Function at 0x1400ab1ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4040]
mov eax, 0x4140
call fcn.1401da3f0
sub rsp, rax
mov rax, qword [0x14030cf00]
xor rax, rsp
mov qword [rbp + 0x4030], rax
mov eax, dword [rbp + 0x40b0]
mov r13, rcx
mov r15, qword [rbp + 0x40a8]
mov r14d, r9d
mov rsi, qword [rbp + 0x40a0]
mov rbx, r8
mov dword [rsp + 0x60], eax
xorps xmm0, xmm0
mov qword [rbp - 0x50], rcx
mov eax, r9d
mov ecx, 0x8000
mov qword [rbp - 0x78], rdx
and eax, ecx
mov dword [rsp + 0x7c], r9d
xor r14d, ecx
mov qword [rbp - 0x58], r15
xor ecx, ecx
test eax, eax
mov qword [rsp + 0x68], rcx
mov r12d, ecx
mov qword [rsp + 0x70], rcx
cmove r14d, r9d
mov dword [rsp + 0x64], ecx
xor eax, eax
lea r8d, [rcx + 0x64]
xor edx, edx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x3c]
movups xmmword [rbp - 0x70], xmm0
call fcn.14020e630
mov edi, 0xffffffff
cmp r14d, 5
je 0x1400ab2c6
test r14d, r14d
je 0x1400ab3b2
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x78], eax
cmp eax, edi
je 0x1400ab988
cmp r14d, 4
je 0x1400ab3b2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, 2
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400ab30b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x216
mov r9d, edi
mov dword [rsp + 0x20], eax
lea rdx, str.C:Users_anfdhDownloadsMeshAgent_masterMeshAgent_mastermicrostackILibProcessPipe.c
xor ecx, ecx
call fcn.1400aa25c
jmp 0x1400ab988
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400ab350
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x217
jmp 0x1400ab2f1
cmp r14d, 5
jne 0x1400ab35a
mov dword [rsp + 0x78], esi
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov r9d, 4
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1400ab39f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x219
jmp 0x1400ab2f1
cmp r14d, edi
lea rax, str.Winsta0Winlogon
cmovne rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rax
test rbx, rbx
je 0x1400ab47b
mov rax, qword [rbx]
test rax, rax
je 0x1400ab47b
cmp qword [rbx + 8], r12
jne 0x1400ab3d5
mov r12, rax
jmp 0x1400ab47b
xor esi, esi
xor edi, edi
mov edx, 0x10000
mov rcx, rax
call fcn.1401e9dbc
inc eax
inc rdi
add r12d, eax
inc esi
mov rax, qword [rbx + rdi*8]
test rax, rax
jne 0x1400ab3d9
lea eax, [r12 - 1]
add eax, esi
movsxd rcx, eax
mov dword [rbp - 0x7c], eax
call fcn.1401ea40c
mov r8, qword [rbx]
xor edi, edi
and dword [rbp - 0x80], 0
mov r12, rax
mov dword [rsp + 0x64], 1
test r8, r8
je 0x1400ab47b
mov r15d, dword [rbp - 0x80]
xor esi, esi
mov r13d, dword [rbp - 0x7c]
lea rax, [0x14026eda8]
mov qword [rsp + 0x20], r8
test r15d, r15d
movsxd rcx, edi
lea r9, [0x140279cbc]
cmove r9, rax
lea r8, [0x1402729e0]
mov eax, r13d
add rcx, r12
sub eax, edi
movsxd rdx, eax
call fcn.140001114
inc rsi
add edi, eax
inc r15d
mov r8, qword [rbx + rsi*8]
test r8, r8
jne 0x1400ab42e
mov r15, qword [rbp - 0x58]
mov r13, qword [rbp - 0x50]
mov ecx, 0x80
call fcn.1401ea40c
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea edx, [r9 + 0x68]
call fcn.14009faa0
mov edi, dword [rsp + 0x60]
mov rsi, rax
lea rbx, [rax + 0x38]
cmp r14d, 4
je 0x1400ab4ba
mov r9d, edi
mov rcx, r13
call fcn.1400aae98
mov qword [rbx], rax
mov qword [rax + 0x40], rsi
mov qword [rsi + 0x10], r13
mov rax, qword [r13 + 0x20]
mov qword [rsi + 0x60], rax
mov dword [rbp - 0x40], 0x68
cmp r14d, 4
je 0x1400ab55a
mov r9d, edi
mov rcx, r13
call fcn.1400aae98
mov qword [rsi + 0x28], rax
mov r9d, edi
mov rcx, r13
mov qword [rax + 0x40], rsi
call fcn.1400aae98
mov qword [rsi + 0x30], rax
mov qword [rax + 0x40], rsi
mov rcx, qword [rsi + 0x28]
add rcx, 0x88
call fcn.1400aae34
mov rcx, qword [rsi + 0x30]
mov edi, 0x80
add rcx, rdi
call fcn.1400aae34
mov rcx, qword [rbx]
add rcx, rdi
call fcn.1400aae34
mov rax, qword [rbx]
mov rcx, qword [rax + 0x88]
mov qword [rbp + 0x20], rcx
mov rax, qword [rsi + 0x28]
mov rcx, qword [rax + 0x80]
mov qword [rbp + 0x10], rcx
mov rax, qword [rsi + 0x30]
mov rcx, qword [rax + 0x88]
bts dword [rbp - 4], 8
mov qword [rbp + 0x18], rcx
xor r13d, r13d
test r15, r15
je 0x1400ab6e0
mov ecx, r13d
mov r13, r15
mov dword [rsp + 0x60], ecx
xor edi, edi
cmp qword [r13], rdi
je 0x1400ab5ee
mov r8, qword [r13 + 8]
or r9d, 0xffffffff
mov dword [rsp + 0x28], edi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or r9d, 0xffffffff
