Function at 0x426220
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
lea eax, [ebp - 8]
lea edi, [ebp - 0x244]
sub esp, 0x2d4
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x294], esp
mov dword [ebp - 0x2a4], 0x4474b0
mov dword [ebp - 0x2a0], 0x447f78
mov dword [ebp - 0x298], 0x426689
mov dword [esp], eax
call fcn.00437520
xor eax, eax
mov ecx, 0xd
mov dword [ebp - 0x24c], 0x3c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x248], 0x40
mov dword [ebp - 0x240], str.runas
mov dword [esp + 8], 0x104
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [ebp - 0x2b8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
je 0x426422
lea eax, [ebp - 0x210]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x274]
mov dword [ebp - 0x27c], eax
mov dword [esp], str.___asadmin
call sub.msvcrt.dll_wcslen
add eax, eax
mov edx, eax
mov dword [ebp - 0x2c0], eax
sar edx, 1
mov dword [ebp - 0x264], edx
cmp edx, 7
ja 0x426450
mov eax, dword [ebp - 0x27c]
cmp edx, 1
jne 0x426445
mov ecx, 0x20
mov word [eax], cx
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x278], edx
xor edx, edx
mov word [eax + ecx], dx
mov eax, dword [0x45115c]
mov dword [ebp - 0x2c0], eax
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x278]
cmp eax, edx
ja 0x426639
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c0]
lea ecx, [ebp - 0x27c]
mov dword [esp], eax
mov dword [ebp - 0x2b8], 1
call fcn.00444ba0
sub esp, 8
mov dword [esp], 0x44a5d8
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x278]
cmp eax, edx
ja 0x42667d
mov dword [esp + 4], eax
lea ecx, [ebp - 0x27c]
mov dword [esp], 0x44a5d8
mov dword [ebp - 0x2b8], 1
call fcn.00444ba0
mov eax, dword [0x451220]
sub esp, 8
mov dword [ebp - 0x2c0], 0
test eax, eax
jle 0x426592
add dword [ebp - 0x2c0], 1
mov edi, dword [ebp - 0x2c0]
cmp edi, eax
jge 0x426592
mov dword [esp], edi
mov dword [ebp - 0x2b8], 1
call fcn.00424940
test al, al
je 0x4264b5
mov eax, dword [0x451220]
jmp 0x4263d2
lea eax, [ebp - 0x274]
cmp edx, eax
je 0x426422
mov dword [esp], edx
call fcn.00446bb0
mov dword [ebp - 0x2c0], 0
lea eax, [ebp - 0x2bc]
mov dword [esp], eax
call fcn.004375b0
mov eax, dword [ebp - 0x2c0]
mov edi, dword [ebp - 4]
leave
ret
test edx, edx
je 0x42631c
jmp 0x426481
lea eax, [ebp - 0x264]
mov dword [esp + 4], 0
lea ecx, [ebp - 0x27c]
mov dword [esp], eax
call fcn.00444d00
mov edx, dword [ebp - 0x264]
mov dword [ebp - 0x27c], eax
sub esp, 8
mov dword [ebp - 0x274], edx
mov ecx, dword [ebp - 0x2c0]
mov dword [esp + 4], str.___asadmin
mov dword [esp], eax
mov dword [esp + 8], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x27c]
lea ecx, [edx + edx]
mov dword [ebp - 0x2c0], ecx
jmp 0x42631c
mov dword [esp], 0x44a5de
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x278]
cmp eax, edx
ja 0x426667
mov dword [esp + 4], eax
lea ecx, [ebp - 0x27c]
mov dword [esp], 0x44a5de
mov dword [ebp - 0x2b8], 1
call fcn.00444ba0
mov ecx, dword [ebp - 0x2c0]
mov eax, dword [0x45121c]
sub esp, 8
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x2c4], eax
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x278]
cmp eax, edx
ja 0x42665b
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c4]
lea ecx, [ebp - 0x27c]
mov dword [esp], eax
mov dword [ebp - 0x2b8], 1
call fcn.00444ba0
sub esp, 8
mov dword [esp], 0x44a5e4
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x278]
cmp eax, edx
ja 0x42664f
mov dword [esp + 4], eax
lea ecx, [ebp - 0x27c]
mov dword [esp], 0x44a5e4
mov dword [ebp - 0x2b8], 1
call fcn.00444ba0
sub esp, 8
jmp 0x426401
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x264]
mov dword [esp], eax
mov dword [ebp - 0x2b8], 1
call fcn.004245b0
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 0x25c]
mov dword [ebp - 0x234], eax
cmp eax, edx
je 0x4265d4
mov dword [esp], eax
call fcn.00446bb0
mov dword [ebp - 0x230], 0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x22c], 0
mov dword [esp], eax
mov dword [ebp - 0x2b8], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
sub esp, 4
mov edx, dword [ebp - 0x27c]
test eax, eax
je 0x426410
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x274]
cmp edx, eax
je 0x42642c
mov dword [esp], edx
call fcn.00446bb0
jmp 0x42642c
mov dword [esp], 0x44a516
mov dword [ebp - 0x2b8], 1
call fcn.00445e20
mov dword [esp], 0x44a516
call fcn.00445e20
mov dword [esp], 0x44a516
call fcn.00445e20
mov dword [esp], 0x44a516
mov dword [ebp - 0x2b8], 1
call fcn.00445e20
mov dword [esp], 0x44a516
call fcn.00445e20
add ebp, 8
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x27c]
lea edx, [ebp - 0x274]
cmp eax, edx
je 0x4266b0
mov dword [esp], eax
call fcn.00446bb0
mov eax, dword [ebp - 0x2c0]
mov dword [esp], eax
mov dword [ebp - 0x2b8], 0xffffffff
call fcn.00437890
nop
lea esi, [esi]