Function at 0x4080c0
Capabilities:
Accept command line arguments
Create process on windows
Delete directory
Get token membership
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425480
mov eax, dword fs:[0]
push eax
sub esp, 0x684
mov eax, dword [0x444624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x690]
mov edi, dword [ebp + 8]
push eax
push esi
mov dword [ebp - 0x68c], esi
mov dword [ebp - 0x690], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [ebp - 0x684], ebx
test ebx, ebx
jne 0x408133
call dword [sym.imp.KERNEL32.dll_GetLastError]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, eax
mov eax, ecx
jmp 0x408725
test esi, esi
je 0x408712
cmp word [esi], 0
je 0x408712
cmp dword [ebp - 0x690], 2
jl 0x408712
push 0x104
lea eax, [ebp - 0x420]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4086fd
cmp eax, 0x104
ja 0x4086fd
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push 0x426878
push dword [ebx]
call esi
test eax, eax
jne 0x408190
lea edi, [eax + 1]
jmp 0x4081c7
push 0x426880
push dword [ebx]
call esi
test eax, eax
je 0x4081c2
push 0x426888
push dword [ebx]
call esi
test eax, eax
je 0x4081c2
push ebx
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x57
jmp 0x408725
mov edi, 2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x408743
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x640]
mov dword [ebp - 0x688], 0
push eax
mov dword [ebp - 0x640], 0
mov word [ebp - 0x63c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
or esi, 0xffffffff
test eax, eax
je 0x40824b
lea eax, [ebp - 0x688]
push eax
push dword [ebp - 0x680]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x40824b
push 0
jmp 0x408259
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, esi
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x680]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test eax, eax
sete cl
test eax, eax
je 0x40827c
xor eax, eax
test cl, cl
je 0x408276
mov dword [eax], eax
cmp dword [ebp - 0x688], 0
jne 0x40841e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x4082ae
call edi
mov esi, eax
push ebx
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x408725
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004140a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jbe 0x4082ee
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x408409
lea eax, [ebp - 0x218]
mov dword [ebp - 0x67c], 0x3c
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x668], eax
xor eax, eax
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], eax
lea eax, [ebp - 0x67c]
push eax
mov dword [ebp - 0x678], 0x540
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], str.runas
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x408402
mov esi, dword [ebp - 0x644]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push esi
call edi
test eax, eax
je 0x4083b2
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4083b2
push eax
push esi
call edi
test eax, eax
je 0x4083b2
lea ecx, [ecx]
jmp 0x4083b0
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x408400
cmp dword [ebp - 0x680], 0x103
je 0x408400
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne cl
test eax, eax
jne 0x4083f6
lea ebx, [ebx]
test cl, cl
je 0x4083f0
mov dword [eax], eax
mov esi, dword [ebp - 0x680]
jmp 0x408409
jmp 0x408400
call edi
test eax, eax
cmovne esi, eax
push ebx
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x408725
mov eax, dword [ebp - 0x68c]
push ebx
push dword [ebp - 0x690]
push dword [ebx + 4]
push edi
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00406300
mov eax, dword [ebp - 0x690]
add esp, 0x18
shl eax, 2
mov esi, ebx
mov dword [ebp - 0x688], eax
add eax, ebx
cmp ebx, eax
je 0x40848c
mov ebx, eax
jmp 0x408460
push dword [esi]
mov dword [ebp - 4], 5
push 0x426890
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x408486
add esi, 4
cmp esi, ebx
jne 0x408460
mov ebx, dword [ebp - 0x684]
mov eax, dword [ebp - 0x688]
xor ecx, ecx
add eax, ebx
cmp eax, esi
setne cl
push ecx
push dword [ebx + 4]
push edi
call fcn.00406610
mov esi, eax
mov eax, dword [ebx + 4]
push 0x426800
mov dword [ebp - 0x688], esi
mov dword [ebp - 0x684], eax
call fcn.004046b0
push str.kvpuins
call fcn.004046b0
add esp, 0x14
cmp edi, 2
jne 0x408655
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x638], str.setup.vbs
mov dword [ebp - 0x634], 0x426848
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], 0x4266e4
call fcn.00404c90
mov dword [ebp - 0x684], eax
lea ecx, [ebp - 0x670]
lea eax, [ebp - 0x684]
push eax
call fcn.00401240
mov eax, dword [ebp - 0x648]
test eax, eax
je 0x408601
push str.3kvpuni
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x4085fb
xor esi, esi
jmp 0x408550
push dword [ebp + esi*4 - 0x638]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x408585
lea eax, [ebp - 0x628]
push eax
call fcn.00406a80
add esp, 4
inc esi
cmp esi, 4
jb 0x408550
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x648]
mov dword [ebp - 4], 7
test eax, eax
je 0x4085c9
mov ecx, dword [ebp - 0x64c]
mov dword [ebp - 0x68c], eax
test ecx, ecx
je 0x40874d
mov eax, dword [ecx]
lea edx, [ebp - 0x68c]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x64c]
test ecx, ecx
je 0x4085e6
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x670]
cmp ecx, eax
setne al
push eax
call edx
mov esi, dword [ebp - 0x688]
and edi, 1
mov dword [ebp - 4], 0xffffffff
jmp 0x40869a
mov eax, dword [ebp - 0x648]
mov dword [ebp - 4], 6
test eax, eax
je 0x40862c
mov ecx, dword [ebp - 0x64c]
mov dword [ebp - 0x684], eax
test ecx, ecx
je 0x408752
mov eax, dword [ecx]
lea edx, [ebp - 0x684]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x64c]
test ecx, ecx
je 0x408649
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x670]
cmp ecx, eax
setne al
push eax
call edx
mov dword [ebp - 4], 0xffffffff
and edi, 1
jmp 0x40869a
and edi, 1
je 0x40869a
test esi, esi
jne 0x408662
xor eax, eax
jmp 0x40868f
cmp esi, 0xbb9
je 0x40868a
cmp esi, 0x10a
je 0x40868a
cmp esi, 0x70a
je 0x40868a
xor eax, eax
cmp esi, 0x666
setne al
add eax, 2
jmp 0x40868f
mov eax, 1
push eax
push 0
call fcn.0040f160
add esp, 8
call fcn.0040ea60
test eax, eax
setne cl
test eax, eax
jne 0x4086ae
test cl, cl
je 0x4086a8
mov dword [eax], eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x690], 2
jg 0x4086eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408757
push 0x40
test edi, edi
mov ecx, 0x4268bc
push str.qZ
mov eax, 0x4268b0
cmove eax, ecx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
mov dword [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
jmp 0x408725
push ebx
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x6f
jmp 0x408725
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0x667
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call int.0041284a
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402e30
call fcn.00412550
call fcn.00412550
test edi, edi
mov ecx, 0x4268d4
mov eax, 0x4268c8
cmove eax, ecx
push eax
call fcn.004074c0
int3