Function at 0x49e260
Capabilities:
Create process on windows
Impersonate user
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [esp + 0x74]
push 0x40
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x7c], 0x44
call fcn.004dce30
add esp, 0xc
xor bl, bl
test byte [0x547ba4], 1
jne 0x49e423
mov eax, 0x547ba4
lock bts dword [eax], 0x1f
jae 0x49e2c9
test byte [0x547ba4], 1
jne 0x49e423
xor edx, edx
mov ecx, eax
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x49e423
push str.winsta.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, eax
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x49e31b
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x49e31b
cmp eax, 0x10000000
jae 0x49e31b
cmp dword [eax + ecx], 0x4550
jne 0x49e31b
lea edx, [eax + 0x78]
mov eax, dword [edx + ecx]
add edx, ecx
test eax, eax
je 0x49e31b
cmp dword [edx + 4], 0
je 0x49e31b
push 0
push 0x532990
add eax, ecx
push eax
push edx
call fcn.004a2140
jmp 0x49e31d
xor eax, eax
push str.userenv.dll
mov dword [0x54ae6c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov eax, 0x5a4d
movzx ecx, word [esi]
mov edx, ecx
cmp cx, ax
jne 0x49e37e
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x49e37e
cmp eax, 0x10000000
jae 0x49e37e
cmp dword [eax + esi], 0x4550
jne 0x49e37e
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x49e37e
cmp dword [ecx + 4], 0
je 0x49e37e
push 0
push str.CreateEnvironmentBlock
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004a2140
movzx ecx, word [esi]
jmp 0x49e382
mov ecx, edx
xor eax, eax
mov dword [0x54ae88], eax
mov eax, 0x5a4d
cmp cx, ax
jne 0x49e3ce
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x49e3ce
cmp eax, 0x10000000
jae 0x49e3ce
cmp dword [eax + esi], 0x4550
jne 0x49e3ce
lea ecx, [eax + 0x78]
mov eax, dword [ecx + esi]
add ecx, esi
test eax, eax
je 0x49e3ce
cmp dword [ecx + 4], 0
je 0x49e3ce
push 0
push str.DestroyEnvironmentBlock
add eax, esi
push eax
push ecx
mov ecx, esi
call fcn.004a2140
jmp 0x49e3d0
xor eax, eax
mov dword [0x54ae60], eax
mov eax, 0x547ba4
lock bts dword [eax], 0
jb 0x49e423
mov esi, dword [0x547ba8]
test esi, esi
je 0x49e3f4
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x547ba4
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x49e423
test esi, esi
je 0x49e423
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x547ba8], 0
mov edx, edi
and edx, 0x3000
cmp edx, 0x3000
jne 0x49e441
mov eax, 0xc00000f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x49e45d
cmp dword [esi + 4], 0
jne 0x49e45d
mov eax, 0xc0000030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi + 0x10]
mov dword [esp + 0x78], eax
test edi, 0x40000
je 0x49e645
test edx, edx
mov ecx, edi
sete al
xor edx, edx
and ecx, 0x10000
movzx eax, al
cmove edx, eax
test edi, 0x20000
je 0x49e4af
mov eax, dword fs:[0x18]
movzx edx, dl
mov dword [esp + 0x14], 0
mov ecx, dword [eax + 0x30]
mov eax, dword [esi + 0x14]
cmp eax, dword [ecx + 0x1d4]
cmovne edx, dword [esp + 0x14]
mov eax, dword [esi + 0x24]
test eax, eax
je 0x49e4bf
cmp eax, 2
jne 0x49e645
test dl, dl
je 0x49e645
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x49e524
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49e4d3
push dword [0x54b7b4]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov dword [esp + 0x20], eax
add eax, 0xa
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov edx, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [eax], edx
lea ecx, [eax + 8]
mov dword [eax + 4], ecx
mov word [edx + ecx], di
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x49e52c
push edx
push ebx
push dword [eax + 4]
call fcn.004dd620
add esp, 0xc
jmp 0x49e52c
mov dword [esp + 0x14], 0
mov ebx, edi
or ebx, 2
cmp dword [esi + 0xc], 0
cmovne ebx, edi
mov ecx, ebx
mov eax, ebx
and ecx, 2
shl ecx, 9
mov edx, ecx
or edx, 4
and al, 4
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x1000000
and al, 8
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
cmove edx, ecx
mov ecx, edx
or ecx, 0x80000
and bl, 0x20
mov ebx, dword [esp + 0x14]
cmove ecx, edx
test ebx, ebx
je 0x49e582
mov eax, dword [ebx + 4]
jmp 0x49e584
xor eax, eax
lea edx, [esp + 0x30]
push edx
lea edx, [esp + 0x74]
push edx
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
push dword [esi]
push 1
push dword [esi + 0x20]
push dword [esi + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x49e5b1
xor esi, esi
jmp 0x49e5c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x49e5c6
movzx esi, si
or esi, 0xc0070000
test ebx, ebx
je 0x49e5dd
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x49e5dd
