Function at 0x40456f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x22c
mov eax, dword [0x48e610]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x74]
push 0x98
mov dword [ebp - 0x164], eax
xor ebx, ebx
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.0045f090
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x9c
call esi
cmp eax, ebx
je 0x40490f
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x94
call esi
cmp eax, ebx
je 0x40490f
cmp dword [ebp - 0x30], 6
jb 0x40490f
call fcn.0043c800
test eax, eax
je 0x404755
lea ecx, [ebp - 0x154]
call fcn.0043f500
lea ecx, [ebp - 0x144]
call fcn.0043f500
push str..exe
mov ecx, edi
call fcn.0043f620
mov esi, eax
cmp esi, ebx
jle 0x4046e4
add esi, 4
cmp byte [edi + 7], 0xff
mov eax, edi
jne 0x404627
mov eax, dword [edi]
cmp byte [eax + esi], 0x22
jne 0x40462e
inc esi
push esi
lea eax, [ebp - 0x14c]
push eax
mov ecx, edi
call fcn.0043ff80
push eax
lea ecx, [ebp - 0x154]
call fcn.0043f840
lea ecx, [ebp - 0x14c]
call fcn.0043f790
push esi
lea eax, [ebp - 0x14c]
push eax
mov ecx, edi
call fcn.00440300
push eax
lea ecx, [ebp - 0x144]
call fcn.0043f840
lea ecx, [ebp - 0x14c]
call fcn.0043f790
mov esi, 0x47ea68
jmp 0x4046ac
push 1
lea eax, [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x144]
call fcn.00440300
push eax
lea ecx, [ebp - 0x144]
call fcn.0043f840
lea ecx, [ebp - 0x16c]
call fcn.0043f790
push esi
push 1
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x144]
call fcn.0043ff80
push eax
call fcn.00401046
pop ecx
pop ecx
lea ecx, [ebp - 0x14c]
mov byte [ebp - 0x139], al
call fcn.0043f790
cmp byte [ebp - 0x139], bl
jne 0x404681
jmp 0x4046f0
push edi
lea ecx, [ebp - 0x154]
call fcn.0043f840
cmp byte [ebp - 0x13d], 0xff
lea ecx, [ebp - 0x144]
jne 0x404705
mov ecx, dword [ebp - 0x144]
cmp byte [ebp - 0x14d], 0xff
lea eax, [ebp - 0x154]
jne 0x40471a
mov eax, dword [ebp - 0x154]
push ecx
push eax
call fcn.0043cc00
pop ecx
pop ecx
lea ecx, [ebp - 0x144]
test eax, eax
je 0x404745
call fcn.0043f790
lea ecx, [ebp - 0x154]
call fcn.0043f790
xor eax, eax
inc eax
jmp 0x404921
call fcn.0043f790
lea ecx, [ebp - 0x154]
call fcn.0043f790
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
je 0x4047a5
lea ecx, [ebp - 0x168]
push ecx
push eax
mov dword [ebp - 0x168], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x168], ebx
jbe 0x4047a5
push dword [ebp - 0x168]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x148], ebx
cmp dword [ebp - 0x158], ebx
je 0x40490f
lea eax, [ebp - 0x15c]
push eax
mov esi, 0x2000000
push esi
push dword [ebp - 0x158]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4048f7
lea eax, [ebp - 0x160]
push eax
push 1
push 2
push ebx
push esi
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x4048eb
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x140], eax
cmp eax, ebx
je 0x4048df
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x150], eax
cmp eax, ebx
je 0x4048d3
push 0x44
pop esi
push esi
lea eax, [ebp - 0x1c0]
push ebx
push eax
call fcn.0045f090
mov ax, word [ebp + 0x78]
mov dword [ebp - 0x1c0], esi
push 0x10
mov word [ebp - 0x190], ax
xor esi, esi
lea eax, [ebp - 0x17c]
push ebx
inc esi
push eax
mov dword [ebp - 0x194], esi
call fcn.0045f090
add esp, 0x18
cmp byte [edi + 7], 0xff
mov eax, edi
jne 0x404873
mov eax, dword [edi]
lea ecx, [ebp - 0x17c]
push ecx
lea ecx, [ebp - 0x1c0]
push ecx
push ebx
push ebx
push ebx
push eax
lea ecx, [ebp - 0x138]
call fcn.00404460
mov ecx, eax
call fcn.00402710
push eax
push ebx
push esi
push dword [ebp - 0x160]
call dword [ebp - 0x150]
lea ecx, [ebp - 0x138]
mov esi, eax
call fcn.00404270
cmp esi, ebx
je 0x4048d3
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x148], 1
cmp eax, ebx
je 0x4048d3
mov ecx, dword [ebp - 0x17c]
mov dword [eax], ecx
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x160]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x15c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x148], ebx
jne 0x40473d
push dword [ebp - 0x164]
push dword [ebp + 0x78]
push edi
call fcn.004018ef
add esp, 0xc
mov ecx, dword [ebp + 0x68]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045f4ee
add ebp, 0x6c
leave
ret