Function at 0x1004d760
Capabilities:
Create process on windows
Enumerate gui resources
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x100ef0a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x10]
movq qword [ebp - 0x74], xmm0
movups xmm0, xmmword [str.S_1_16_8192]
push ebx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x18]
movups xmmword [ebp - 0x2c], xmm0
push edi
movq xmm0, qword [0x100c942c]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x48]
movq qword [ebp - 0x1c], xmm0
xorps xmm0, xmm0
push eax
push 0x20
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1004d988
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 1
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push 0
push 0
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], 2
push eax
push 0
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
call edi
push dword [ebp - 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
test esi, esi
je 0x1004d98a
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x1004d86e
lea eax, [ebp - 0x54]
push eax
push 0x1004dc50
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x1004d98a
lea ecx, [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x1004d98a
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1004d988
lea eax, [ebp - 0x50]
mov byte [ebp - 0x3d], 0
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1004d8b8
call edi
jmp 0x1004d954
lea eax, [ebp - 0x44]
push eax
push 1
push 2
push 0
push 0x18b
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1004d8d8
call edi
jmp 0x1004d954
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
jne 0x1004d8ed
call edi
jmp 0x1004d954
mov eax, dword [ebp - 0x4c]
push eax
mov dword [ebp - 0x70], 0x20
mov dword [ebp - 0x74], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x74]
push eax
push 0x19
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1004d91c
call edi
jmp 0x1004d954
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push 0
push 0
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push 0
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x1004d950
call edi
push eax
push str.CreateProcessWithTokenW_failed_with_error:__d
call fcn.1003ea50
add esp, 8
jmp 0x1004d954
mov byte [ebp - 0x3d], 1
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x1004d967
push eax
call ebx
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x1004d971
push ecx
call ebx
push esi
call ebx
mov al, byte [ebp - 0x3d]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10050cd5
mov esp, ebp
pop ebp
ret
call edi
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10050cd5
mov esp, ebp
pop ebp
ret