Function at 0x486c3e
Capabilities:
Check os version

Disassembly:
push 0x154
mov eax, 0x50ea77
call fcn.005060cc
mov dword [ebp - 0xd4], ecx
and dword [ebp - 4], 0
xor edi, edi
inc edi
cmp dword [0xd5b274], 0
jne 0x486caa
push 0x90
lea eax, [ebp - 0xbc]
mov dword [0xd5b274], edi
push 0
push eax
mov dword [ebp - 0xc0], 0x94
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
imul eax, dword [ebp - 0xbc], 0xa
add eax, dword [ebp - 0xb8]
mov dword [0xd5b270], eax
jmp 0x486caf
mov eax, dword [0xd5b270]
or ebx, 0xffffffff
cmp eax, 0x3c
jl 0x48728a
call fcn.00426031
test eax, eax
je 0x48728a
cmp dword [0xd5c098], 0
jne 0x486cee
mov edx, edi
mov dword [0xd5c098], edi
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], str.SeIncreaseQuotaPrivilege
call fcn.0042627e
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
je 0x48728a
and dword [ebp - 0xd8], 0
lea ecx, [ebp - 0xd8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0xd8], 0
je 0x48728a
push dword [ebp - 0xd8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x104], esi
test esi, esi
je 0x48728a
and dword [ebp - 0xd0], 0
lea eax, [ebp - 0xd0]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
mov eax, dword [ebp - 0xd0]
je 0x48726d
test eax, eax
je 0x48726d
and dword [ebp - 0xc8], 0
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 4
push ecx
push edi
push 2
push 0
push 0x18b
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
mov eax, dword [ebp - 0xc8]
je 0x487251
test eax, eax
je 0x487251
push 0x40
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x160], 0x44
push 0
push eax
call fcn.004f1a90
mov dword [ebp - 0x134], edi
xor eax, eax
mov word [ebp - 0x130], ax
lea edi, [ebp - 0x114]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00409736
push eax
lea ecx, [ebp - 0xcc]
call fcn.0040953f
push 0x55b71c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.004094e6
push str.BELOWNORMAL
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.004094e6
push str.NORMAL
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.004094e6
push str.ABOVENORMAL
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.004094e6
push str.HIGH
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.004094e6
push str.REALTIME
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.004094e6
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0xd4]
cmp eax, 2
je 0x486f0c
cmp eax, 5
ja 0x486f0c
lea ecx, [ebp - 0x28]
mov edx, 0x55b754
lea eax, [ecx + eax*4]
push eax
lea ecx, [ebp - 0xc4]
call fcn.004143d7
pop ecx
mov byte [ebp - 4], 0xc
mov edx, dword [eax]
mov edi, dword [ebp - 0xcc]
add edi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x486eeb
cmp dword [edi + 0xc], 0
jl 0x486edc
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x486edc
call fcn.004098e7
mov dword [ebp - 0xd4], eax
lea edx, [edi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x486ed1
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xd4]
add eax, 0x10
mov dword [ebp - 0xcc], eax
jmp 0x486eeb
push dword [edx - 0xc]
lea ecx, [ebp - 0xcc]
push edx
call fcn.0040942f
mov byte [ebp - 4], 0xb
mov eax, ebx
mov edx, dword [ebp - 0xc4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x486f0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xd4]
call fcn.00423842
push str.cmd.exe
mov edx, eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe0]
call fcn.00405cb9
pop ecx
mov byte [ebp - 4], 0xf
mov eax, ebx
mov edx, dword [ebp - 0xd4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x486f4f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._C_start__
lea ecx, [ebp - 0xf8]
call fcn.004094e6
push 0x51e630
mov edx, eax
mov byte [ebp - 4], pe_nt_image_headers32
lea ecx, [ebp - 0xf4]
call fcn.00405cb9
pop ecx
mov edi, 0x553e84
mov byte [ebp - 4], 0x11
push edi
mov edx, eax
lea ecx, [ebp - 0xf0]
call fcn.00405cb9
pop ecx
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x12
push ecx
mov edx, eax
lea ecx, [ebp - 0xec]
call fcn.0040a740
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xe8]
mov edx, eax
mov dword [esp], 0x55a208
call fcn.00405cb9
pop ecx
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x14
push ecx
mov edx, eax
lea ecx, [ebp - 0xe4]
call fcn.0040a740
pop ecx
push edi
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xdc]
call fcn.00405cb9
pop ecx
mov byte [ebp - 4], 0x17
mov eax, ebx
mov edx, dword [ebp - 0xe4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487009
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x18
mov eax, ebx
mov edx, dword [ebp - 0xe8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48702a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x19
mov eax, ebx
mov edx, dword [ebp - 0xec]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48704b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1a
mov eax, ebx
mov edx, dword [ebp - 0xf0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48706c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1b
mov eax, ebx
mov edx, dword [ebp - 0xf4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48708d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1c
mov eax, ebx
mov edx, dword [ebp - 0xf8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4870ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x487102
lea eax, [ebp + 0xc]
mov edx, 0x51e5b0
push eax
lea ecx, [ebp - 0xfc]
call fcn.004143d7
pop ecx
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xdc]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0040a860
mov byte [ebp - 4], 0x1c
mov eax, ebx
mov edx, dword [ebp - 0xfc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487102
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x487124
push eax
call fcn.004f5d90
pop ecx
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x48712d
and dword [ebp - 0xc4], 0
jmp 0x48714b
lea eax, [edi + edi]
call fcn.004f0800
mov edx, dword [ebp - 0xc4]
mov ecx, esp
push 0
push edi
call fcn.00407760
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x100], eax
test eax, eax
je 0x48716d
push eax
call fcn.004f5d90
pop ecx
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jle 0x487171
xor eax, eax
jmp 0x487189
lea eax, [edi + edi]
call fcn.004f0800
mov edx, dword [ebp - 0x100]
mov ecx, esp
push 0
push edi
call fcn.00407760
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x160]
push ecx
mov ecx, dword [ebp - 0xc8]
sub esp, 0xc
push dword [ebp - 0xc4]
push eax
call fcn.00486b33
add esp, 0x1c
test eax, eax
jne 0x4871b7
xor edi, edi
jmp 0x4871d0
push dword [ebp - 0x110]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x114]
call edi
xor edi, edi
inc edi
mov byte [ebp - 4], 0xf
mov eax, ebx
mov edx, dword [ebp - 0xdc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4871f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov eax, ebx
mov edx, dword [ebp - 0xe0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487212
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push fcn.0040981b
push 6
push 4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.004f046e
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0xcc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x487249
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc8]
jmp 0x487253
xor edi, edi
test eax, eax
je 0x487265
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xd0]
jmp 0x48726f
xor edi, edi
test eax, eax
je 0x487281
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0xd0], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48728c
xor edi, edi
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4872aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4872c5
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
lea esp, [ebp - 0x170]
call fcn.00506076
ret