Function at 0x45859c
Capabilities:
Check os version
Create process on windows
Get hostname
Get session user name
Terminate process

Disassembly:
push 0x3d0
mov eax, 0x4d54ec
call fcn.004ae269
lea eax, [ebp - 0x29c]
mov ebx, ecx
call fcn.00457ce3
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0048aa29
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00402840
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.004adda0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x45877e
call fcn.0040750e
cmp eax, edi
jne 0x45871c
call fcn.004600e5
cmp eax, 6
jae 0x458660
push edi
push 0x10
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x532600
call fcn.0040255d
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 3
jmp 0x4586e7
mov eax, dword [0x56431c]
push 1
mov esi, 0x520938
push esi
push str.pccpvistaschedule
push dword [eax]
push str.runas
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jl 0x4586a5
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.ExitProcess_:_Elevated_now_restarting
call fcn.0040255d
call fcn.0044e684
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push 0x10
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push 0x532600
call fcn.0040255d
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 5
push dword [eax]
call fcn.0048a5fe
mov ecx, dword [ebp - 0x3c0]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.00402883
lea ecx, [ebp - 0x29c]
call fcn.00457d59
xor al, al
jmp 0x458abe
call fcn.004582fb
test al, al
jne 0x45877e
call fcn.0045836b
test al, al
jne 0x45877e
cmp byte [ebp + 8], al
jne 0x4586fc
push edi
push 0x40
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.S9PT9_26
call fcn.0040255d
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 7
jmp 0x4586e7
mov eax, dword [0x56431c]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x45878b
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040276b
cmp byte [0x5662f5], 0
je 0x4587bc
push str._default
jmp 0x4587ce
cmp byte [ebp + 8], 0
je 0x4587c9
push str._updatecheck
jmp 0x4587ce
push str.scan
lea ecx, [ebp - 0x3b8]
call fcn.0040276b
lea ecx, [ebp - 0x3b8]
call fcn.00407261
push eax
lea ecx, [ebp - 0x260]
call fcn.0040276b
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.00411fca
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebx + 0x24]
call fcn.00442549
lea esi, [ebp - 0x3dc]
lea edi, [ebp - 0x298]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x28c], ax
mov word [ebp - 0x28a], ax
lea eax, [ebp - 0x3b4]
push eax
mov dword [ebp - 0x3b4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x3b0], 5
mov esi, 0x100
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x3c8], esi
lea ecx, [ebp - 0x3b8]
push eax
jb 0x458874
push esi
call fcn.00442359
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
jmp 0x4588be
push 0x104
mov dword [ebp - 0x3c8], esi
call fcn.00442359
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x3c8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00407261
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x3b8]
call fcn.00407261
push eax
lea ecx, [ebp - 0x258]
call fcn.0040276b
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.00411fca
lea ecx, [ebx + 0x14]
mov dword [ebp - 0x3c0], ecx
call fcn.00407261
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040276b
mov eax, dword [ebx + 0x30]
xor esi, esi
sub eax, esi
je 0x4589e7
dec eax
je 0x4589d7
dec eax
je 0x458998
dec eax
je 0x458965
push esi
push 0x10
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.S9PT9_546
call fcn.0040255d
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 9
jmp 0x4586e7
add ebx, 0x38
push 4
pop edi
cmp ebx, esi
je 0x4589ea
lea eax, [ebp - 0x243]
xor ecx, ecx
sub ebx, eax
lea eax, [ebp + ecx - 0x243]
cmp byte [ebx + eax], 1
jne 0x458990
mov byte [eax], 1
mov byte [ebp - 0x244], 1
inc ecx
cmp ecx, 0x1f
jl 0x458979
jmp 0x4589ea
push 3
lea eax, [ebx + 0x38]
pop edi
mov dword [ebp - 0x3bc], edi
cmp eax, esi
je 0x4589da
xor edx, edx
push 7
inc edx
pop esi
cmp byte [eax], 1
jne 0x4589d0
movzx ecx, dx
cmp dx, 7
jne 0x4589be
xor ecx, ecx
xor edi, edi
inc edi
shl edi, cl
add word [ebp - 0x246], di
mov edi, dword [ebp - 0x3bc]
inc eax
inc edx
dec esi
jne 0x4589ae
jmp 0x4589da
push 2
pop edi
mov ax, word [ebx + 0x34]
mov word [ebp - 0x248], ax
jmp 0x4589ea
xor edi, edi
inc edi
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x268], edi
call fcn.00457e03
cmp eax, 0x80070050
jne 0x458ac6
cmp byte [0x5662f5], 0
jne 0x458a82
cmp byte [ebp + 8], 0
jne 0x458a82
push esi
push 0x24
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.S9PT9_488
call fcn.0040255d
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 0xb
push dword [eax]
call fcn.0048a5fe
cmp eax, 6
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3bc]
sete bl
add ecx, 0xfffffff0
call fcn.00402883
test bl, bl
je 0x4586fc
mov ecx, dword [ebp - 0x3c0]
call fcn.00407261
push eax
call fcn.004581d0
pop ecx
test eax, eax
jl 0x458aa3
lea eax, [ebp - 0x29c]
call fcn.00457e03
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.00402883
lea ecx, [ebp - 0x29c]
call fcn.00457d59
mov al, 1
call fcn.004ae2ec
ret 4
cmp eax, 0x80070005
jne 0x458b25
push esi
push 0x40
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x532600
call fcn.0040255d
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 0xd
push dword [eax]
call fcn.0048a5fe
mov ecx, dword [ebp - 0x3bc]
jmp 0x4586f4
cmp eax, 0x8007007b
jne 0x458b74
push esi
push 0x40
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.S9PT9_35
call fcn.0040255d
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 0xf
jmp 0x458b13
cmp eax, esi
jge 0x458aa3
push esi
push 0x10
push 0x520938
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040255d
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.S9PT9_546
call fcn.0040255d
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e18
mov byte [ebp - 4], 0x11
jmp 0x458b13