Function at 0x45a2b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4a3ce1
mov eax, dword fs:[0]
push eax
sub esp, 0x8b4
mov eax, dword [0x4d6720]
xor eax, esp
mov dword [esp + 0x8b0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x8c8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8dc]
mov ecx, dword [esp + 0x8ec]
mov ebp, dword [esp + 0x8d8]
mov esi, dword [esp + 0x8e4]
xor ebx, ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x24], ebx
call fcn.00468b49
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x45a337
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
lea edx, [esp + 0xa4]
push edx
xor ecx, ecx
push 0x208
mov dword [esp + 0x8d8], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0xac], cx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 1
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0x3c]
xor eax, eax
push edx
mov word [esp + 0x4be], ax
call fcn.00443f20
add esp, 0xc
mov byte [esp + 0x8d0], 1
call fcn.00468b49
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x45a3b2
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x8d0], 2
call fcn.00468b49
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x45a3e4
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x8d0], 3
call fcn.00468b49
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x45a416
push 0x80004005
call fcn.00401210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov edi, dword [esp + 0x8e0]
mov byte [esp + 0x8d0], 4
cmp edi, 1
je 0x45a5ca
jle 0x45a5c0
cmp edi, 3
jg 0x45a5c0
mov eax, esi
cmp esi, ebx
jne 0x45a458
mov eax, 0x4a7664
push eax
lea ecx, [esp + 0x18]
call fcn.00403c10
push 0x4baa68
push 0x4ae76c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8d8], 6
call fcn.004066b0
push 0x4a8a44
push 0x4a8a4c
lea ecx, [esp + 0x1c]
call fcn.004066b0
push 0x4baa60
push 0x4a80b8
lea ecx, [esp + 0x1c]
call fcn.004066b0
push 0x4baa58
push 0x4a85d4
lea ecx, [esp + 0x1c]
call fcn.004066b0
push 0x4baa50
push 0x4a8890
lea ecx, [esp + 0x1c]
call fcn.004066b0
push str.wosb_aux_main1_output
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00401b10
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x8d4], 7
call fcn.00401a50
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x8d0], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45a51a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.wosb_aux_sub1_output
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00401b10
add esp, 0xc
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x8d4], 8
call fcn.00401a50
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x8d0], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45a56b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push edi
push str.wkdcmd
lea ecx, [esp + 0x40]
push str._s_d___s____s____s_
push ecx
call fcn.00404580
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x1c
mov byte [esp + 0x8d0], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45a639
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x45a639
mov dword [esp + 0x24], 0xd
jmp 0x45a639
push str.wosb_aux_main1_output
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00401b10
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x8d4], 5
call fcn.00401a50
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x8d0], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45a61b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
push ecx
push 1
push str.wkdcmd
lea edx, [esp + 0x38]
push str._s_d___s_
push edx
call fcn.00404580
add esp, 0x14
mov esi, dword [esp + 0x2c]
cmp dword [esi - 0xc], ebx
je 0x45ab3b
push 0x208
lea ecx, [esp + 0x4b8]
push ecx
xor eax, eax
push ebx
mov word [esp + 0x4c0], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
mov word [esp + 0x8c2], dx
cmp dword [esi - 0xc], ebx
mov esi, 0x4a7664
je 0x45a67d
mov esi, 0x4a7770
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.00459bc0
mov eax, dword [eax]
push eax
push str.logusrsid
push esi
lea ecx, [esp + 0x40]
push str._s_s__s_
push ecx
mov byte [esp + 0x8ec], 9
call fcn.004191f0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x1c
mov byte [esp + 0x8d0], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45a6d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x38
lea ecx, [esp + 0x70]
push ebx
push ecx
call fcn.00482db0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x88], eax
mov eax, dword [0x4d7e6c]
add esp, 0xc
lea edx, [esp + 0x4b4]
mov dword [esp + 0x68], 0x3c
mov dword [esp + 0x6c], 0x4440
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], str.runas
mov dword [esp + 0x78], edx
mov dword [esp + 0x84], 5
cmp eax, ebx
je 0x45a744
push ebx
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
cmp eax, ebx
je 0x45a744
or dword [esp + 0x6c], 0x200000
mov dword [esp + 0x9c], eax
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
xor ecx, ecx
test eax, eax
setge cl
lea edx, [esp + 0x68]
push edx
mov esi, ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x45ab03
cmp dword [esp + 0xa0], ebx
je 0x45aaf9
call fcn.00469e8e
mov ecx, dword [eax + 4]
call fcn.00466efe
mov eax, dword [esp + 0x8f0]
mov ecx, dword [esp + 0xa0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x45aabe
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], ebx
call fcn.004016e0
lea ecx, [esp + 0x14]
call fcn.004016e0
mov bl, 0xc
mov byte [esp + 0x8d0], bl
cmp edi, 1
je 0x45a99e
jle 0x45a98a
cmp edi, 3
jg 0x45a98a
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push edi
call fcn.004229a0
add esp, 0xc
test eax, eax
je 0x45a916
