Function at 0x480df0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x890
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov esi, edx
mov edx, dword [0x4bb2d0]
mov edi, ecx
mov ecx, dword [str.RUNDLL32.EXE]
push 0x103
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x840], eax
mov eax, dword [0x4bb2d4]
mov dword [ebp - 0x18], ecx
mov cl, byte [0x4bb2d8]
lea edx, [ebp - 0x123]
push 0
push edx
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], cl
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x834], 6
mov dword [ebp - 0x830], 3
mov byte [ebp - 0x124], 0
call fcn.004a3190
add esp, 0xc
test esi, esi
je 0x480e9a
push esi
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x124]
call fcn.00401000
xor esi, esi
cmp ebx, 2
jg 0x480ea5
cmp ebx, esi
jge 0x480eab
mov dword [ebp - 0x83c], esi
xor ebx, ebx
test edi, edi
jns 0x480eba
neg edi
mov ebx, 1
test edi, edi
jle 0x480ed8
xor eax, eax
cmp edi, 0xb
jl 0x480ed6
cmp edi, 0x15
jge 0x480ecc
xor eax, eax
jmp 0x480ed6
cmp edi, 0x1f
jge 0x480ed6
mov eax, 1
mov esi, eax
push 0x1f40001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor edi, edi
mov dword [ebp - 0x84c], eax
cmp dword [0x4d2afc], edi
je 0x480f38
mov eax, dword [0x4c6444]
mov ecx, dword [0x4c6448]
mov dword [ebp - 0x844], eax
mov dword [ebp - 0x848], ecx
cmp esi, edi
je 0x480f24
mov dword [0x4c6444], 0x20019
mov dword [0x4c6448], 0xf003f
jmp 0x480f38
mov dword [0x4c6444], 0x20119
mov dword [0x4c6448], 0xf013f
mov edx, 0x7ffffffe
cmp ebx, edi
je 0x481000
mov esi, dword [ebp - 0x840]
push esi
mov eax, 0x104
lea ecx, [ebp - 0x124]
call fcn.00401000
mov ebx, dword [ebp - 0x850]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x480fe5
mov eax, 0x200
lea ecx, [ebp - 0x124]
cmp byte [ecx], 0
je 0x480f83
inc ecx
dec eax
jne 0x480f78
jmp 0x480fab
cmp eax, edi
je 0x480fab
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push 0x4b5e54
lea ecx, [ebp + ecx - 0x124]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, 0x200
lea ecx, [ebp - 0x124]
cmp byte [ecx], 0
je 0x480fc1
inc ecx
dec eax
jne 0x480fb6
jmp 0x480fe5
cmp eax, edi
je 0x480fe5
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push ebx
lea ecx, [ebp + ecx - 0x124]
mov edx, 0x7fffffff
call fcn.00401000
lea edx, [ebp - 0x18]
push edx
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x324]
call fcn.00401000
jmp 0x48101d
mov eax, dword [ebp - 0x840]
push eax
mov eax, 0x200
lea ecx, [ebp - 0x324]
call fcn.00401000
mov esi, dword [ebp - 0x840]
mov dword [ebp - 0x88c], 0x3c
mov dword [ebp - 0x888], edi
mov dword [ebp - 0x884], edi
mov dword [ebp - 0x880], str.runas
cmp dword [ebp + 0xc], edi
jne 0x48104c
mov dword [ebp - 0x880], str.open
lea ecx, [ebp - 0x42c]
push ecx
mov ecx, esi
call fcn.0047e550
add esp, 4
mov ecx, 0x4b17de
test eax, eax
jle 0x481074
lea edx, [ebp - 0x42c]
mov dword [ebp - 0x874], edx
jmp 0x48107a
mov dword [ebp - 0x874], ecx
mov edx, dword [ebp - 0x83c]
mov edi, dword [ebp + edx*4 - 0x838]
or dword [ebp - 0x888], 0x400
lea eax, [ebp - 0x324]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x880], ecx
lea eax, [ebp - 0x88c]
lea ecx, [ebp - 0x124]
push eax
mov dword [ebp - 0x878], ecx
mov dword [ebp - 0x870], edi
mov dword [ebp - 0x86c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x481259
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x481167
mov eax, 0x200
lea ecx, [ebp - 0x324]
cmp byte [ecx], 0
je 0x4810ff
inc ecx
dec eax
jne 0x4810f4
jmp 0x481127
test eax, eax
je 0x481127
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push 0x4b5e54
lea ecx, [ebp + ecx - 0x324]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x200
lea eax, [ebp - 0x324]
cmp byte [eax], 0
je 0x48113d
inc eax
dec edx
jne 0x481132
jmp 0x481167
test edx, edx
je 0x481167
mov ecx, 0x200
sub ecx, edx
lea edx, [ebp - 0x124]
mov eax, 0x200
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x324]
mov edx, 0x7fffffff
call fcn.00401000
mov ebx, 0x270f
cmp dword [0x4c643c], ebx
jge 0x481206
mov eax, dword [ebp - 0x880]
push eax
push str.fileLaunchDelayedProgram
push str._s__s
lea ecx, [ebp - 0x82c]
push 0x200
push ecx
call fcn.00402830
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea edx, [ebp - 0x83c]
push edx
push 0x400
mov esi, eax
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [ebp - 0x83c]
push eax
push esi
push str._d___s
lea ecx, [ebp - 0x62c]
push 0x200
push ecx
call fcn.00402830
mov edx, dword [ebp - 0x83c]
add esp, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x82c]
push eax
lea esi, [ebp - 0x62c]
call fcn.0047fb10
add esp, 4
push edi
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
cmp esi, 0x1f
ja 0x481266
cmp dword [0x4c643c], ebx
jge 0x481266
mov edx, dword [ebp - 0x880]
push edx
push str.fileLaunchDelayedProgram_WinExec
push str._s__s
lea eax, [ebp - 0x62c]
push 0x200
push eax
call fcn.00402830
add esp, 0x14
push 0
lea edx, [ebp - 0x62c]
mov ecx, esi
call fcn.00482f90
jmp 0x481263
push str.fileLaunchDelayedProgram_ShellExecute__TRUE
call fcn.0047fb10
add esp, 4
cmp dword [0x4d2afc], 0
je 0x481287
mov ecx, dword [ebp - 0x844]
mov edx, dword [ebp - 0x848]
mov dword [0x4c6444], ecx
mov dword [0x4c6448], edx
mov eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret