Function at 0x464fa4
Capabilities:
Check os version
Create process on windows
Get hostname
Get session user name
Terminate process

Disassembly:
push 0x3d0
mov eax, 0x512114
call fcn.004e3d69
lea eax, [ebp - 0x29c]
mov ebx, ecx
call fcn.004646fa
xor edi, edi
mov dword [ebp - 4], edi
call fcn.004be6f3
push eax
lea ecx, [ebp - 0x3b8]
call fcn.004027f9
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.004e38a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x465186
call fcn.004075e9
cmp eax, edi
jne 0x465124
call fcn.0047876d
cmp eax, 6
jae 0x465068
push edi
push 0x10
push 0x5afd90
push ecx
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x5c33a0
call fcn.0040253b
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 3
jmp 0x4650ef
mov eax, dword [0x60889c]
push 1
mov esi, 0x5afd90
push esi
push str.arovistaschedule
push dword [eax]
push str.runas
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jl 0x4650ad
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.ExitProcess_:_Elevated_now_restarting
call fcn.0040253b
call fcn.00454d39
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push 0x10
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push 0x5c33a0
call fcn.0040253b
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 5
push dword [eax]
call fcn.004be306
mov ecx, dword [ebp - 0x3c0]
add ecx, 0xfffffff0
call fcn.0040285b
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.0040285b
lea ecx, [ebp - 0x29c]
call fcn.00464770
xor al, al
jmp 0x4654c6
call fcn.00464d03
test al, al
jne 0x465186
call fcn.00464d73
test al, al
jne 0x465186
cmp byte [ebp + 8], al
jne 0x465104
push edi
push 0x40
push 0x5afd90
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.IDS_SERVICENORUN
call fcn.0040253b
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 7
jmp 0x4650ef
mov eax, dword [0x60889c]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x465193
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.00402719
cmp byte [0x60a92b], 0
je 0x4651c4
push str._default
jmp 0x4651d6
cmp byte [ebp + 8], 0
je 0x4651d1
push str._updatecheck
jmp 0x4651d6
push str.scan
lea ecx, [ebp - 0x3b8]
call fcn.00402719
lea ecx, [ebp - 0x3b8]
call fcn.0040733c
push eax
lea ecx, [ebp - 0x260]
call fcn.00402719
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.004145ba
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebx + 0x24]
call fcn.00445c03
lea esi, [ebp - 0x3dc]
lea edi, [ebp - 0x298]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x28c], ax
mov word [ebp - 0x28a], ax
lea eax, [ebp - 0x3b4]
push eax
mov dword [ebp - 0x3b4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x3b0], 5
mov esi, 0x100
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x3c8], esi
lea ecx, [ebp - 0x3b8]
push eax
jb 0x46527c
push esi
call fcn.00445a08
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
jmp 0x4652c6
push 0x104
mov dword [ebp - 0x3c8], esi
call fcn.00445a08
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x3c8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.0040733c
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x3b8]
call fcn.0040733c
push eax
lea ecx, [ebp - 0x258]
call fcn.00402719
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.004145ba
lea ecx, [ebx + 0x14]
mov dword [ebp - 0x3c0], ecx
call fcn.0040733c
push eax
lea ecx, [ebp - 0x24c]
call fcn.00402719
mov eax, dword [ebx + 0x30]
xor esi, esi
sub eax, esi
je 0x4653ef
dec eax
je 0x4653df
dec eax
je 0x4653a0
dec eax
je 0x46536d
push esi
push 0x10
push 0x5afd90
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.IDS_NEWTASKERROR
call fcn.0040253b
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 9
jmp 0x4650ef
add ebx, 0x38
push 4
pop edi
cmp ebx, esi
je 0x4653f2
lea eax, [ebp - 0x243]
xor ecx, ecx
sub ebx, eax
lea eax, [ebp + ecx - 0x243]
cmp byte [ebx + eax], 1
jne 0x465398
mov byte [eax], 1
mov byte [ebp - 0x244], 1
inc ecx
cmp ecx, 0x1f
jl 0x465381
jmp 0x4653f2
push 3
lea eax, [ebx + 0x38]
pop edi
mov dword [ebp - 0x3bc], edi
cmp eax, esi
je 0x4653e2
xor edx, edx
push 7
inc edx
pop esi
cmp byte [eax], 1
jne 0x4653d8
movzx ecx, dx
cmp dx, 7
jne 0x4653c6
xor ecx, ecx
xor edi, edi
inc edi
shl edi, cl
add word [ebp - 0x246], di
mov edi, dword [ebp - 0x3bc]
inc eax
inc edx
dec esi
jne 0x4653b6
jmp 0x4653e2
push 2
pop edi
mov ax, word [ebx + 0x34]
mov word [ebp - 0x248], ax
jmp 0x4653f2
xor edi, edi
inc edi
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x268], edi
call fcn.0046481a
cmp eax, 0x80070050
jne 0x4654ce
cmp byte [0x60a92b], 0
jne 0x46548a
cmp byte [ebp + 8], 0
jne 0x46548a
push esi
push 0x24
push 0x5afd90
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.IDS_FILEEXIST
call fcn.0040253b
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 0xb
push dword [eax]
call fcn.004be306
cmp eax, 6
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3bc]
sete bl
add ecx, 0xfffffff0
call fcn.0040285b
test bl, bl
je 0x465104
mov ecx, dword [ebp - 0x3c0]
call fcn.0040733c
push eax
call fcn.00464bd8
pop ecx
test eax, eax
jl 0x4654ab
lea eax, [ebp - 0x29c]
call fcn.0046481a
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.0040285b
lea ecx, [ebp - 0x29c]
call fcn.00464770
mov al, 1
call fcn.004e3dec
ret 4
cmp eax, 0x80070005
jne 0x46552d
push esi
push 0x40
push 0x5afd90
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x5c33a0
call fcn.0040253b
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 0xd
push dword [eax]
call fcn.004be306
mov ecx, dword [ebp - 0x3bc]
jmp 0x4650fc
cmp eax, 0x8007007b
jne 0x46557c
push esi
push 0x40
push 0x5afd90
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.IDS_VALIDFILE
call fcn.0040253b
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 0xf
jmp 0x46551b
cmp eax, esi
jge 0x4654ab
push esi
push 0x10
push 0x5afd90
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040253b
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.IDS_NEWTASKERROR
call fcn.0040253b
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406ef3
mov byte [ebp - 4], 0x11
jmp 0x46551b