Function at 0x4049b0
Capabilities:
Check os version
Create process on windows
Get token membership

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4614cb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa88
mov eax, dword [0x47a040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0xa50]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xa4c]
mov dword [ebp - 0xa4c], 0
push eax
mov word [ebp - 0xa48], 0x500
mov dword [ebp - 0xa50], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0xa44], eax
test eax, eax
je 0x404a81
lea eax, [ebp - 0xa44]
push eax
push dword [ebp - 0xa50]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x404a67
mov dword [ebp - 0xa44], eax
push dword [ebp - 0xa50]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0xa44]
test eax, eax
jne 0x404de6
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x158]
push eax
mov dword [ebp - 0x158], 0x11c
call esi
test eax, eax
jne 0x404ab1
lea eax, [ebp - 0x158]
mov dword [ebp - 0x158], 0x114
push eax
call esi
cmp dword [ebp - 0x154], 6
jb 0x404de6
mov eax, dword [ebx + 8]
or edi, 0xffffffff
cmp dword [eax - 0xc], 0
jl 0x404afe
push str._ElevPri
push eax
call fcn.00439107
add esp, 8
test eax, eax
je 0x404afe
sub eax, dword [ebx + 8]
sar eax, 1
cmp eax, edi
je 0x404afe
push 0
push 0x46ee00
push 0x46ee08
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x404dc3
push 0x208
lea eax, [ebp - 0xa40]
push 0
push eax
call fcn.00439ab0
add esp, 0xc
lea eax, [ebp - 0xa40]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00404660
mov ecx, eax
test ecx, ecx
je 0x404e28
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xa44], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa44]
push dword [ebx + 8]
push str._ElevPri
push str._s__s
push eax
call fcn.00405a50
push 0x100
lea eax, [ebp - 0x144]
mov dword [ebp - 0x158], 0x11c
push 0
push eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
call fcn.00439ab0
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0x1c
xor eax, eax
mov word [ebp - 0x42], ax
mov dword [ebp - 0x40], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [ebp - 0x158]
mov dword [ebp - 0x154], 6
xor ecx, ecx
mov dword [ebp - 0x150], 0
push eax
mov word [ebp - 0x44], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x404cae
push str.runas
xorps xmm0, xmm0
lea eax, [ebp - 0x34]
push 0x10
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.004421e0
mov esi, dword [ebp - 0xa44]
lea eax, [ebp - 0x34]
mov dword [ebp - 0xa84], eax
add esp, 0xc
lea eax, [ebp - 0xa40]
mov dword [ebp - 0xa88], 0
xorps xmm0, xmm0
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xa90]
mov dword [ebp - 0xa78], 0
push eax
movlpd qword [ebp - 0xa70], xmm0
movlpd qword [ebp - 0xa68], xmm0
movlpd qword [ebp - 0xa60], xmm0
mov dword [ebp - 0xa58], 0
mov dword [ebp - 0xa90], 0x3c
mov dword [ebp - 0xa7c], esi
mov dword [ebp - 0xa74], 0
mov dword [ebp - 0xa8c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x404da8
push dword [ebp - 0xa58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404da8
push 0x800
lea eax, [ebp - 0x838]
push 0
push eax
call fcn.00439ab0
mov esi, dword [ebp - 0xa44]
lea eax, [ebp - 0xa40]
add esp, 0xc
test esi, esi
je 0x404ced
push esi
push eax
lea eax, [ebp - 0x838]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x404d03
push eax
lea eax, [ebp - 0x838]
push 0x46f4f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xa98], 0x44
mov word [ebp - 0xa56], ax
xorps xmm0, xmm0
mov eax, 1
movlpd qword [ebp - 0xa94], xmm0
mov word [ebp - 0xa68], ax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa98]
movlpd qword [ebp - 0xa8c], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x838]
movlpd qword [ebp - 0xa84], xmm0
push eax
push 0
movlpd qword [ebp - 0xa7c], xmm0
movlpd qword [ebp - 0xa74], xmm0
movlpd qword [ebp - 0xa66], xmm0
movlpd qword [ebp - 0xa5e], xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0xa6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404da8
push dword [ebp - 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x20]
call edi
or edi, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404dc3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x404de2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
jmp 0x404e0a
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebx + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404e08
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004378e6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80004005
call fcn.00401920
int3