Function at 0x4562c9
Capabilities:
Check os version
Create process on windows
Get hostname
Get session user name
Terminate process

Disassembly:
push 0x3d0
mov eax, 0x4de524
call fcn.004b6799
lea eax, [ebp - 0x29c]
mov ebx, ecx
call fcn.00455a1f
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0049219b
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00402802
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.004b62d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4564ab
call fcn.004075f5
cmp eax, edi
jne 0x456449
call fcn.0045c16c
cmp eax, 6
jae 0x45638d
push edi
push 0x10
push 0x52dc10
push ecx
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x540f88
call fcn.0040254f
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 3
jmp 0x456414
mov eax, dword [0x57805c]
push 1
mov esi, 0x52dc10
push esi
push str.arovistaschedule
push dword [eax]
push str.runas
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jl 0x4563d2
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.ExitProcess_:_Elevated_now_restarting
call fcn.0040254f
call fcn.0044d3b2
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push 0x10
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push 0x540f88
call fcn.0040254f
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 5
push dword [eax]
call fcn.00491d70
mov ecx, dword [ebp - 0x3c0]
add ecx, 0xfffffff0
call fcn.00402845
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebp - 0x29c]
call fcn.00455a95
xor al, al
jmp 0x4567eb
call fcn.00456028
test al, al
jne 0x4564ab
call fcn.00456098
test al, al
jne 0x4564ab
cmp byte [ebp + 8], al
jne 0x456429
push edi
push 0x40
push 0x52dc10
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.IDS_SERVICENORUN
call fcn.0040254f
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 7
jmp 0x456414
mov eax, dword [0x57805c]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x4564b8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040272d
cmp byte [0x57a03b], 0
je 0x4564e9
push str._default
jmp 0x4564fb
cmp byte [ebp + 8], 0
je 0x4564f6
push str._updatecheck
jmp 0x4564fb
push str.scan
lea ecx, [ebp - 0x3b8]
call fcn.0040272d
lea ecx, [ebp - 0x3b8]
call fcn.00407348
push eax
lea ecx, [ebp - 0x260]
call fcn.0040272d
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.004123c7
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebx + 0x24]
call fcn.00442a8f
lea esi, [ebp - 0x3dc]
lea edi, [ebp - 0x298]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x28c], ax
mov word [ebp - 0x28a], ax
lea eax, [ebp - 0x3b4]
push eax
mov dword [ebp - 0x3b4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x3b0], 5
mov esi, 0x100
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x3c8], esi
lea ecx, [ebp - 0x3b8]
push eax
jb 0x4565a1
push esi
call fcn.00442894
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
jmp 0x4565eb
push 0x104
mov dword [ebp - 0x3c8], esi
call fcn.00442894
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x3c8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00407348
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x3b8]
call fcn.00407348
push eax
lea ecx, [ebp - 0x258]
call fcn.0040272d
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.004123c7
lea ecx, [ebx + 0x14]
mov dword [ebp - 0x3c0], ecx
call fcn.00407348
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040272d
mov eax, dword [ebx + 0x30]
xor esi, esi
sub eax, esi
je 0x456714
dec eax
je 0x456704
dec eax
je 0x4566c5
dec eax
je 0x456692
push esi
push 0x10
push 0x52dc10
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.IDS_NEWTASKERROR
call fcn.0040254f
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 9
jmp 0x456414
add ebx, 0x38
push 4
pop edi
cmp ebx, esi
je 0x456717
lea eax, [ebp - 0x243]
xor ecx, ecx
sub ebx, eax
lea eax, [ebp + ecx - 0x243]
cmp byte [ebx + eax], 1
jne 0x4566bd
mov byte [eax], 1
mov byte [ebp - 0x244], 1
inc ecx
cmp ecx, 0x1f
jl 0x4566a6
jmp 0x456717
push 3
lea eax, [ebx + 0x38]
pop edi
mov dword [ebp - 0x3bc], edi
cmp eax, esi
je 0x456707
xor edx, edx
push 7
inc edx
pop esi
cmp byte [eax], 1
jne 0x4566fd
movzx ecx, dx
cmp dx, 7
jne 0x4566eb
xor ecx, ecx
xor edi, edi
inc edi
shl edi, cl
add word [ebp - 0x246], di
mov edi, dword [ebp - 0x3bc]
inc eax
inc edx
dec esi
jne 0x4566db
jmp 0x456707
push 2
pop edi
mov ax, word [ebx + 0x34]
mov word [ebp - 0x248], ax
jmp 0x456717
xor edi, edi
inc edi
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x268], edi
call fcn.00455b3f
cmp eax, 0x80070050
jne 0x4567f3
cmp byte [0x57a03b], 0
jne 0x4567af
cmp byte [ebp + 8], 0
jne 0x4567af
push esi
push 0x24
push 0x52dc10
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.IDS_FILEEXIST
call fcn.0040254f
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 0xb
push dword [eax]
call fcn.00491d70
cmp eax, 6
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3bc]
sete bl
add ecx, 0xfffffff0
call fcn.00402845
test bl, bl
je 0x456429
mov ecx, dword [ebp - 0x3c0]
call fcn.00407348
push eax
call fcn.00455efd
pop ecx
test eax, eax
jl 0x4567d0
lea eax, [ebp - 0x29c]
call fcn.00455b3f
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.00402845
lea ecx, [ebp - 0x29c]
call fcn.00455a95
mov al, 1
call fcn.004b681c
ret 4
cmp eax, 0x80070005
jne 0x456852
push esi
push 0x40
push 0x52dc10
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x540f88
call fcn.0040254f
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 0xd
push dword [eax]
call fcn.00491d70
mov ecx, dword [ebp - 0x3bc]
jmp 0x456421
cmp eax, 0x8007007b
jne 0x4568a1
push esi
push 0x40
push 0x52dc10
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.IDS_VALIDFILE
call fcn.0040254f
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 0xf
jmp 0x456840
cmp eax, esi
jge 0x4567d0
push esi
push 0x10
push 0x52dc10
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040254f
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.IDS_NEWTASKERROR
call fcn.0040254f
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406eff
mov byte [ebp - 4], 0x11
jmp 0x456840