Function at 0x4966a2
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push 0x518
mov eax, 0x50d7cb
call fcn.0049caff
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x4d8], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4e8], eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x4e0], ebx
push eax
mov dword [ebp - 0x4dc], ebx
mov dword [ebp - 0x4d4], ebx
movups xmmword [ebp - 0x524], xmm0
call fcn.004904db
pop ecx
pop ecx
lea eax, [ebp - 0x4d4]
mov dword [ebp - 4], ebx
push eax
push 0x20
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x496f5f
jmp 0x4967aa
xor esi, esi
lea edi, [ebp - 0x38]
xor eax, eax
inc esi
mov dword [ebp - 0x3c], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push str.SeIncreaseQuotaPrivilege
push ebx
call dword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x496861
push 0x7a
push 0x539d24
mov byte [ebp - 4], 3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x454]
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0x454]
jmp 0x496f89
or dword [ebp - 0x30], 2
lea eax, [ebp - 0x3c]
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x4d4]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x49691c
push 0x89
push 0x539d24
mov byte [ebp - 4], 5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x3f0]
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0x3f0]
jmp 0x496f89
call dword [sym.imp.USER32.dll_GetShellWindow]
mov edi, eax
test edi, edi
jne 0x4969c0
push 0x95
push 0x539d24
push 2
lea ecx, [ebp - 0x38c]
mov byte [ebp - 4], 7
call fcn.00417524
push 0x5581cc
lea eax, [ebp - 0x38c]
jmp 0x496f89
lea eax, [ebp - 0x4cc]
mov dword [ebp - 0x4cc], ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x4cc], 0
jne 0x496a75
push 0x9d
push 0x539d24
push 5
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 9
call fcn.00417524
push 0x5581cc
lea eax, [ebp - 0x328]
jmp 0x496f89
push dword [ebp - 0x4cc]
push ebx
push 0x400
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov dword [ebp - 0x4bc], eax
test eax, eax
jne 0x496b30
push 0xa5
push 0x539d24
mov byte [ebp - 4], 0xb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x2c4]
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0x2c4]
jmp 0x496f89
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp edi, eax
je 0x496bd2
push 0xab
push 0x539d24
push 6
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xd
call fcn.00417524
push 0x5581cc
lea eax, [ebp - 0x260]
jmp 0x496f89
mov edi, dword [ebp - 0x4bc]
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
cmp dword [ebp - 0x4cc], eax
je 0x496c7f
push 0xb0
push 0x539d24
push 6
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 0xf
call fcn.00417524
push 0x5581cc
lea eax, [ebp - 0x1fc]
jmp 0x496f89
lea eax, [ebp - 0x4e0]
push eax
push 2
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
jne 0x496d32
push 0xb7
push 0x539d24
mov byte [ebp - 4], 0x11
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x198]
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0x198]
jmp 0x496f89
lea eax, [ebp - 0x4dc]
push eax
push esi
push 2
push ebx
push 0x18b
push dword [ebp - 0x4e0]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x496df1
push 0xcf
push 0x539d24
mov byte [ebp - 4], 0x13
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x134]
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0x134]
jmp 0x496f89
mov ecx, dword [ebp - 0x4d0]
mov eax, 0x52ee50
mov esi, dword [ebp - 0x4d8]
test ecx, ecx
cmovne eax, ecx
mov ecx, esi
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x54]
push eax
call fcn.0041042e
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x15
push ecx
mov ecx, eax
call fcn.00426310
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 0x16
push ecx
push eax
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x539e10
mov dword [eax + 4], 5
lea eax, [ebp - 0x2c]
push eax
call fcn.00492231
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x496e58
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x496e60
mov esi, dword [esi]
push dword [ebp - 0x4e8]
push dword [ebp - 0x4c0]
push dword [ebp - 0x4c8]
push ebx
push ebx
push eax
push esi
push ebx
push dword [ebp - 0x4dc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040dd89
lea ecx, [ebp - 0x6c]
call fcn.0040dd89
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.0040dd89
test esi, esi
jne 0x496f4e
push 0xe4
push 0x539d24
mov byte [ebp - 4], 0x17
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0xd0]
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0xd0]
jmp 0x496f89
lea ecx, [ebp - 0x4e4]
call fcn.00492a5b
call fcn.0049ca51
ret
push 0x6c
push 0x539d24
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x4b8]
call fcn.00417547
push 0x5581cc
lea eax, [ebp - 0x4b8]
push eax
call fcn.004a6281
int3