Function at 0x40448a
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push dword [esp + 0x10]
push dword [0x454f70]
call fcn.0040c2f6
and eax, eax
je 0x40477e
call fcn.0040290e
push 0xffffffff
push dword [esp + 0x14]
call fcn.00403577
mov ebp, dword [0x454f74]
cmp dword [ebp + 0x24], 0
je 0x4045c1
push dword [0x4551cc]
mov edx, 0x45303c
push edx
call fcn.00411be0
push dword [0x4551cc]
push dword [0x4551cc]
mov ebp, dword [0x454f74]
push dword [ebp + 0x20]
call fcn.00408da5
pop eax
mov edx, str.__r_n_r_n_
push edx
call fcn.00411be0
lea eax, [esp + 4]
push eax
call fcn.00411c40
mov ebx, dword [ebp + 0x24]
cmp ebx, 2
jne 0x404525
push dword [ebp + 8]
call fcn.00410460
and eax, eax
je 0x404525
mov eax, 1
jmp 0x404527
xor eax, eax
and eax, eax
je 0x4045a1
push dword [0x454eb4]
call fcn.0040641e
and eax, eax
je 0x4045a1
mov ebp, dword [0x454f74]
push dword [ebp + 8]
call fcn.0040645c
and eax, eax
je 0x40459c
push dword [0x4551cc]
push dword [0x4551cc]
push dword [esp + 8]
mov eax, str.warntext
push eax
call fcn.00406550
lea eax, [esp + 4]
push eax
call fcn.00411c40
push dword [0x4551cc]
push dword [0x4551cc]
mov eax, 0x453582
push eax
push dword [0x454f38]
push dword [esp + 0x10]
call fcn.004108d0
lea eax, [esp + 4]
push eax
call fcn.00411c40
call fcn.00406679
push 4
push dword [esp + 4]
mov eax, 0x45362a
push eax
call fcn.004055de
mov ebx, eax
cmp ebx, 7
jne 0x4045c1
jmp 0x404780
mov ebp, dword [0x454f74]
push dword [ebp + 0xc]
mov edx, str.Exit
pop ecx
call fcn.004050b0
je 0x4045dc
jmp 0x4022da
cmp dword [0x454e54], 0
je 0x4045ef
push 0
call sub.KERNEL32.dll_Wow64EnableWow64FsRedirection
mov eax, 0x453044
push eax
mov ebp, dword [0x454f74]
push dword [ebp + 0xc]
call fcn.00410520
and eax, eax
je 0x40464f
push dword [0x4551cc]
mov ebp, dword [0x454f74]
push dword [ebp + 0xc]
call fcn.00403774
lea eax, [esp + 4]
push eax
call fcn.00411c40
push dword [esp]
call fcn.00410460
and eax, eax
je 0x40464f
mov edx, dword [esp]
push dword [0x4551cc]
push edx
call fcn.00411be0
mov ebp, dword [0x454f74]
lea eax, [ebp + 0xc]
push eax
call fcn.00411c40
mov eax, 0x453044
push eax
mov ebp, dword [0x454f74]
push dword [ebp + 0x10]
call fcn.00410520
and eax, eax
je 0x4046af
push dword [0x4551cc]
mov ebp, dword [0x454f74]
push dword [ebp + 0x10]
call fcn.00403774
lea eax, [esp + 4]
push eax
call fcn.00411c40
push dword [esp]
call fcn.00410460
and eax, eax
je 0x4046af
mov edx, dword [esp]
push dword [0x4551cc]
push edx
call fcn.00411be0
mov ebp, dword [0x454f74]
lea eax, [ebp + 0x10]
push eax
call fcn.00411c40
mov ebp, dword [0x454f74]
cmp dword [ebp + 0x30], 0
je 0x404719
mov ebp, dword [0x454f74]
cmp dword [ebp + 0x34], 0
je 0x4046f0
push 0
push dword [0x454f00]
mov ebp, dword [0x454f74]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, str.RunAS
push eax
push 0
call sub.SHELL32.DLL_ShellExecuteW
jmp 0x404717
push 1
push dword [0x454f00]
mov ebp, dword [0x454f74]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, str.RunAS
push eax
push 0
call sub.SHELL32.DLL_ShellExecuteW
jmp 0x40475a
mov ebp, dword [0x454f74]
cmp dword [ebp + 0x34], 0
je 0x404743
push 2
push dword [0x454f00]
mov ebp, dword [0x454f74]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00405ab1
jmp 0x40475a
push dword [0x454f00]
mov ebp, dword [0x454f74]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00405a99
cmp dword [0x454e54], 0
je 0x40476d
push 1
call sub.KERNEL32.dll_Wow64EnableWow64FsRedirection
mov ebp, dword [0x454f74]
cmp dword [ebp + 0x28], 0
je 0x40477e
jmp 0x4022da
xor eax, eax
push dword [esp]
call fcn.00411cc0
add esp, 4
pop ebx
pop ebp
ret 4