Function at 0x4802c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [0x4ec1a4]
mov edi, ecx
mov ecx, dword [str.RUNDLL32.EXE]
push 0x103
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x82c], eax
mov eax, dword [0x4ec1a8]
mov dword [ebp - 0x14], ecx
mov cl, byte [0x4ec1ac]
lea edx, [ebp - 0x11f]
push 0
push edx
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], cl
mov byte [ebp - 0x120], 0
call fcn.004d29c0
add esp, 0xc
test esi, esi
je 0x480343
push esi
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x120]
call fcn.004010b0
xor esi, esi
xor ebx, ebx
test edi, edi
jns 0x480352
neg edi
lea ebx, [esi + 1]
test edi, edi
jle 0x480370
xor eax, eax
cmp edi, 0xb
jl 0x48036e
cmp edi, 0x15
jge 0x480364
xor eax, eax
jmp 0x48036e
cmp edi, 0x1f
jge 0x48036e
mov eax, 1
mov esi, eax
push 0x1f40001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [0x506e0c], 0
mov dword [ebp - 0x830], eax
je 0x4803cf
mov eax, dword [0x4f8b78]
mov ecx, dword [0x4f8b7c]
mov dword [ebp - 0x834], eax
mov dword [ebp - 0x838], ecx
test esi, esi
je 0x4803bb
mov dword [0x4f8b78], 0x20019
mov dword [0x4f8b7c], 0xf003f
jmp 0x4803cf
mov dword [0x4f8b78], 0x20119
mov dword [0x4f8b7c], 0xf013f
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, 0x7ffffffe
test ebx, ebx
je 0x48049a
mov esi, dword [ebp - 0x82c]
push esi
mov eax, 0x104
lea ecx, [ebp - 0x120]
call fcn.004010b0
mov ebx, dword [ebp - 0x83c]
push ebx
call edi
test eax, eax
je 0x48047f
mov eax, 0x200
lea ecx, [ebp - 0x120]
cmp byte [ecx], 0
je 0x48041c
inc ecx
dec eax
jne 0x480411
jmp 0x480444
test eax, eax
je 0x480444
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push 0x4e6f20
lea ecx, [ebp + ecx - 0x120]
mov edx, 0x7fffffff
call fcn.004010b0
mov eax, 0x200
lea ecx, [ebp - 0x120]
nop
cmp byte [ecx], 0
je 0x48045b
inc ecx
dec eax
jne 0x480450
jmp 0x48047f
test eax, eax
je 0x48047f
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push ebx
lea ecx, [ebp + ecx - 0x120]
mov edx, 0x7fffffff
call fcn.004010b0
lea edx, [ebp - 0x14]
push edx
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x320]
call fcn.004010b0
jmp 0x4804b7
mov eax, dword [ebp - 0x82c]
push eax
mov eax, 0x200
lea ecx, [ebp - 0x320]
call fcn.004010b0
mov esi, dword [ebp - 0x82c]
xor ebx, ebx
mov dword [ebp - 0x878], 0x3c
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x870], ebx
mov dword [ebp - 0x86c], str.runas
cmp dword [ebp + 0xc], ebx
jne 0x4804e8
mov dword [ebp - 0x86c], str.open
lea ecx, [ebp - 0x628]
push ecx
mov ecx, esi
call fcn.0047c1e0
add esp, 4
mov ecx, 0x4e27f8
test eax, eax
jle 0x480510
lea edx, [ebp - 0x628]
mov dword [ebp - 0x860], edx
jmp 0x480516
mov dword [ebp - 0x860], ecx
or dword [ebp - 0x874], 0x400
mov dword [ebp - 0x86c], ecx
lea edx, [ebp - 0x878]
lea eax, [ebp - 0x320]
lea ecx, [ebp - 0x120]
push edx
mov dword [ebp - 0x868], eax
mov dword [ebp - 0x864], ecx
mov dword [ebp - 0x85c], 1
mov dword [ebp - 0x858], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp eax, ebx
jne 0x4806e7
lea eax, [ebp - 0x120]
push eax
call edi
test eax, eax
je 0x4805f4
mov eax, 0x200
lea ecx, [ebp - 0x320]
nop
cmp byte [ecx], bl
je 0x48058a
inc ecx
dec eax
jne 0x480580
jmp 0x4805b2
cmp eax, ebx
je 0x4805b2
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push 0x4e6f20
lea ecx, [ebp + ecx - 0x320]
mov edx, 0x7fffffff
call fcn.004010b0
mov edx, 0x200
lea eax, [ebp - 0x320]
lea ecx, [ecx]
cmp byte [eax], bl
je 0x4805ca
inc eax
dec edx
jne 0x4805c0
jmp 0x4805f4
cmp edx, ebx
je 0x4805f4
mov ecx, 0x200
sub ecx, edx
lea edx, [ebp - 0x120]
mov eax, 0x200
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x320]
mov edx, 0x7fffffff
call fcn.004010b0
mov ebx, 0x270f
cmp dword [0x4f8b70], ebx
jge 0x480693
mov eax, dword [ebp - 0x86c]
push eax
push str.fileLaunchDelayedProgram
push str._s__s
lea ecx, [ebp - 0x828]
push 0x200
push ecx
call fcn.00402ee0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea edx, [ebp - 0x82c]
push edx
push 0x400
mov esi, eax
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [ebp - 0x82c]
push eax
push esi
push str._d___s
lea ecx, [ebp - 0x520]
push 0x200
push ecx
call fcn.00402ee0
mov edx, dword [ebp - 0x82c]
add esp, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x828]
push eax
lea esi, [ebp - 0x520]
call fcn.0047da70
add esp, 4
push 1
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
cmp esi, 0x1f
ja 0x4806f4
cmp dword [0x4f8b70], ebx
jge 0x4806f4
mov edx, dword [ebp - 0x86c]
push edx
push str.fileLaunchDelayedProgram_WinExec
push str._s__s
lea eax, [ebp - 0x520]
push 0x200
push eax
call fcn.00402ee0
add esp, 0x14
push 0
lea edx, [ebp - 0x520]
mov ecx, esi
call fcn.00482b70
jmp 0x4806f1
push str.fileLaunchDelayedProgram_ShellExecute__TRUE
call fcn.0047da70
add esp, 4
cmp dword [0x506e0c], 0
je 0x480715
mov ecx, dword [ebp - 0x834]
mov edx, dword [ebp - 0x838]
mov dword [0x4f8b78], ecx
mov dword [0x4f8b7c], edx
mov eax, dword [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret