Function at 0x417390
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51a2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x56c36c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x188], eax
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x184], ecx
lea esi, [ecx + 4]
mov dword [ebp - 0x15c], 0
sub eax, esi
mov dword [ebp - 0x158], 0
sar eax, 2
lea ecx, [ebp - 0x15c]
lea eax, [eax + eax*4]
shl eax, 2
push eax
call fcn.00407640
mov dword [ebp - 4], 0
cmp esi, ebx
je 0x417428
nop
push dword [esi]
lea eax, [ebp - 0x15c]
push eax
call fcn.00416cd0
add esi, 4
add esp, 8
cmp esi, ebx
jne 0x417410
mov esi, dword [ebp - 0x15c]
push 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
call fcn.0047f232
push dword [ebp - 0x15c]
mov dword [ebp - 0x190], esi
call fcn.0047f232
mov ebx, dword [ebp - 0x184]
push esi
mov dword [ebp - 4], 1
push dword [ebx]
push edi
push str.Launching_via_shell__s__s__s
push 0x570e9c
call fcn.004172b0
add esp, 0x1c
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0
mov byte [ebp - 0x178], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push esi
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 2
call fcn.0042a7b0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
mov byte [ebp - 0x16c], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebx]
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 4
call fcn.0042a7b0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov byte [ebp - 0x160], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push edi
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 6
call fcn.0042a7b0
mov ecx, dword [ebp - 0x188]
xor eax, eax
cmp byte [ecx + 0x2c], al
setne al
push eax
push 0
push dword [ebp - 0x17c]
push dword [ebp - 0x170]
push dword [ebp - 0x164]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp byte [ebp - 0x160], 0
mov ecx, dword [ebp - 0x164]
mov byte [ebp - 4], 7
je 0x417576
test ecx, ecx
je 0x417576
mov eax, dword [ebp - 0x168]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x164]
add esp, 8
push ecx
call fcn.0047f232
add esp, 4
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
cmp byte [ebp - 0x16c], 0
mov ecx, dword [ebp - 0x170]
mov byte [ebp - 4], 8
je 0x4175c2
test ecx, ecx
je 0x4175c2
mov eax, dword [ebp - 0x174]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x170]
add esp, 8
push ecx
call fcn.0047f232
add esp, 4
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
cmp byte [ebp - 0x178], 0
mov ecx, dword [ebp - 0x17c]
mov byte [ebp - 4], 9
je 0x41760e
test ecx, ecx
je 0x41760e
mov eax, dword [ebp - 0x180]
add eax, eax
push eax
push ecx
call fcn.00408000
mov ecx, dword [ebp - 0x17c]
add esp, 8
push ecx
call fcn.0047f232
add esp, 4
mov byte [ebp - 4], 1
cmp ebx, 0x20
jle 0x417649
push esi
call fcn.0047f232
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047f941
mov esp, ebp
pop ebp
ret 4
mov eax, str.runas
nop
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x417670
test cl, cl
je 0x41766c
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x417670
add edi, 2
add eax, 2
test cl, cl
jne 0x417650
xor eax, eax
jmp 0x417675
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41768b
cmp ebx, 5
jne 0x41768b
push esi
call fcn.0047f232
add esp, 4
xor al, al
jmp 0x41762b
push 0x56c050
lea ecx, [ebp - 0x15c]
call fcn.00416fa0
push ebx
lea eax, [ebp - 0x18c]
push 0x52c448
push eax
call fcn.00402670
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.004171b0
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
call fcn.004172f0
mov ecx, dword [ebp - 0x184]
add esp, 0xc
push eax
call fcn.004172e0
push eax
push str.ShellExecute__s___s__failed___s_
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.00409fd0
add esp, 0x14
lea eax, [ebp - 0x154]
push 0x558f70
push eax
call fcn.00480e30
int3