Function at 0x4493c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xd4
push ebx
push esi
push edi
xor ebx, ebx
push 0x3c
lea eax, [esp + 0x5c]
push ebx
mov esi, 0x44
push eax
xor edi, edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], ebx
call fcn.004a30a0
push 0x40
xor eax, eax
lea ecx, [esp + 0xac]
push ebx
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0xb0], esi
call fcn.004a30a0
add esp, 0x18
push str.CreateProcessWithTokenW
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
jne 0x449488
mov ecx, dword [esp + 0xe4]
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x9c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4494ee
mov edx, dword [esp + 0x44]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x40]
push eax
call esi
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xd4
ret 4
lea ecx, [esp + 0x10]
push ecx
push 0x20
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4494ee
lea edx, [esp + 0x34]
push edx
push str.SeIncreaseQuotaPrivilege
push ebx
mov dword [esp + 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push ebx
lea eax, [esp + 0x3c]
push eax
push ebx
push ecx
mov dword [esp + 0x54], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4494fc
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
add esp, 0xd4
ret 4
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
je 0x44953b
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x44953b
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x44953b
lea edx, [esp + 0x18]
push edx
push 0xb
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x44954a
lea ecx, [esp + 0x14]
push ecx
jmp 0x449553
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 1
push 2
push ebx
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov eax, dword [esp + 0xe4]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x54]
push edx
push ebx
push ebx
push ebx
push eax
push ebx
push ebx
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x44959c
mov edx, dword [esp + 0x20]
push edx
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
mov bl, 1
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0xd4
ret 4