Function at 0x4734ce
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004ea000
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], eax
call fcn.00460ca6
test eax, eax
mov ecx, str.runas
cmovne ecx, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
call fcn.004603c8
test al, al
je 0x473535
test al, 0x89
nop
scasd eax, dword es:[edi]
cmp al, 0x41
mov dword [edx + ebx*8 + 0x14], ebx
mov esi, 0xcc45ecc0
lea eax, [ebp - 0x3c]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x47354d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x473592
call fcn.0046033e
test al, al
je 0x473569
repe scasb al, byte es:[edi]
mov bl, 0x59
in al, 0xd5
imul eax, esp, 0x22911d85
push esi
push 0xaf969856
or al, 0xe8
xchg esp, eax
retf 0xfffe
call fcn.00460002
test al, al
je 0x47358f
mov bl, 0x6b
fcom qword [ebx - 0x67]
pop ebp
adc dword [eax], ecx
jae 0x4735df
sub edi, dword [eax + 0x6fbfc5f1]
enter 0x339a, 0x65
fpatan
test al, 0xd8
test eax, 0xfb28f00
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, al
je 0x4735fd
mov ebx, 0xdeca32c8
invalid
call fcn.0045ffbd
test al, al
je 0x47361c
xor dword [eax + 0x44734bfe], ecx
invalid
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x7c], esi
call fcn.004602f9
test al, al
je 0x47363f
cdq
shr byte [ebx + eax*8], 1
invalid
push str.explorer.exe
call fcn.004739b6
pop ecx
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
push 8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x473765
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], esi
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 1
push dword [ebp - 0x7c]
call esi
cmp dword [ebp - 0x80], 0
je 0x473808
push dword [ebp - 0x80]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x473802
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x80]
push ebx
push 1
push dword [ebp - 0x7c]
call esi
test eax, eax
je 0x47374f
mov eax, dword [ebx]
push 0x14
pop ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x94], eax
push ecx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
call fcn.0046008c
test al, al
je 0x473718
dec dword [ebp - 0x9b73]
call dword [ecx - 0x73]
lea esi, [edi + edi*8 - 1]
dec dword [ecx - 0x937b]
call dword [ecx - 0x73]
dec ebp
enter 0xffffffffffff8d51, 0xffffffffffffff8d
jo 0x4736e6
invalid
invalid
jl 0x4736ca
pop es
push 0x15bb7cf2
je 0x473773
test al, 0xc1
dec edi
cli
cmp dword [esi - 0x2d521f4f], 0xffffffa9
sal eax, 0x68
invalid
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x47374f
push str.ConvertSidToStringSidW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x473748
lea ecx, [ebp - 0x84]
push ecx
push dword [ebp - 0x94]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x7c], 0
je 0x473765
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x473770
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x84]
test esi, esi
je 0x47379e
invalid
xor eax, eax
cmp word [esi], ax
je 0x473788
push esi
call fcn.004f2ba9
pop ecx
push eax
push esi
lea ecx, [ebp - 0x78]
call fcn.00420aa0
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00460002
test al, al
je 0x4737be
lea ebp, [eax]
xchg ecx, eax
mov bh, 0x4c
mov eax, dword [0xb51c9547]
into
jp 0x4737c0
add dh, byte [ebx + 0x7539afa6]
cmp ebp, ecx
test bh, dh
call fcn.004601e5
test al, al
je 0x4737da
retf 0xfffe
wait
jns 0x473816
jl 0x47381c
clc
cmc
cwde
pop edi
add eax, 0x5d670c14
lahf
iretd
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x78]
push eax
call fcn.00422b50
xor eax, eax
lea ecx, [ebp - 0x78]
push eax
push 1
call fcn.004209e0
mov eax, dword [ebp - 0x88]
call fcn.00458b37
ret
mov ebx, dword [ebp - 0x88]
cmp dword [ebp - 0x7c], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x473819
push dword [ebp - 0x7c]
call esi
test bh, bh
salc
test edi, edi
je 0x473820
add edx, dword [edi - 1]
salc
push edi
call esi
lea eax, [ebp - 0x78]
mov ecx, ebx
push eax
call fcn.00422b50
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.004209e0
mov eax, ebx
jmp 0x4737fc