Function at 0x45747b
Capabilities:
Check os version
Create process on windows
Get hostname
Get session user name
Terminate process

Disassembly:
push 0x3d0
mov eax, 0x4d5ae7
call fcn.004ae989
lea eax, [ebp - 0x29c]
mov ebx, ecx
call fcn.00456bc2
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0048b151
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00402821
xor eax, eax
mov byte [ebp - 4], 1
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
call fcn.004ae4c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x45765d
call fcn.00407527
cmp eax, edi
jne 0x4575fb
call fcn.0045ef16
cmp eax, 6
jae 0x45753f
push edi
push 0x10
push 0x5229b8
push ecx
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x534b30
call fcn.0040253e
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 3
jmp 0x4575c6
mov eax, dword [0x5675bc]
push 1
mov esi, 0x5229b8
push esi
push str.pccpvistaschedule
push dword [eax]
push str.runas
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jl 0x457584
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.ExitProcess_:_Elevated_now_restarting
call fcn.0040253e
call fcn.0044dcca
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push 0x10
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push 0x534b30
call fcn.0040253e
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 5
push dword [eax]
call fcn.0048ad48
mov ecx, dword [ebp - 0x3c0]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.00402883
lea ecx, [ebp - 0x29c]
call fcn.00456c38
xor al, al
jmp 0x45799d
call fcn.004571da
test al, al
jne 0x45765d
call fcn.0045724a
test al, al
jne 0x45765d
cmp byte [ebp + 8], al
jne 0x4575db
push edi
push 0x40
push 0x5229b8
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.SAFEPC_A26
call fcn.0040253e
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 7
jmp 0x4575c6
mov eax, dword [0x5675bc]
mov ecx, dword [eax]
lea edx, [ebp - 0x21c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x45766a
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.0040274c
cmp byte [0x569595], 0
je 0x45769b
push str._default
jmp 0x4576ad
cmp byte [ebp + 8], 0
je 0x4576a8
push str._updatecheck
jmp 0x4576ad
push str.scan
lea ecx, [ebp - 0x3b8]
call fcn.0040274c
lea ecx, [ebp - 0x3b8]
call fcn.0040727a
push eax
lea ecx, [ebp - 0x260]
call fcn.0040274c
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.00411fe7
lea eax, [ebp - 0x3dc]
push eax
lea ecx, [ebx + 0x24]
call fcn.00442548
lea esi, [ebp - 0x3dc]
lea edi, [ebp - 0x298]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x28c], ax
mov word [ebp - 0x28a], ax
lea eax, [ebp - 0x3b4]
push eax
mov dword [ebp - 0x3b4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x3b0], 5
mov esi, 0x100
lea eax, [ebp - 0x3c8]
mov dword [ebp - 0x3c8], esi
lea ecx, [ebp - 0x3b8]
push eax
jb 0x457753
push esi
call fcn.00442358
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
jmp 0x45779d
push 0x104
mov dword [ebp - 0x3c8], esi
call fcn.00442358
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x3c8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x3b8]
call fcn.0040727a
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x3b8]
call fcn.0040727a
push eax
lea ecx, [ebp - 0x258]
call fcn.0040274c
push 0xffffffffffffffff
lea ecx, [ebp - 0x3b8]
call fcn.00411fe7
lea ecx, [ebx + 0x14]
mov dword [ebp - 0x3c0], ecx
call fcn.0040727a
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040274c
mov eax, dword [ebx + 0x30]
xor esi, esi
sub eax, esi
je 0x4578c6
dec eax
je 0x4578b6
dec eax
je 0x457877
dec eax
je 0x457844
push esi
push 0x10
push 0x5229b8
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x3bc], esp
push str.SAFEPC_A546
call fcn.0040253e
lea eax, [ebp - 0x3c0]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 9
jmp 0x4575c6
add ebx, 0x38
push 4
pop edi
cmp ebx, esi
je 0x4578c9
lea eax, [ebp - 0x243]
xor ecx, ecx
sub ebx, eax
lea eax, [ebp + ecx - 0x243]
cmp byte [ebx + eax], 1
jne 0x45786f
mov byte [eax], 1
mov byte [ebp - 0x244], 1
inc ecx
cmp ecx, 0x1f
jl 0x457858
jmp 0x4578c9
push 3
lea eax, [ebx + 0x38]
pop edi
mov dword [ebp - 0x3bc], edi
cmp eax, esi
je 0x4578b9
xor edx, edx
push 7
inc edx
pop esi
cmp byte [eax], 1
jne 0x4578af
movzx ecx, dx
cmp dx, 7
jne 0x45789d
xor ecx, ecx
xor edi, edi
inc edi
shl edi, cl
add word [ebp - 0x246], di
mov edi, dword [ebp - 0x3bc]
inc eax
inc edx
dec esi
jne 0x45788d
jmp 0x4578b9
push 2
pop edi
mov ax, word [ebx + 0x34]
mov word [ebp - 0x248], ax
jmp 0x4578c9
xor edi, edi
inc edi
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x268], edi
call fcn.00456ce2
cmp eax, 0x80070050
jne 0x4579a5
cmp byte [0x569595], 0
jne 0x457961
cmp byte [ebp + 8], 0
jne 0x457961
push esi
push 0x24
push 0x5229b8
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.SAFEPC_A488
call fcn.0040253e
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 0xb
push dword [eax]
call fcn.0048ad48
cmp eax, 6
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3bc]
sete bl
add ecx, 0xfffffff0
call fcn.00402883
test bl, bl
je 0x4575db
mov ecx, dword [ebp - 0x3c0]
call fcn.0040727a
push eax
call fcn.004570af
pop ecx
test eax, eax
jl 0x457982
lea eax, [ebp - 0x29c]
call fcn.00456ce2
mov ecx, dword [ebp - 0x3b8]
add ecx, 0xfffffff0
call fcn.00402883
lea ecx, [ebp - 0x29c]
call fcn.00456c38
mov al, 1
call fcn.004aea0c
ret 4
cmp eax, 0x80070005
jne 0x457a04
push esi
push 0x40
push 0x5229b8
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x534b30
call fcn.0040253e
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 0xd
push dword [eax]
call fcn.0048ad48
mov ecx, dword [ebp - 0x3bc]
jmp 0x4575d3
cmp eax, 0x8007007b
jne 0x457a53
push esi
push 0x40
push 0x5229b8
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.SAFEPC_A35
call fcn.0040253e
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 0xf
jmp 0x4579f2
cmp eax, esi
jge 0x457982
push esi
push 0x10
push 0x5229b8
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
push str.RESOURCESTRING
call fcn.0040253e
push ecx
mov byte [ebp - 4], 0x10
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push str.SAFEPC_A546
call fcn.0040253e
lea eax, [ebp - 0x3bc]
push eax
mov byte [ebp - 4], 1
call fcn.00406e20
mov byte [ebp - 4], 0x11
jmp 0x4579f2