Function at 0x40944c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x974
lea ebp, [esp - 4]
mov eax, dword [0x452724]
xor eax, ebp
mov dword [ebp + 0x974], eax
push 0x20
mov eax, 0x42d62f
call fcn.00415521
mov eax, ecx
xor ebx, ebx
cmp dword [eax + 0x10], ebx
mov dword [ebp - 0x10], eax
je 0x409487
push str.__ChangeWinFirewallException
call fcn.004140dd
pop ecx
call fcn.00412965
mov edi, eax
cmp edi, 0x32
jbe 0x4096aa
push 0xf
pop esi
push ebx
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x34], esi
call fcn.0040423a
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x6c], esi
call fcn.0040423a
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
push ebx
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.00408ae2
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405cdc
cmp edi, 0x50
movzx eax, byte [ebp + 0x980]
push eax
jae 0x409598
push str.ChangeWinFirewallException_is_XP_compatible__set_to__d_____
call fcn.004140dd
push str.::Enabled:Instant_Support_Desk_Service
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp]
push eax
call fcn.00408c60
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x1c]
push ecx
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.00408a8f
add esp, 0x20
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp]
call fcn.004049c1
cmp byte [ebp + 0x980], bl
push 0x10
pop edi
je 0x409546
cmp dword [ebp + 0x50], edi
jb 0x409541
mov ecx, dword [ebp + 0x3c]
jmp 0x409548
lea ecx, [ebp + 0x3c]
jmp 0x409548
xor ecx, ecx
cmp dword [ebp + 0x6c], edi
mov eax, dword [ebp + 0x58]
jae 0x409553
lea eax, [ebp + 0x58]
push 1
push ecx
push eax
mov ecx, esi
call fcn.0040932f
cmp byte [ebp + 0x980], bl
je 0x409575
cmp dword [ebp + 0x50], edi
jb 0x409570
mov ecx, dword [ebp + 0x3c]
jmp 0x409577
lea ecx, [ebp + 0x3c]
jmp 0x409577
xor ecx, ecx
cmp dword [ebp + 0x6c], edi
mov eax, dword [ebp + 0x58]
jae 0x409582
lea eax, [ebp + 0x58]
push ebx
push ecx
push eax
mov ecx, esi
call fcn.0040932f
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x38]
jmp 0x409679
push str.ChangeWinFirewallException_is_Vista_compatible__set_to__d_____
call fcn.004140dd
pop ecx
pop ecx
push 0x104
lea eax, [ebp + 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x409681
push str._netsh.exe
lea ecx, [ebp - 0x2c]
call fcn.00405078
mov byte [ebp - 4], 5
push eax
lea eax, [ebp + 0x870]
push eax
lea eax, [ebp]
push eax
call fcn.00408caf
add esp, 0xc
mov byte [ebp - 4], 7
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004049c1
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x38]
push str.Instant_Support_Desk_Service
push eax
call fcn.00408caf
add esp, 0xc
mov byte [ebp - 4], 8
cmp byte [ebp + 0x980], bl
mov edx, str.advfirewall_firewall_add_rule_name__s__program__s__dirin_actionallow
jne 0x40961d
mov edx, str.advfirewall_firewall_delete_rule_name__s__program__s_
mov ecx, dword [ebp + 0x58]
push 0x10
pop edi
cmp dword [ebp + 0x6c], edi
jae 0x40962b
lea ecx, [ebp + 0x58]
cmp dword [ebp + 0x50], edi
mov eax, dword [ebp + 0x3c]
jae 0x409636
lea eax, [ebp + 0x3c]
push ecx
push eax
push edx
lea eax, [ebp + 0x70]
push eax
call fcn.00417806
mov eax, dword [ebp + 4]
add esp, 0x10
cmp dword [ebp + 0x18], edi
jae 0x409650
lea eax, [ebp + 4]
push ebx
push ebx
lea ecx, [ebp + 0x70]
push ecx
push eax
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 7
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.004049c1
mov byte [ebp - 4], 1
lea ecx, [ebp]
push ebx
push 1
call fcn.004049c1
cmp byte [ebp + 0x984], bl
je 0x40968d
mov byte [esi + 5], 1
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.004049c1
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.004049c1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x974]
xor ecx, ebp
call fcn.00414b1e
add ebp, 0x978
leave
ret 8