Function at 0x4d4eb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x654c00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov ecx, 0x700724
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
mov dword [ebp - 0x78], 0x3c
push 0x38
push 0
lea eax, [ebp - 0x74]
push eax
call fcn.006100a0
add esp, 0xc
mov ecx, 1
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
mov ebx, 0x104
sub eax, ebx
or eax, ecx
jge 0x4d4f2b
push ebx
lea ecx, [ebp - 0x14]
call fcn.00401400
mov esi, dword [ebp - 0x14]
cmp dword [esi - 8], ebx
jge 0x4d4f3a
push 0x80070057
call fcn.004011d0
mov dword [esi - 0xc], ebx
xor ecx, ecx
mov word [esi + 0x208], cx
push ebx
push esi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4d4fec
push 0x5c
push esi
call fcn.00613b38
add esp, 8
cmp eax, ebx
je 0x4d4fec
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x4d4fec
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.00414520
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x14]
call fcn.004078d0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d4fb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xe
push str.HotKeySVC.exe
lea ecx, [ebp - 0x14]
call fcn.00401710
mov dword [ebp - 0x6c], str.runas
mov esi, dword [ebp - 0x14]
cmp dword [esi - 4], 1
jle 0x4d4fe0
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401370
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x68], esi
mov edx, dword [edi + 4]
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.004d4570
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 1
jmp 0x4d501b
cmp dword [edi + 0x6c], ebx
je 0x4d5126
cmp eax, ebx
jne 0x4d5106
cmp dword [esi - 0xc], ebx
jle 0x4d5057
mov dword [ebp - 0x64], str.uninstall
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4d5168
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x6c], 1
call fcn.005bc840
mov ebx, 7
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], 0
xor ecx, ecx
mov word [ebp - 0x3c], cx
push 4
push str.HKEN
lea ecx, [ebp - 0x3c]
call fcn.00407940
mov byte [ebp - 4], 6
cmp dword [edi + 0x6c], 0
setne dl
movzx eax, dl
push eax
lea ecx, [ebp - 0x3c]
push ecx
push 1
call fcn.005bc840
mov ecx, eax
call fcn.005bc240
mov byte [ebp - 4], 1
cmp dword [ebp - 0x28], 8
jb 0x4d50b7
mov edx, dword [ebp - 0x3c]
push edx
call fcn.0060faf6
add esp, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], 0
xor eax, eax
mov word [ebp - 0x3c], ax
mov ecx, edi
call fcn.004d4640
mov dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4d50f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi - 0xc], ebx
jle 0x4d5057
mov dword [ebp - 0x6c], 0x66f294
mov dword [ebp - 0x64], str.uninstall
lea ecx, [ebp - 0x78]
push ecx
jmp 0x4d503c
cmp eax, ebx
jne 0x4d5139
cmp dword [esi - 0xc], ebx
jle 0x4d5057
lea edx, [ebp - 0x78]
push edx
jmp 0x4d514d
cmp dword [esi - 0xc], ebx
jle 0x4d5057
mov dword [ebp - 0x6c], 0x66f294
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x64], str.install
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4d5050
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x6c], ebx
jmp 0x4d5057