Function at 0x453f30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e23e5
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
mov eax, dword [0x53d9f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xa8], 0
test esi, esi
je 0x454832
cmp word [esi], 0
je 0x454832
push edi
push esi
push str.Running_elevated:__s___s.
push str.kupdate::KProcessUtils::RunElevated
push 0x14a
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 7
call fcn.00412750
lea eax, [ebp - 0x58]
push 0x14
push eax
call fcn.00416f00
add esp, 0x24
cmp dword [eax + 0x14], 8
mov ebx, 1
mov dword [ebp - 4], 0
mov dword [ebp - 0xa8], ebx
jb 0x453fd1
mov eax, dword [eax]
push eax
call fcn.004168a0
add esp, 4
test al, al
jne 0x45404f
lea eax, [ebp - 0x40]
push 0x17
push eax
call fcn.00416f00
add esp, 8
cmp dword [eax + 0x14], 8
mov ebx, 3
mov dword [ebp - 4], 1
mov dword [ebp - 0xa8], ebx
jb 0x454006
mov eax, dword [eax]
push eax
call fcn.004168a0
add esp, 4
test al, al
jne 0x45404f
lea eax, [ebp - 0x28]
push 0x15
push eax
call fcn.00416f00
add esp, 8
cmp dword [eax + 0x14], 8
mov ebx, 7
mov dword [ebp - 4], 2
mov dword [ebp - 0xa8], ebx
jb 0x45403b
mov eax, dword [eax]
push eax
call fcn.004168a0
add esp, 4
mov byte [ebp - 0xa1], 0
test al, al
je 0x454056
mov byte [ebp - 0xa1], 1
mov dword [ebp - 4], 1
test bl, 4
je 0x4540b3
mov edx, dword [ebp - 0x14]
and ebx, 0xfffffffb
cmp edx, 8
jb 0x45409f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454095
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454147
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0
test bl, 2
je 0x45410c
mov edx, dword [ebp - 0x2c]
and ebx, 0xfffffffd
cmp edx, 8
jb 0x4540f8
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4540ee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454147
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x454157
mov edx, dword [ebp - 0x44]
and ebx, 0xfffffffe
cmp edx, 8
jb 0x454157
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45414d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45414d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0xa1], 0
je 0x45419b
push 0x1388
push edi
push dword [0x50e8a0]
call fcn.0049aed0
add esp, 0xc
test eax, eax
jns 0x45438b
push eax
push str.Failed_send_ipc_message:_0x_08x.
push str.kupdate::KProcessUtils::RunElevated
push 0x156
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
lea eax, [ebp - 0x70]
push 6
push eax
call fcn.00416f00
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 3
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.004168a0
add esp, 0xc
test al, al
je 0x4545eb
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 4
call fcn.00410410
mov ecx, eax
call fcn.00446780
lea ecx, [ebp - 0xa0]
test eax, eax
je 0x454392
push str.Run__UserAdmin__
call fcn.00404c50
push esi
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 5
push eax
call fcn.00404b80
push 0x4effc0
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 6
push eax
call fcn.00404b80
push edi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 7
push eax
call fcn.00404b80
add esp, 0x24
lea ecx, [ebp - 0x28]
push eax
call fcn.00405210
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x454289
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45427f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov edx, dword [ebp - 0x74]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x4542de
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4542d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov edx, dword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x45432f
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454325
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov edx, dword [ebp - 0x8c]
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x4544e3
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4544d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4544d9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor eax, eax
jmp 0x454855
push str.Run__UserSystem__
call fcn.00404c50
push esi
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
push eax
call fcn.00404b80
push 0x4effc0
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 9
push eax
call fcn.00404b80
push edi
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xa
push eax
call fcn.00404b80
add esp, 0x24
lea ecx, [ebp - 0x28]
push eax
call fcn.00405210
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x454416
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45440c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov edx, dword [ebp - 0x74]
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov byte [ebp - 4], 9
cmp edx, 8
jb 0x45446b
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454461
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov byte [ebp - 4], 8
cmp edx, 8
jb 0x4544c0
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4544b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
jmp 0x454343
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x5c], 8
push ecx
cmovae eax, dword [ebp - 0x70]
push eax
push str.Running_elevated_through_wpscloudsvr:__s___s.
