Function at 0x4049f7
Capabilities:
Create process on windows
Create process suspended
Set current directory

Disassembly:
push 0x17c
mov eax, 0x442ed3
call fcn.00424a85
mov ebx, edx
mov edi, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
push 8
mov dword [ebp - 0x74], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404c16
and dword [ebp - 0x84], 0
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 2
push eax
push 0x12
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x78]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x404c13
cmp dword [ebp - 0x7c], 2
je 0x404c13
cmp dword [ebx + 0x14], 8
jb 0x404a7e
mov eax, dword [ebx]
jmp 0x404a80
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x404ab9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [edi + 8], 0
mov esi, eax
je 0x404aa7
push str.SetCurrentDirectory_failed_
push 0x45
mov ecx, edi
call fcn.004039ae
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x404c39
cmp dword [edi + 8], 0
je 0x404acd
push str.Creating_process...
push 0x49
mov ecx, edi
call fcn.004039ae
push ebx
lea ecx, [ebp - 0x58]
call fcn.0040a83e
xor ebx, ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov edx, eax
mov dword [esp], str.NVIDIA_Web_Helper.exe_
call fcn.0040a56e
push dword [ebp - 0x80]
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040a3e3
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0040812d
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0040812d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0xd4]
push 0x40
push ebx
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
call fcn.004272a0
add esp, 0xc
mov dword [ebp - 0xd8], 0x44
lea eax, [ebp - 0x94]
xorps xmm0, xmm0
movups xmmword [ebp - 0x94], xmm0
push eax
lea eax, [ebp - 0xd8]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x404bf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push ecx
lea ecx, [ebp - 0x188]
mov ebx, eax
call fcn.0040678e
push ebx
mov edx, str.CreateProcess_failed_with
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x178]
call fcn.0040a64a
mov ecx, eax
call fcn.00406e55
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x188]
call fcn.00406743
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x404bbe
mov eax, dword [eax]
cmp dword [edi + 8], 0
je 0x404bce
push eax
push 0x45
mov ecx, edi
call fcn.004039ae
push 0
push 1
lea ecx, [ebp - 0x70]
call fcn.00408384
lea ecx, [ebp - 0x188]
call fcn.004049a9
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
xor ebx, ebx
jmp 0x404c04
mov ecx, dword [ebp - 0x74]
mov esi, ebx
mov eax, dword [ebp - 0x94]
mov dword [ecx], eax
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.0040812d
mov eax, esi
jmp 0x404c39
mov esi, dword [ebp - 0x74]
cmp dword [edi + 8], 0
je 0x404c2a
push str.Current_process_is_elevated__trying_to_create_unelevated
push 0x49
mov ecx, edi
call fcn.004039ae
push esi
push dword [ebp - 0x80]
mov edx, ebx
mov ecx, edi
call fcn.00403daf
pop ecx
pop ecx
call fcn.00424a2f
ret