Function at 0x449298
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47344e
mov eax, dword fs:[0]
push eax
mov eax, 0x12b4
call fcn.00463310
mov eax, dword [0x4a0590]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1240], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x123c], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1254], esi
lea edi, [ebp - 0x1250]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x12bc]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x1244], ebx
mov dword [ebp - 0x1234], esi
mov dword [ebp - 0x12c0], esi
call fcn.0045f360
add esp, 0xc
xor eax, eax
push 0x1fe
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.0045f360
add esp, 0xc
xor eax, eax
push 0xffe
mov word [ebp - 0x1210], ax
lea eax, [ebp - 0x120e]
push esi
push eax
call fcn.0045f360
add esp, 0xc
lea eax, [ebp - 0x1230]
call fcn.0043bdc9
mov dword [ebp - 4], esi
mov dword [ebp - 0x12c0], 0x44
cmp ebx, esi
je 0x449372
cmp word [ebx], si
jne 0x449374
xor ebx, ebx
lea eax, [ebp - 0x1238]
push eax
push esi
push 2
push ebx
push 0x487028
push dword [ebp - 0x1240]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x4493c6
push 0x48702c
call fcn.00447c29
pop ecx
lea eax, [ebp - 0x1230]
call fcn.0043b39a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00453655
leave
ret
push 1
push dword [ebp - 0x1238]
lea eax, [ebp - 0x1234]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
cmp eax, esi
jne 0x4493e4
mov dword [ebp - 0x1234], esi
lea eax, [ebp - 0x210]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x449405
push str.GetCurrentDirectory
call fcn.00447c29
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov ebx, 0x800
lea eax, [ebp - 0x1210]
push ebx
push eax
call fcn.00455d11
add esp, 0xc
mov edi, 0x47ef94
push edi
lea eax, [ebp - 0x1210]
push ebx
push eax
call fcn.00455d80
add esp, 0xc
cmp dword [ebp - 0x123c], esi
je 0x449466
push dword [ebp - 0x123c]
lea eax, [ebp - 0x1210]
push ebx
push eax
call fcn.00455d80
add esp, 0xc
push edi
lea eax, [ebp - 0x1210]
push ebx
push eax
call fcn.00455d80
add esp, 0xc
push str._relaunch
lea eax, [ebp - 0x1210]
push ebx
push eax
call fcn.00455d80
add esp, 0xc
call fcn.004441a6
push eax
lea edi, [ebp - 0x1274]
call fcn.0043bb24
mov edi, eax
lea esi, [ebp - 0x1230]
mov byte [ebp - 4], 1
call fcn.0043ba47
lea eax, [ebp - 0x1274]
mov byte [ebp - 4], 0
call fcn.0043b39a
cmp dword [ebp - 0x1218], 8
mov eax, dword [ebp - 0x122c]
jae 0x4494c1
lea eax, [ebp - 0x122c]
push eax
lea eax, [ebp - 0x1210]
push ebx
push eax
call fcn.00455d80
add esp, 0xc
lea eax, [ebp - 0x1254]
push eax
lea eax, [ebp - 0x12c0]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x1234]
lea eax, [ebp - 0x1210]
push 0x400
push eax
push 0
push 1
push dword [ebp - 0x1244]
push 0x487028
push dword [ebp - 0x1240]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x449537
push 0x487068
call fcn.00447c29
pop ecx
xor bl, bl
lea eax, [ebp - 0x1230]
call fcn.0043b39a
mov al, bl
jmp 0x4493ac
cmp dword [ebp - 0x1234], 0
je 0x44954b
push dword [ebp - 0x1234]
call sub.USERENV.dll_DestroyEnvironmentBlock
push dword [ebp - 0x1238]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1254]
call esi
push dword [ebp - 0x1250]
call esi
mov bl, 1
jmp 0x449525