Function at 0x440e4f
Capabilities:
Accept command line arguments
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe64
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xe20], ebx
lea edi, [ebp - 0xe1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0xe60]
push ebx
push eax
mov dword [ebp - 0xe64], ebx
call fcn.00450230
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push ebx
push eax
call fcn.00450230
add esp, 0x18
mov dword [ebp - 0xe0c], ebx
call fcn.004407d8
test eax, eax
jne 0x440ec9
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00450b32
leave
ret
call dword [sym.imp.___total_physical_size__lu_MB_GetCommandLineA]
push eax
push 0x469a48
push 0x400
push 0x4d49e8
call fcn.00450d91
add esp, 0x10
call fcn.00440b5c
test eax, eax
je 0x440eb9
mov edi, dword [sym.imp.___total_physical_size__lu_MB_GetACP]
push esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
push 0x4d47a8
push ebx
call edi
mov ebx, dword [sym.imp.___total_physical_size__lu_MB_MultiByteToWideChar]
push eax
call ebx
push esi
lea eax, [ebp - 0x604]
push eax
push 0xffffffffffffffff
push 0x4d48a8
push 0
call edi
push eax
call ebx
push esi
lea eax, [ebp - 0xe04]
push eax
push 0xffffffffffffffff
push 0x4d49e8
push 0
call edi
push eax
call ebx
lea eax, [ebp - 0xe08]
push eax
xor edi, edi
push edi
push 2
lea eax, [ebp - 0x604]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.ical_size__lu_MB_LogonUserW]
test eax, eax
jne 0x440f90
push 0x4d47a8
push str.Logon_of_user__s_failed_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1c8
push str.RUNAS
call fcn.0044dc85
add esp, 0x14
jmp 0x44105f
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0xe08]
mov dword [ebp - 0xe10], esi
call dword [0x4d47a0]
test eax, eax
jne 0x440fe0
push str.GetUserProfileDirectory_failed_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1d8
push str.RUNAS
call fcn.0044dc85
add esp, 0x10
push dword [ebp - 0xe08]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
jmp 0x44105f
xor eax, eax
inc eax
mov dword [ebp - 0xe64], 0x44
cmp dword [0x4cd614], eax
jne 0x441004
xor ecx, ecx
mov dword [ebp - 0xe38], eax
mov word [ebp - 0xe34], cx
lea ecx, [ebp - 0xe20]
push ecx
lea ecx, [ebp - 0xe64]
push ecx
lea ecx, [ebp - 0x204]
push ecx
push edi
push 0x400
lea ecx, [ebp - 0xe04]
push ecx
push edi
push eax
lea eax, [ebp - 0x604]
push eax
push edi
lea eax, [ebp - 0x404]
push eax
call dword [0x4d479c]
test eax, eax
jne 0x441065
push str.CreateProcessWithLogon_failed_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x1ef
push str.RUNAS
call fcn.0044dc85
add esp, 0x10
pop esi
jmp 0x440eb9
push 0xffffffffffffffff
push dword [ebp - 0xe20]
call dword [sym.imp.___total_physical_size__lu_MB_WaitForSingleObject]
lea eax, [ebp - 0xe0c]
push eax
push dword [ebp - 0xe20]
call dword [sym.imp.___total_physical_size__lu_MB_GetExitCodeProcess]
push dword [ebp - 0xe08]
mov esi, dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
call esi
push dword [ebp - 0xe20]
call esi
push dword [ebp - 0xe1c]
call esi
push dword [ebp - 0xe0c]
call fcn.00451974
int3