call fcn.004a2a20
test esi, esi
js 0x49e941
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49e5f9
mov eax, dword [esp + 0x38]
mov dword [ecx], eax
mov eax, dword [esp + 0x3c]
mov dword [ecx + 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [esp + 0x30]
test ecx, ecx
je 0x49e608
mov dword [ecx], eax
jmp 0x49e613
test eax, eax
je 0x49e613
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp + 0x18]
mov eax, dword [esp + 0x34]
test ecx, ecx
je 0x49e62b
mov dword [ecx], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test eax, eax
je 0x49e941
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test edi, 0x1000
je 0x49e695
push dword [esi + 0x18]
mov edx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
lea ecx, [esp + 0x20]
call fcn.004ad010
test eax, eax
js 0x49e943
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
mov edx, 0xf01ff
call fcn.004ad290
push dword [esp + 0x1c]
mov ebx, eax
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x49e6f4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test edi, 0x2000
je 0x49e701
mov eax, dword [0x54ae6c]
test eax, eax
jne 0x49e6b4
mov eax, 0xc000007a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea ecx, [esp + 0x58]
push ecx
push 0xc
lea ecx, [esp + 0x6c]
push ecx
push 0xe
push dword [esi + 0x18]
push 0
call eax
test al, al
jne 0x49e6ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x49e943
movzx eax, ax
or eax, 0xc0070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], eax
mov ebx, edi
shr ebx, 0x11
and bl, 1
jmp 0x49e7b9
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x49e79a
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x14], 2
mov al, byte [ecx]
xor al, 0xe
test al, 0x1f
jne 0x49e78f
push str.NT_AUTHORITY
push ecx
call fcn.004de297
add esp, 8
test eax, eax
jne 0x49e796
mov ecx, dword [esi + 0x1c]
mov al, byte [ecx]
xor al, 0xf3
test al, 0x1f
jne 0x49e751
push str.SYSTEM
push ecx
call fcn.004de297
add esp, 8
test eax, eax
je 0x49e788
mov ecx, dword [esi + 0x1c]
mov al, byte [ecx]
xor al, 0xc
test al, 0x1f
jne 0x49e76e
push str.LOCAL_SERVICE
push ecx
call fcn.004de297
add esp, 8
test eax, eax
je 0x49e788
mov ecx, dword [esi + 0x1c]
mov al, byte [ecx]
xor al, 0xe
test al, 0x1f
jne 0x49e796
push str.NETWORK_SERVICE
push ecx
call fcn.004de297
add esp, 8
test eax, eax
jne 0x49e796
mov eax, 5
jmp 0x49e79a
mov eax, 2
jmp 0x49e79a
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0
push eax
push dword [esi + 0x20]
push dword [esi + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x49e6cd
test edi, 0x10000
je 0x49e820
lea eax, [esp + 0x5c]
push eax
push 4
lea eax, [esp + 0x2c]
push eax
push 0x13
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x49e820
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x60]
push ecx
push 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], eax
push ecx
push 8
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x49e815
cmp dword [esp + 0x28], 1
jne 0x49e815
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [esp + 0x14]
jmp 0x49e889
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
test bl, bl
je 0x49e88d
lea eax, [esp + 0x2c]
mov dword [esp + 0x40], 0x18
push eax
push 1
push 0
lea eax, [esp + 0x4c]
mov dword [esp + 0x50], 0
push eax
push 0xf01ff
push dword [esp + 0x24]
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
call dword [sym.imp.ntdll.dll_NtDuplicateToken]
push dword [esp + 0x10]
mov ebx, eax
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x49e68a
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
test edi, 0x20000
je 0x49e8ca
mov eax, dword [esi + 0x14]
push 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push 0xc
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test ebx, ebx
jns 0x49e8ca
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [esi + 0xc], 0
jne 0x49e8f3
mov eax, dword [0x54ae88]
test eax, eax
je 0x49e8f3
push 0
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
call eax
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x49e8f7
or edi, 2
jmp 0x49e8f7
mov ecx, dword [esp + 0x18]
push dword [ebp + 0x18]
mov eax, dword [esi + 0xc]
test eax, eax
push dword [ebp + 0x14]
cmovne ecx, eax
lea eax, [esp + 0x78]
push dword [ebp + 0x10]
push dword [esp + 0x1c]
push edi
push eax
push dword [esi + 8]
push ecx
push dword [esi + 4]
push dword [esi]
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov edx, dword [esp + 0x18]
mov esi, eax
test edx, edx
je 0x49e937
mov ecx, dword [0x54ae60]
test ecx, ecx
je 0x49e937
push edx
call ecx
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14