Function at 0x4548c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e2465
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], ebx
test esi, esi
je 0x454d9c
cmp word [esi], bx
je 0x454d9c
mov ecx, esi
mov dword [ebp - 0x30], ebx
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
jmp 0x454930
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x454930
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.004033b0
push 0x14
xor eax, eax
mov dword [ebp - 4], 0
push 0x4ff814
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.004033b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.004065e0
add esp, 4
test eax, eax
jne 0x45499f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00454ed0
add esp, 8
mov byte [ebp - 0x71], 0
test eax, eax
je 0x4549a3
mov byte [ebp - 0x71], 1
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x4549dd
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4549d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454a10
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x454a20
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454a16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x454a16
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0x71], 0
jne 0x454b93
push esi
call fcn.00454fc0
add esp, 4
test al, al
jne 0x454b93
push str.companyname_not_matched
lea ecx, [ebp - 0x58]
call fcn.00404c50
push 0x4f1b84
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 2
call fcn.00404c50
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.00404c50
push 0
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 4
push eax
push 0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0049b6b0
mov edx, dword [ebp - 0x2c]
add esp, 0x18
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x454ac5
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454abb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454b5a
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov edx, dword [ebp - 0x5c]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x454b13
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454b09
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454b5a
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x454b6a
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454b60
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x454b60
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
push esi
push str.Exe:__s_cert_verify_faild_
push str.kupdate::KProcessUtils::RunProcess
push 0x1b0
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
mov eax, 0x80004005
jmp 0x454dbf
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5421c0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x541a90]
cmp eax, dword [ecx + 4]
jg 0x454ddb
cmp byte [0x541a8e], 0
jne 0x454c95
mov ecx, esi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x454be0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004033b0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 7
push eax
call fcn.0049c4d0
mov edx, dword [ebp - 0x14]
add esp, 4
movzx edi, al
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x454c52
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454c48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x454c48
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test edi, edi
jne 0x454c92
push esi
push str.Exe:__s_VerifyEmbeddedSignature_faild_
push str.kupdate::KProcessUtils::RunProcess
push 0x1b9
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push edi
call fcn.00412750
add esp, 0x18
mov eax, 0x80004005
jmp 0x454dbf
mov edi, dword [ebp - 0x7c]
push esi
push str.RunProcess:__s.
push str.kupdate::KProcessUtils::RunProcess
push 0x1bd
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 7
call fcn.00412750
push 0x38
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xbc], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [ebp - 0x84], 0
mov ecx, 0x540
mov dword [ebp - 0xb4], 0
test edi, edi
mov dword [ebp - 0xb0], 0
mov eax, 0x500
mov dword [ebp - 0xac], esi
cmovne eax, ecx
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xbc]
push eax
mov dword [ebp - 0x9c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x454d6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x454d4a
movzx esi, si
or esi, 0x80070000
push esi
push str.Failed_ShellExecuteEx:_0x_08x.
push str.kupdate::KProcessUtils::RunProcess
push 0x1ce
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
mov eax, esi
jmp 0x454dbf
test edi, edi
je 0x454d98
push 0xffffffffffffffff
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x454dbf
push str.Invalid_Arg.
push str.kupdate::KProcessUtils::RunProcess
push 0x1a2
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x14
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret
push 0x541a90
call fcn.004bf206
add esp, 4
cmp dword [0x541a90], 0xffffffff
jne 0x454bb3
mov dword [ebp - 4], 5
call fcn.004d83d0
test al, al
je 0x454e32
push str.UpdateDisableVerifySig
lea ecx, [ebp - 0x58]
call fcn.00404c50
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 6
mov ebx, 1
push eax
mov dword [ebp - 0x78], ebx
call fcn.004d8750
add esp, 4
test al, al
je 0x454e32
mov al, bl
jmp 0x454e36
xor al, al
jmp 0x454e36
mov dword [ebp - 4], 5
mov byte [0x541a8e], al
test bl, 1
je 0x454e85
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x454e85
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454e79
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x454e79
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
jmp 0x454e85
push 0x541a90
mov dword [ebp - 4], 0xffffffff
call fcn.004bf1bc
add esp, 4
jmp 0x454bb3