Function at 0x494048
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push 0x518
mov eax, 0x508318
call fcn.00498168
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x4d8], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4e8], eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x4e0], ebx
push eax
mov dword [ebp - 0x4dc], ebx
mov dword [ebp - 0x4d4], ebx
movups xmmword [ebp - 0x524], xmm0
call fcn.0048e6fb
pop ecx
pop ecx
lea eax, [ebp - 0x4d4]
mov dword [ebp - 4], ebx
push eax
push 0x20
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x494905
jmp 0x494150
xor esi, esi
lea edi, [ebp - 0x38]
xor eax, eax
inc esi
mov dword [ebp - 0x3c], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push str.SeIncreaseQuotaPrivilege
push ebx
call dword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x494207
push 0x79
push 0x533ba4
mov byte [ebp - 4], 3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x454]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x454]
jmp 0x49492f
or dword [ebp - 0x30], 2
lea eax, [ebp - 0x3c]
push ebx
push ebx
push ebx
push eax
push ebx
push dword [ebp - 0x4d4]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4942c2
push 0x88
push 0x533ba4
mov byte [ebp - 4], 5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x3f0]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x3f0]
jmp 0x49492f
call dword [sym.imp.USER32.dll_GetShellWindow]
mov edi, eax
test edi, edi
jne 0x494366
push 0x94
push 0x533ba4
push 2
lea ecx, [ebp - 0x38c]
mov byte [ebp - 4], 7
call fcn.004173ff
push 0x5519c4
lea eax, [ebp - 0x38c]
jmp 0x49492f
lea eax, [ebp - 0x4cc]
mov dword [ebp - 0x4cc], ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x4cc], 0
jne 0x49441b
push 0x9c
push 0x533ba4
push 5
lea ecx, [ebp - 0x328]
mov byte [ebp - 4], 9
call fcn.004173ff
push 0x5519c4
lea eax, [ebp - 0x328]
jmp 0x49492f
push dword [ebp - 0x4cc]
push ebx
push 0x400
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov dword [ebp - 0x4bc], eax
test eax, eax
jne 0x4944d6
push 0xa4
push 0x533ba4
mov byte [ebp - 4], 0xb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x2c4]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x2c4]
jmp 0x49492f
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp edi, eax
je 0x494578
push 0xaa
push 0x533ba4
push 6
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xd
call fcn.004173ff
push 0x5519c4
lea eax, [ebp - 0x260]
jmp 0x49492f
mov edi, dword [ebp - 0x4bc]
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
cmp dword [ebp - 0x4cc], eax
je 0x494625
push 0xaf
push 0x533ba4
push 6
lea ecx, [ebp - 0x1fc]
mov byte [ebp - 4], 0xf
call fcn.004173ff
push 0x5519c4
lea eax, [ebp - 0x1fc]
jmp 0x49492f
lea eax, [ebp - 0x4e0]
push eax
push 2
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
jne 0x4946d8
push 0xb6
push 0x533ba4
mov byte [ebp - 4], 0x11
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x198]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x198]
jmp 0x49492f
lea eax, [ebp - 0x4dc]
push eax
push esi
push 2
push ebx
push 0x18b
push dword [ebp - 0x4e0]
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x494797
push 0xce
push 0x533ba4
mov byte [ebp - 4], 0x13
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x134]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x134]
jmp 0x49492f
mov ecx, dword [ebp - 0x4d0]
mov eax, 0x52ce20
mov esi, dword [ebp - 0x4d8]
test ecx, ecx
cmovne eax, ecx
mov ecx, esi
mov dword [ebp - 0x4d0], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00410309
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x15
push ecx
mov ecx, eax
call fcn.00426101
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 0x16
push ecx
push eax
push ecx
push ecx
mov eax, esp
mov dword [eax], 0x533c90
mov dword [eax + 4], 5
lea eax, [ebp - 0x2c]
push eax
call fcn.00490346
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x4947fe
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x494806
mov esi, dword [esi]
push dword [ebp - 0x4e8]
push dword [ebp - 0x4c0]
push dword [ebp - 0x4c8]
push ebx
push ebx
push eax
push esi
push ebx
push dword [ebp - 0x4dc]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040dc64
lea ecx, [ebp - 0x6c]
call fcn.0040dc64
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.0040dc64
test esi, esi
jne 0x4948f4
push 0xe3
push 0x533ba4
mov byte [ebp - 4], 0x17
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0xd0]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0xd0]
jmp 0x49492f
lea ecx, [ebp - 0x4e4]
call fcn.00490a9f
call fcn.004980ba
ret
push 0x6b
push 0x533ba4
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 4
lea ecx, [ebp - 0x4b8]
call fcn.00417422
push 0x5519c4
lea eax, [ebp - 0x4b8]
push eax
call fcn.004a1a51
int3