff5
mov eax, dword [edi + 0x1c]
jmp 0x453ff8
mov eax, dword [edi + 0x24]
call eax
cmp dword [ebp - 0x814], 0
mov esi, eax
je 0x45400a
mov eax, dword [edi + 0x24]
call eax
mov ecx, edi
call fcn.00453a30
xor eax, eax
test esi, esi
sete al
jmp 0x4541aa
mov edx, dword [edi + 0x10]
mov eax, 0xfff10fff
mov ecx, 0xfff30fff
push 0xc1a
cmp dword [edx + 8], 0
cmove ecx, eax
mov eax, ecx
or eax, 0x40000
cmp dword [edx + 0xc], 0
cmovne ecx, eax
mov esi, ecx
or esi, 0x80000
cmp dword [edx + 4], 0
cmove esi, ecx
mov ecx, ebx
mov eax, esi
and eax, 0xffefffff
cmp dword [edx], 0
cmove esi, eax
call fcn.00464620
test eax, eax
jne 0x454071
and esi, 0xfeffffff
push 0xc30
mov ecx, ebx
call fcn.00464620
test eax, eax
je 0x454087
and esi, 0xfdffffff
push 0xbf3
mov ecx, ebx
call fcn.00464620
test eax, eax
jne 0x45409a
and esi, 0xfffffffe
push 0xbf4
mov ecx, ebx
call fcn.00464620
test eax, eax
jne 0x4540ad
and esi, 0xfffffffd
push 0xbfa
mov ecx, ebx
call fcn.00464620
test eax, eax
jne 0x4540c0
and esi, 0xfffffffb
push 0xbe1
mov ecx, ebx
call fcn.00464620
test eax, eax
jne 0x4540d3
and esi, 0xffffffef
push 0xbe2
mov ecx, ebx
call fcn.00464620
test eax, eax
jne 0x4540e6
and esi, 0xffffffdf
push 0xbf5
mov ecx, ebx
call fcn.00464620
test eax, eax
je 0x4540fc
or esi, 0x1000
push 0xbf6
mov ecx, ebx
call fcn.00464620
test eax, eax
je 0x454112
or esi, 0x2000
cmp dword [0x4d3d8c], 0xa
ja 0x454132
jne 0x454138
mov eax, dword [0x4d3d90]
test eax, eax
jne 0x454132
cmp dword [0x4d3d94], 0x55f0
jb 0x454138
or esi, 0x8000
cmp dword [edi + 4], 0
je 0x454143
mov eax, dword [edi + 0x18]
jmp 0x454146
mov eax, dword [edi + 0x20]
call eax
test eax, eax
jne 0x453db5
mov eax, dword [edi + 0x30]
push esi
push dword [edi + 4]
call eax
mov ebx, dword [ebp - 0x814]
mov dword [ebp - 0x818], eax
test ebx, ebx
je 0x454171
mov ecx, dword [edi + 0x30]
push esi
push 0
call ecx
cmp dword [0x4d3d8c], 0xa
ja 0x454191
jne 0x4541a4
mov eax, dword [0x4d3d90]
test eax, eax
jne 0x454191
cmp dword [0x4d3d94], 0x55f0
jb 0x4541a4
mov eax, dword [edi + 0x28]
test eax, eax
je 0x4541a4
cmp dword [edi + 4], 0
je 0x4541a2
test ebx, ebx
je 0x4541a4
call eax
mov eax, dword [ebp - 0x818]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047d39f
mov esp, ebp
pop ebp
ret