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
call fcn.004229a0
add esp, 0xc
test eax, eax
je 0x45a8a2
push 0xd
lea ecx, [esp + 0x18]
call fcn.004038f0
push 0x4a8dcc
push 0x4a80b8
lea ecx, [esp + 0x1c]
call fcn.004066b0
push 0xd
lea ecx, [esp + 0x24]
call fcn.004038f0
push 0x4a8dcc
push 0x4a80b8
lea ecx, [esp + 0x28]
call fcn.004066b0
lea eax, [esp + 0x14]
push eax
mov ecx, ebp
call fcn.00401a50
mov ecx, dword [ebp]
cmp dword [ecx - 0xc], 0
je 0x45a873
push str._r_n_r_n
mov ecx, ebp
call fcn.00401ef0
lea edx, [esp + 0x20]
push edx
mov ecx, ebp
call fcn.00407840
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
call fcn.00401a50
lea ecx, [esp + 0x38]
call fcn.00401ce0
mov ecx, eax
call fcn.00401810
jmp 0x45aa5c
mov ecx, dword [esp + 0x18]
push edi
push ecx
lea edx, [esp + 0x6c]
push str.CWakeSourcesDlg::runWakeDeviceCmdElevated.ReadTextFileToCString_err_d__file_s
push edx
call fcn.00411be0
mov eax, dword [eax]
push 0x12a
push eax
push 4
mov byte [esp + 0x8ec], 0xf
call fcn.0042fc90
add esp, 0x1c
lea ecx, [esp + 0x64]
mov byte [esp + 0x8d0], bl
call fcn.0041f860
mov eax, dword [esp + 0x18]
push 1
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.004285d0
mov eax, dword [eax]
mov edx, dword [esp + 0x24]
push eax
push edx
push str._ERROR:___d___s_
push ebp
mov byte [esp + 0x8ec], 0x10
call fcn.00404580
lea ecx, [esp + 0x64]
jmp 0x45aa54
mov eax, dword [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x5c]
push str.CWakeSourcesDlg::runWakeDeviceCmdElevated.ReadTextFileToCString_err_d__file_s
push ecx
call fcn.00411be0
mov eax, dword [eax]
push 0x129
push eax
push 4
mov byte [esp + 0x8ec], 0x11
call fcn.0042fc90
add esp, 0x1c
lea ecx, [esp + 0x54]
mov byte [esp + 0x8d0], bl
call fcn.0041f860
mov edx, dword [esp + 0x18]
push 1
push edx
lea eax, [esp + 0x68]
push eax
call fcn.004285d0
mov eax, dword [eax]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push str._ERROR:___d___s_
push ebp
mov byte [esp + 0x8ec], 0x12
call fcn.00404580
lea ecx, [esp + 0x7c]
jmp 0x45aa54
push edi
push str._Bad_cmd_d_
push ebp
call fcn.00404580
add esp, 0xc
jmp 0x45aa5c
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push edi
call fcn.004229a0
add esp, 0xc
test eax, eax
je 0x45a9e5
push 0xd
lea ecx, [esp + 0x18]
call fcn.004038f0
push 0x4a8dcc
push 0x4a80b8
lea ecx, [esp + 0x1c]
call fcn.004066b0
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.00401a50
jmp 0x45aa5c
mov edx, dword [esp + 0x18]
push edi
push edx
lea eax, [esp + 0x64]
push str.CWakeSourcesDlg::runWakeDeviceCmdElevated.ReadTextFileToCString_err_d__file_s
push eax
call fcn.00411be0
mov eax, dword [eax]
push 0x127
push eax
push 4
mov byte [esp + 0x8ec], 0xd
call fcn.0042fc90
add esp, 0x1c
lea ecx, [esp + 0x5c]
mov byte [esp + 0x8d0], bl
call fcn.0041f860
mov ecx, dword [esp + 0x18]
push 1
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.004285d0
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x28]
push eax
push str._ERROR:___d___s_
push ebp
mov byte [esp + 0x8ec], 0xe
call fcn.00404580
lea ecx, [esp + 0x68]
add esp, 0x1c
call fcn.0041f860
mov edx, dword [esp + 0xa0]
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x30], 0xfffff883
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
mov eax, dword [esp + 0x28]
je 0x45aa8b
test eax, eax
jne 0x45aa8b
mov dword [esp + 0x3c], 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 1
mov dword [esp + 0x24], eax
call fcn.0041f860
lea ecx, [esp + 0x20]
call fcn.0041f860
lea ecx, [esp + 0x43]
xor ebx, ebx
mov byte [esp + 0x8d0], 4
call fcn.0040e6e0
jmp 0x45ab18
cmp eax, 0x102
jne 0x45aadc
lea ecx, [esp + 0x43]
mov dword [esp + 0x24], eax
mov byte [esp + 0x8d0], 4
call fcn.0040e6e0
jmp 0x45ab18
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x43]
mov dword [esp + 0x24], eax
mov byte [esp + 0x8d0], 4
call fcn.0040e6e0
jmp 0x45ab18
mov dword [esp + 0x24], 6
jmp 0x45ab31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
cmp eax, 0x4c7
jne 0x45ab18
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0xa0]
cmp eax, ebx
je 0x45ab31
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xa0], ebx
cmp esi, ebx
je 0x45ab3b
call dword [sym.imp.ole32.dll_CoUninitialize]
mov edi, dword [esp + 0x1c]
cmp dword [edi - 0xc], ebx
je 0x45ab5a
push edi
call fcn.0041b370
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.00401580
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
cmp dword [esi - 0xc], ebx
je 0x45ab79
push esi
call fcn.0041b370
add esp, 4
lea ecx, [esp + 0x30]
call fcn.00401580
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x50]
cmp ecx, ebx
je 0x45ab8b
lea eax, [esp + 0x38]
push eax
call fcn.00401a50
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x45ab99
mov ecx, dword [esp + 0x44]
mov dword [eax], ecx
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov byte [esp + 0x8d0], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45abcc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x8d0], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45abf0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x8d0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45ac14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x8d0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45ac3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x8d0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45ac67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x8c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8b0]
xor ecx, esp
call fcn.00482b5f
add esp, 0x8c0
ret