Function at 0x465e40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c468
mov eax, dword fs:[0]
push eax
sub esp, 0x184
mov eax, dword [0x613384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x188], eax
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x184], ecx
lea esi, [ecx + 4]
mov dword [ebp - 0x15c], 0
sub eax, esi
mov dword [ebp - 0x158], 0
sar eax, 2
lea ecx, [ebp - 0x15c]
lea eax, [eax + eax*4]
shl eax, 2
push eax
call fcn.00449300
mov dword [ebp - 4], 0
cmp esi, ebx
je 0x465ed8
nop
push dword [esi]
lea eax, [ebp - 0x15c]
push eax
call fcn.00448070
add esi, 4
add esp, 8
cmp esi, ebx
jne 0x465ec0
mov esi, dword [ebp - 0x15c]
push 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
call fcn.0054454b
push dword [ebp - 0x15c]
mov dword [ebp - 0x190], esi
call fcn.0054454b
mov ebx, dword [ebp - 0x184]
push esi
mov dword [ebp - 4], 1
push dword [ebx]
push edi
push str.Launching_via_shell__s__s__s
push 0x617858
call fcn.00406750
add esp, 0x1c
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x17c], 0
mov byte [ebp - 0x178], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push esi
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 2
call fcn.00481da0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
mov byte [ebp - 0x16c], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push dword [ebx]
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 4
call fcn.00481da0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov byte [ebp - 0x160], 0
push 1
push 0xffffffffffffffff
push 0xfde9
push edi
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 6
call fcn.00481da0
mov ecx, dword [ebp - 0x188]
xor eax, eax
cmp byte [ecx + 0x2c], al
setne al
push eax
push 0
push dword [ebp - 0x17c]
push dword [ebp - 0x170]
push dword [ebp - 0x164]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp byte [ebp - 0x160], 0
mov ecx, dword [ebp - 0x164]
mov byte [ebp - 4], 7
je 0x466026
test ecx, ecx
je 0x466026
mov eax, dword [ebp - 0x168]
add eax, eax
push eax
push ecx
call fcn.0045fa10
mov ecx, dword [ebp - 0x164]
add esp, 8
push ecx
call fcn.0054454b
add esp, 4
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
cmp byte [ebp - 0x16c], 0
mov ecx, dword [ebp - 0x170]
mov byte [ebp - 4], 8
je 0x466072
test ecx, ecx
je 0x466072
mov eax, dword [ebp - 0x174]
add eax, eax
push eax
push ecx
call fcn.0045fa10
mov ecx, dword [ebp - 0x170]
add esp, 8
push ecx
call fcn.0054454b
add esp, 4
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
cmp byte [ebp - 0x178], 0
mov ecx, dword [ebp - 0x17c]
mov byte [ebp - 4], 9
je 0x4660be
test ecx, ecx
je 0x4660be
mov eax, dword [ebp - 0x180]
add eax, eax
push eax
push ecx
call fcn.0045fa10
mov ecx, dword [ebp - 0x17c]
add esp, 8
push ecx
call fcn.0054454b
add esp, 4
mov byte [ebp - 4], 1
cmp ebx, 0x20
jle 0x4660f9
push esi
call fcn.0054454b
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544c5a
mov esp, ebp
pop ebp
ret 4
mov eax, str.runas
nop
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x466120
test cl, cl
je 0x46611c
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x466120
add edi, 2
add eax, 2
test cl, cl
jne 0x466100
xor eax, eax
jmp 0x466125
sbb eax, eax
or eax, 1
test eax, eax
jne 0x46613b
cmp ebx, 5
jne 0x46613b
push esi
call fcn.0054454b
add esp, 4
xor al, al
jmp 0x4660db
push 0x611230
lea ecx, [ebp - 0x15c]
call fcn.00465ab0
push ebx
lea eax, [ebp - 0x18c]
push 0x5b8188
push eax
call fcn.0040c750
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.00412070
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
call fcn.00465da0
mov ecx, dword [ebp - 0x184]
add esp, 0xc
push eax
call fcn.0042c980
push eax
push str.ShellExecute__s___s__failed___s_
lea eax, [ebp - 0x154]
push 0
push eax
call fcn.00439590
add esp, 0x14
lea eax, [ebp - 0x154]
push 0x5f4710
push eax
call fcn.005461fc
int3