Function at 0x475bd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6828e6
mov eax, dword fs:[0]
push eax
mov eax, 0x1138
call fcn.006122b0
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
sub esp, 8
lea ecx, [ebp - 0x1144]
call fcn.00472b00
mov edx, 0x76903c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1134]
call fcn.0046dbb0
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x475c35
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, eax
call fcn.00473400
add esp, 4
mov edx, 0x76b520
mov ecx, eax
call fcn.0046dbb0
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x475c58
mov edx, dword [edi]
push dword [edi + 0x10]
mov ecx, eax
call fcn.00473400
add esp, 4
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x112c]
push eax
call fcn.0046fb40
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00464990
mov byte [ebp - 4], 2
mov edx, dword [0x7aa7c8]
test edx, edx
je 0x475cba
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
mov eax, dword [edx]
cmovae ecx, dword [ebp - 0x2c]
push ecx
push str.ACTION_StartElevated___s_
push edx
call dword [eax + 4]
mov ecx, dword [0x7aa7c8]
add esp, 0xc
test ecx, ecx
je 0x475cba
mov eax, dword [ecx]
call dword [eax + 8]
push 0x38
lea eax, [ebp - 0x1090]
mov dword [ebp - 0x1094], 0x3c
push 0
push eax
call fcn.0064cf50
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ebp - 0x1090]
mov ebx, ecx
and ebx, 1
mov dword [ebp - 0x1088], str.runas
mov edx, 0x40
cmovne eax, edx
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x1090], eax
jb 0x475d05
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x1084], esi
jb 0x475d13
mov edi, dword [edi]
mov eax, dword [ebp - 0x1078]
test cl, 4
mov ecx, 1
mov dword [ebp - 0x1080], edi
cmovne eax, ecx
mov dword [ebp - 0x1078], eax
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x1058], eax
lea eax, [ebp - 0x1094]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x475df5
mov eax, dword [ebp - 0x105c]
test ebx, ebx
je 0x475d67
test eax, eax
je 0x475e21
xor esi, esi
test ebx, ebx
je 0x475d7c
mov ecx, eax
call fcn.004756d0
mov esi, eax
mov eax, dword [ebp - 0x105c]
mov edx, dword [0x7aa7c8]
test edx, edx
je 0x475da7
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
mov eax, dword [edx]
cmovae ecx, dword [ebp - 0x2c]
push esi
push ecx
push str.ACTION_StartElevated_finished___s_:__d_r_n
push edx
call dword [eax + 4]
mov eax, dword [ebp - 0x105c]
add esp, 0x10
test eax, eax
je 0x475dbc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x105c], 0
lea ecx, [ebp - 0x2c]
call fcn.00453390
lea ecx, [ebp - 0x44]
call fcn.00453390
lea ecx, [ebp - 0x1144]
call fcn.00471d90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006116c3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1054]
push str.ShellExecuteEx_failed_with_error__d
push eax
call fcn.00475650
add esp, 0xc
lea eax, [ebp - 0x1054]
push 0x7901f8
push eax
call fcn.0064dbb3
lea eax, [ebp - 0x1054]
push str.sei.hProcess_is_NULL__
push eax
call fcn.004755b0
add esp, 8
lea eax, [ebp - 0x1054]
push 0x7901e8
push eax
call fcn.0064dbb3
int3