Function at 0x4c7bd5
Capabilities:
Check os version
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x40], 0xc
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
xor esi, esi
stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4c7c49
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], esi
je 0x4c7c2b
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 8], esi
je 0x4c7c38
push dword [ebp - 8]
call edi
mov dword [ebp - 8], esi
cmp dword [ebp - 0xc], esi
je 0x4c7c42
push dword [ebp - 0xc]
call edi
xor eax, eax
jmp 0x4c7ed0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [ebp - 0x10]
push 2
push esi
push esi
lea eax, [ebp - 0xc]
push eax
call edi
push eax
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4c7c18
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], esi
je 0x4c7c7b
push dword [ebp - 0x10]
call ebx
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x110
stosd dword es:[edi], eax
lea eax, [ebp - 0x1a0]
push esi
push eax
call fcn.004fe380
add esp, 0xc
lea eax, [ebp - 0x1a4]
push eax
mov dword [ebp - 0x1a4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1a0], 6
jb 0x4c7ed7
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x4c7ed7
lea esi, [ebp - 0x14]
call fcn.004c7aec
test eax, eax
je 0x4c7ed5
cmp dword [ebp - 0x14], 0
je 0x4c7ed5
push 0x40
xor edi, edi
lea eax, [ebp - 0x88]
push edi
push eax
mov dword [ebp - 0x8c], 0x44
call fcn.004fe380
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov dword [ebp - 0x54], edi
mov word [ebp - 0x5c], ax
mov dword [ebp - 0x60], 0x101
call fcn.004c7b4c
mov dword [ebp - 0x24], eax
cmp eax, edi
jne 0x4c7d57
cmp dword [ebp - 8], edi
je 0x4c7d44
push dword [ebp - 8]
call ebx
mov dword [ebp - 8], edi
cmp dword [ebp - 0xc], edi
je 0x4c7c42
push dword [ebp - 0xc]
call ebx
jmp 0x4c7c42
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x4c7d37
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x4c7d37
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.004104a0
lea eax, [ebp - 0x190]
push 3
push dword [ebp - 0x14]
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x194]
call fcn.00410760
mov ecx, dword [ebp - 0x194]
lea eax, [ebp - 0x18]
push eax
call fcn.004066b0
lea eax, [ebp - 0x190]
cmp dword [ebp - 0x194], eax
je 0x4c7dca
push dword [ebp - 0x194]
call fcn.004f6d01
pop ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, str.adb_version
call fcn.004104a0
lea eax, [ebp - 0x190]
push 3
push dword [ebp - 0x1c]
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x194]
call fcn.00410760
mov ecx, dword [ebp - 0x194]
lea eax, [ebp - 0x10]
push eax
call fcn.004066b0
lea eax, [ebp - 0x190]
cmp dword [ebp - 0x194], eax
je 0x4c7e1d
push dword [ebp - 0x194]
call fcn.004f6d01
pop ecx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x8c]
push eax
push edi
push edi
push 0x8000020
lea esi, [ebp - 0x10]
call fcn.0040a6c0
push eax
lea esi, [ebp - 0x18]
call fcn.0040a6c0
push eax
push 1
push dword [ebp - 0x24]
call dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
test eax, eax
jne 0x4c7e71
call fcn.00406760
lea eax, [ebp - 0x1c]
call fcn.004b8a70
mov ecx, esi
call fcn.00406760
lea eax, [ebp - 0x14]
call fcn.004b8a70
jmp 0x4c7d37
call fcn.00406760
lea eax, [ebp - 0x1c]
call fcn.004b8a70
lea ecx, [ebp - 0x18]
call fcn.00406760
lea eax, [ebp - 0x14]
call fcn.004b8a70
xor esi, esi
push 0xffffffffffffffff
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x34]
call ebx
push dword [ebp - 0x30]
call ebx
cmp dword [ebp - 8], esi
je 0x4c7eaf
push dword [ebp - 8]
call ebx
mov eax, dword [ebp + 0x10]
push esi
push eax
push dword [eax]
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
cmp dword [ebp - 0xc], esi
je 0x4c7ece
push dword [ebp - 0xc]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
push 0x40
lea eax, [ebp - 0x88]
push esi
push eax
mov dword [ebp - 0x8c], 0x44
call fcn.004fe380
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
xor eax, eax
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x8c]
push eax
push esi
push esi
push 0x8000020
push 1
push esi
push esi
push str.adb_version
push dword [ebp + 8]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x60], 0x101
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4c7e90
cmp dword [ebp - 8], esi
je 0x4c7f52
push dword [ebp - 8]
call ebx
mov dword [ebp - 8], esi
cmp dword [ebp - 0xc], esi
jmp 0x4c7d47