push str.kupdate::KProcessUtils::RunElevated
push 0x16d
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 7
call fcn.00412750
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0xa8]
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
push edx
cmovae eax, dword [ebp - 0x70]
push ecx
push eax
call fcn.004548c0
mov edx, dword [ebp - 0xa8]
add esp, 0x28
test eax, eax
js 0x45458d
test dx, dx
jne 0x45458d
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x454586
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45457c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
xor esi, esi
jmp 0x4547f4
push edx
push eax
push str.Failed_run_through_wpscloudsvr:_0x_08x__exit_code:_d
push str.kupdate::KProcessUtils::RunElevated
push 0x174
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
mov edx, dword [ebp - 0x14]
add esp, 0x1c
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x4545eb
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4545e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
call fcn.00410410
mov ecx, eax
call fcn.00446780
test eax, eax
je 0x454685
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5421c0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5405e4]
cmp eax, dword [ecx + 4]
jg 0x454871
push dword [0x4fef28]
lea eax, [ebp - 0xa0]
mov ecx, 0x5405c4
push eax
call fcn.00413a10
mov ecx, dword [str.manual]
mov esi, eax
mov edx, ecx
or ebx, 8
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x454646
sub edx, edi
mov edi, esi
sar edx, 1
cmp dword [esi + 0x14], 8
jb 0x45465f
mov edi, dword [esi]
mov esi, dword [esi + 0x10]
cmp esi, edx
jne 0x4546ff
test esi, esi
je 0x454685
sub edi, ecx
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x4546ff
add ecx, 2
sub esi, 1
jne 0x454670
mov byte [ebp - 0xa1], 0
test bl, 8
je 0x4546d1
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x4546d1
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4546c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
cmp byte [ebp - 0xa1], 0
je 0x454708
push str.personal_version__not_manual__not_use_uac
push str.kupdate::KProcessUtils::RunElevated
push 0x17c
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
mov esi, 0x80004005
jmp 0x4547f1
mov byte [ebp - 0xa1], 1
jmp 0x45468c
call fcn.00453290
test al, al
je 0x4547d1
push 0x38
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xec], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0xac]
add esp, 0xc
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0xe8], 0x500
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], str.runas
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xcc], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x454586
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4547b0
movzx esi, si
or esi, 0x80070000
push esi
push str.Failed_ShellExecuteEx:_0x_08x.
push str.kupdate::KProcessUtils::RunElevated
push 0x190
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x18
jmp 0x4547f4
push str.Can_not_be_elevated.
push str.kupdate::KProcessUtils::RunElevated
push 0x197
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
mov esi, 0x80070032
add esp, 0x14
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x45482e
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x454824
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x454385
push edx
push ecx
call fcn.004bee2d
add esp, 8
mov eax, esi
jmp 0x454855
push str.Invalid_Arg.
push str.kupdate::KProcessUtils::RunElevated
push 0x146
push str.H:_rc_v12_i18n_20231201_branchCoding_supportwpsupdateUpdateClient_srcutilKProcessUtils.cpp
push 0
call fcn.00412750
add esp, 0x14
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bee49
mov esp, ebp
pop ebp
ret
push 0x5405e4
call fcn.004bf206
add esp, 4
cmp dword [0x5405e4], 0xffffffff
jne 0x45461f
mov ecx, 0x5405c4
mov byte [ebp - 4], 0xb
call fcn.004138c0
push 0x4ebe20
call fcn.004bf0be
push 0x5405e4
mov byte [ebp - 4], 3
call fcn.004bf1bc
add esp, 8
jmp 0x45461f