Function at 0x4060f0
Capabilities:
Execute command
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408ec6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x178
mov eax, dword [0x40e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.Starting_procedure_to_elevate_to__NT_Authority_System__Privilege._n
call fcn.00401170
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x406176
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_get_current_processs_handle__failed_with_error_no:__d_n
call fcn.00401170
push str.Press_Enter_to_exit
call fcn.00401170
add esp, 0xc
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x120]
push eax
push str.Got_Executable_Path:__s_n
call fcn.00401170
sub esp, 0x10
mov ecx, esp
push 0x3a
push str.Enter_PsExec.exe_PsExec64.exe_path__Including_File_Name_:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00401800
lea ecx, [ebp - 0x150]
call fcn.00406510
add esp, 0x18
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x140]
test ecx, ecx
jne 0x406215
push 0x1b
push str.S:_ShellScript_PsExec64.exe
lea ecx, [ebp - 0x150]
call fcn.00401800
cmp dword [ebp - 0x13c], 0x10
lea eax, [ebp - 0x150]
cmovae eax, dword [ebp - 0x150]
push eax
push str.PsExec.exe_path_not_specified__using_default:__s_n
call fcn.00401170
mov ecx, dword [ebp - 0x140]
add esp, 8
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
mov eax, 0x7fffffff
mov byte [ebp - 4], 1
sub eax, ecx
cmp eax, 7
jb 0x406503
cmp dword [ebp - 0x13c], 0x10
lea eax, [ebp - 0x150]
push 7
cmovae eax, dword [ebp - 0x150]
push str.__i__s
push ecx
push eax
push ecx
push dword [ebp - 0x154]
lea ecx, [ebp - 0x16c]
call fcn.00401a80
lea edi, [ebp - 0x120]
mov byte [ebp - 4], 2
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x406280
mov edx, dword [ebp - 0x158]
sub edi, ecx
mov ecx, dword [ebp - 0x15c]
mov eax, edx
sub eax, ecx
push edi
cmp edi, eax
ja 0x4062d5
lea eax, [ecx + edi]
cmp edx, 0x10
mov dword [ebp - 0x15c], eax
lea esi, [ebp - 0x16c]
cmovae esi, dword [ebp - 0x16c]
lea eax, [ebp - 0x120]
add esi, ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + edi], 0
lea eax, [ebp - 0x16c]
jmp 0x4062f5
lea eax, [ebp - 0x120]
mov byte [ebp - 0x154], 0
push eax
push dword [ebp - 0x154]
lea ecx, [ebp - 0x16c]
push edi
call fcn.00405600
movups xmm0, xmmword [eax]
lea ecx, [ebp - 0x138]
movups xmmword [ebp - 0x184], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x184]
push eax
movq qword [ebp - 0x174], xmm0
call fcn.004047f0
mov edx, dword [ebp - 0x170]
cmp edx, 0x10
jb 0x406365
mov ecx, dword [ebp - 0x184]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40635b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406395
push edx
push ecx
call fcn.00407c98
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x158]
cmp edx, 0x10
jb 0x4063a5
mov ecx, dword [ebp - 0x16c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40639b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40639b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407c98
add esp, 8
cmp dword [ebp - 0x124], 0x10
lea eax, [ebp - 0x138]
cmovae eax, dword [ebp - 0x138]
push eax
push str.Constructed_command:__s_n
call fcn.00401170
push str.Executing_Command...
call fcn.00401170
add esp, 0xc
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x124], 0x10
cmovae eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
sub esp, 0x14
mov ecx, esp
push 0x17
push str.Press_Enter_to_continue
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00401800
lea ecx, [ebp - 0x184]
call fcn.00406510
mov edx, dword [ebp - 0x170]
add esp, 0x18
cmp edx, 0x10
jb 0x406458
mov ecx, dword [ebp - 0x184]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40644e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40644e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407c98
add esp, 8
mov edx, dword [ebp - 0x124]
cmp edx, 0x10
jb 0x40648e
mov ecx, dword [ebp - 0x138]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406484
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4064d5
push edx
push ecx
call fcn.00407c98
add esp, 8
mov edx, dword [ebp - 0x13c]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
cmp edx, 0x10
jb 0x4064e5
mov ecx, dword [ebp - 0x150]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4064db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4064db
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407c98
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00407a06
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00401300
int3