Function at 0x414a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
push str._SIBTool_4_bcyj
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push str.__admin6464
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x414c0d
test edi, edi
je 0x414af4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret 0x10
push str._SIBTool_4_bcyj
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x414adf
xorps xmm0, xmm0
mov dword [ebp - 0x510], 0
push 0x104
lea eax, [ebp - 0x20c]
movlpd qword [ebp - 0x544], xmm0
push eax
push ebx
movlpd qword [ebp - 0x538], xmm0
movlpd qword [ebp - 0x530], xmm0
movlpd qword [ebp - 0x528], xmm0
movlpd qword [ebp - 0x520], xmm0
movlpd qword [ebp - 0x518], xmm0
mov dword [ebp - 0x548], 0x3c
mov dword [ebp - 0x53c], str.runas
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x534], str.__admin6464
mov dword [ebp - 0x538], eax
lea eax, [ebp - 0x548]
push eax
mov dword [ebp - 0x52c], 0xa
mov dword [ebp - 0x544], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x510], 0
je 0x414adf
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_ResetEvent]
nop
push 0x64
push esi
call edi
cmp eax, 0x102
jne 0x414c03
push 0xa
push dword [ebp - 0x510]
call edi
cmp eax, 0x102
je 0x414bc0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x510]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret 0x10
call fcn.00411200
push esi
call ebx
jmp 0x414bc0
test edi, edi
je 0x414adf
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x50c], 8
push eax
mov dword [ebp - 0x508], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov esi, dword [0x431020]
mov ecx, dword [0x431024]
mov dword [0x43211c], 0
cmp esi, ecx
jae 0x414c80
mov eax, dword [esi]
test eax, eax
je 0x414c79
mov eax, dword [eax + 0x1c]
push 1
call eax
mov ecx, dword [0x431024]
add esi, 4
cmp esi, ecx
jb 0x414c66
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
push 0xc
mov dword [0x432120], eax
mov dword [0x432124], 0
call fcn.0041554d
add esp, 4
test eax, eax
je 0x414cca
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [0x432124], eax
mov dword [0x432128], 0
jmp 0x414cd4
mov dword [0x432124], 0
lea ecx, [ebp - 0x504]
call fcn.004119d0
mov dword [ebp - 0x210], edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebx, eax
mov eax, dword [ebp - 0x4f0]
test eax, eax
jne 0x414d1a
call fcn.00416035
mov dword [ebp - 0x4f0], eax
test eax, eax
jne 0x414d1a
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x508], 0xffffffff
jmp 0x414d83
push 0
push 0
push eax
call fcn.00416137
lea eax, [ebp - 0x504]
mov dword [ebp - 0x4fc], eax
call esi
push 0x431044
mov dword [ebp - 0x4f8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x43105c]
mov dword [ebp - 0x4f4], eax
lea eax, [ebp - 0x4fc]
push 0x431044
mov dword [0x43105c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0x40ca30
push ebx
push 0x81
push dword [0x432498]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x4f0]
test ecx, ecx
je 0x414d93
push ecx
call fcn.004160e1
mov ebx, dword [0x4320cc]
add ebx, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x432128]
test esi, esi
je 0x414df5
cmp dword [esi + 4], 0
jle 0x414dc3
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [0x432128]
test esi, esi
je 0x414df5
mov eax, dword [esi]
test eax, eax
je 0x414ddc
push eax
call fcn.00419068
add esp, 4
mov dword [esi], 0
push 0xc
push esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00414edd
add esp, 8
push ebx
mov dword [0x432128], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x432124]
test esi, esi
je 0x414e4e
mov eax, dword [esi]
test eax, eax
je 0x414e25
push eax
call fcn.00419068
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x414e3c
push eax
call fcn.00419068
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
mov dword [esi + 8], 0
call fcn.00414edd
add esp, 8
mov ecx, 0x4320f0
call fcn.004141c0
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x508]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00414e7e
mov esp, ebp
pop ebp
ret 0x10