mov dword [rsp + 0x28], edi
lea r8, [0x1402719c4]
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [rsp + 0x28], 0
or r9d, 0xffffffff
mov r8, qword [r13]
xor edx, edx
and qword [rsp + 0x20], 0
mov ecx, 0xfde9
lea edi, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x60]
add eax, edi
add ecx, eax
mov dword [rsp + 0x60], ecx
add r13, 0x10
jne 0x1400ab570
lea eax, [rcx + rcx]
movsxd rbx, eax
mov eax, 0xffffffff
cmp rbx, rax
jae 0x1400ab616
mov eax, 0xffffffe7
cmp rbx, rax
jae 0x1400ab616
lea rcx, [rbx + 0x18]
call fcn.1401ea40c
xor r13d, r13d
jmp 0x1400ab61c
xor r13d, r13d
mov eax, r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14009faa0
mov rdi, rax
mov ebx, r13d
mov r8, qword [r15]
test r8, r8
je 0x1400ab6dd
mov eax, dword [rdi - 0x18]
or r9d, 0xffffffff
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
lea rdx, [rdi + rcx*2]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or r9d, 0xffffffff
lea r8, [0x1402719c4]
dec eax
add ebx, eax
mov eax, dword [rdi - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [rdi + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [r15 + 8]
or r9d, 0xffffffff
dec eax
add ebx, eax
mov eax, dword [rdi - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [rdi + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add ebx, eax
add r15, 0x10
jne 0x1400ab633
mov r15, rdi
mov rdi, qword [rbp - 0x78]
mov ebx, 0x1000
test r14d, 0xfffffffb
jne 0x1400ab7ae
lea rax, [rbp + 0x2030]
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [rsp + 0x7c]
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x48], rdx
mov eax, ebx
and eax, 0x8000
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rdx
neg eax
mov eax, r13d
mov qword [rsp + 0x38], r13
sbb ecx, ecx
mov qword [rsp + 0x30], r15
and ecx, 0x208
lea rdx, [rbp + 0x30]
or ecx, 0x8000400
mov dword [rsp + 0x28], ecx
cmp r14d, 4
lea rcx, [rbp + 0x2030]
setne al
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400ab91d
test r14d, r14d
je 0x1400ab860
jmp 0x1400ab7b2
mov ebx, dword [rsp + 0x7c]
mov r8, rdi
mov dword [rsp + 0x28], 0x1000
lea rax, [rbp + 0x2030]
mov edi, 0xfde9
mov ecx, edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r12
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp - 0x70]
and ebx, 0x8000
mov qword [rsp + 0x50], rcx
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x40]
neg ebx
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x2030]
mov rcx, qword [rsp + 0x70]
sbb eax, eax
mov qword [rsp + 0x40], r13
and eax, 0x208
mov qword [rsp + 0x38], r15
or eax, 0x8000400
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1400ab91d
test r15, r15
je 0x1400ab86d
mov rcx, r15
call fcn.14009fb80
cmp dword [rsp + 0x64], r13d
je 0x1400ab87c
mov rcx, r12
call fcn.1401e8ee0
cmp r14d, 4
je 0x1400ab8d6
mov rcx, qword [rsi + 0x30]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x88], r13
mov rcx, qword [rsi + 0x38]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x38]
mov qword [rax + 0x88], r13
mov rcx, qword [rsi + 0x28]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x28]
mov qword [rax + 0x80], r13
mov rax, qword [rbp - 0x70]
mov qword [rsi + 0x50], rax
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400ab8ed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x60]
mov dword [rsi + 0x18], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400ab908
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400ab918
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x1400ab98a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp r14d, 4
je 0x1400ab944
mov rcx, qword [rsi + 0x38]
call fcn.1400aacbc
mov rcx, qword [rsi + 0x30]
call fcn.1400aacbc
mov rcx, qword [rsi + 0x28]
call fcn.1400aacbc
cmp dword [rsp + 0x64], r13d
je 0x1400ab953
mov rcx, r12
call fcn.1401e8ee0
mov rcx, rsi
call fcn.14009fb80
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400ab96b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400ab97b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1400ab988
mov rcx, r15
call fcn.14009fb80
xor eax, eax
mov rcx, qword [rbp + 0x4030]
xor rcx, rsp
call fcn.1401d9e80
mov rbx, qword [rsp + 0x4180]
add rsp, 0x4140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret