Function at 0x140016680
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov esi, edx
xor r12d, r12d
mov dword [rbp - 0x70], r12d
call fcn.140014190
mov rcx, rax
lea rdi, [0x1400e8328]
mov r9, rdi
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
xor edx, edx
call fcn.14009cf00
mov ebx, r12d
mov qword [rbp - 0x38], rbx
call fcn.140014190
cmp byte [rax + 0x64], r12b
je 0x14001673c
lea ecx, [r12 + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140016735
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x140016738
mov rbx, r12
mov qword [rbp - 0x38], rbx
call fcn.140014190
mov rcx, rax
lea r9, str.Enter_StartApplicationLauncher
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14009cf00
mov rax, 0xffffffffffffffff
mov qword [rbp - 0x30], rax
call fcn.140015f40
test eax, eax
jne 0x14001677c
mov dil, 1
lea rsi, str.Error_:_No_Active_sessions_found.
jmp 0x14001679a
mov ecx, eax
call fcn.140015d00
mov r14, rax
mov qword [rbp - 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x1400167bb
xor dil, dil
lea rsi, str.GetActiveSessionToken_failed
call fcn.140014190
mov rcx, rax
mov r9, rsi
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14009cf00
jmp 0x1400171fd
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1400167fc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.ImpersonateLoggedOnUser_failed_with_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14009cf00
xor dil, dil
jmp 0x1400171fd
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r15d, 2
mov r9d, r15d
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x14001685e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.DuplicateTokenEx_failed_with_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [r15 + 3]
call fcn.14009cf00
xor dil, dil
jmp 0x1400171fd
lea r8, [rbp + 0xb0]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400168ac
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Lookup_Privilege_value_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14009cf00
xor dil, dil
jmp 0x1400171fd
mov dword [rbp + 0xb8], 1
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xbc], rax
mov dword [rbp + 0xc4], r15d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rbp + 0xb8]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140016926
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Adjust_Privilege_value_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14009cf00
xor dil, dil
jmp 0x1400171fd
mov qword [rbp - 0x28], r12
mov r8d, 1
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x28]
call sub.USERENV.dll_CreateEnvironmentBlock
mov r13d, r12d
mov ecx, 0x400
test eax, eax
cmovne r13d, ecx
mov dword [rbp - 0x78], r13d
mov qword [rsp + 0x60], rdi
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r12w
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.140013240
nop
mov r12d, 5
cmp esi, 1
jne 0x140016a86
call fcn.140014190
mov rcx, rax
lea r9, str.Launching_windows_MSInfo_executable
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [rsi + 2]
call fcn.14009cf00
lea rdi, str.C:WindowsSystem32msinfo32.exe
xor r15d, r15d
mov rsi, qword [rsp + 0x60]
or r13d, 0x30
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
mov dword [rbp], 0x68
lea rax, str.winsta0default
mov qword [rbp + 0x10], rax
mov word [rbp + 0x40], r12w
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea rax, [rbp]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rsi
mov rdx, rdi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140017127
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.CreateProcessAsUser_failed_with_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, r12d
call fcn.14009cf00
xor dil, dil
jmp 0x1400171a1
cmp esi, 2
jne 0x140016aae
call fcn.140014190
mov rcx, rax
lea r9, str.Launching_HP_UWP_App_is_not_implemented
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [rsi + 2]
call fcn.14009cf00
jmp 0x1400169bc
cmp esi, 3
jne 0x1400170c0
call fcn.140014190
mov rcx, rax
lea r9, str.Launching_HPHotkeyNotification
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, esi
call fcn.14009cf00
call fcn.140014190
mov rcx, rax
lea rax, str.C:WindowsSystem32HPHotkeyNotification.exe
mov qword [rsp + 0x20], rax
lea r9, str.HPHotkeyNotification_Path_is__s
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, r15d
call fcn.14009cf00
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1f0]
call fcn.1400a57c0
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x140016b60
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_find_Service_file_executable_.Error:_0x_08X
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, r12d
call fcn.14009cf00
xor r15d, r15d
xor dil, dil
jmp 0x1400171a1
xor esi, esi
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
lea rax, [rbp + 0x1f0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x140016b90
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x70]
call fcn.140013240
nop
lea rdi, [rbp + 0x70]
mov r13, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x88]
cmp rsi, 8
cmovae rdi, r13
movabs rax, 0x7ffffffffffffffe
mov r14, qword [rbp + 0x80]
test r14, r14
je 0x140016cf5
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xf0]
call fcn.1400a57c0
lea rcx, [0x1400eacc4]
lea r8, [0x1400eacc6]
mov edx, 0x100
movzx eax, word [rcx]
cmp ax, dx
jae 0x140016c57
movzx eax, al
mov byte [rbp + rax + 0xf0], 1
add rcx, 2
cmp rcx, r8
jne 0x140016c03
lea rcx, [r14 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdi + rax*2]
movzx eax, word [r8]
cmp ax, dx
jae 0x140016c48
cmp byte [rbp + rax + 0xf0], 0
jne 0x140016c9f
cmp r8, rdi
je 0x140016ceb
sub r8, 2
jmp 0x140016c35
lea rcx, [r14 - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdi + rax*2]
mov ecx, 1
lea rax, [0x1400eacc4]
movzx edx, word [r8]
cmp word [rax], dx
je 0x140016c9f
add rax, 2
sub rcx, 1
jne 0x140016c80
cmp r8, rdi
je 0x140016c9a
sub r8, 2
jmp 0x140016c70
mov r8, r9
jmp 0x140016ca5
sub r8, rdi
sar r8, 1
cmp r8, 0xffffffffffffffff
je 0x140016ceb
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], di
cmp r14, r8
cmovb r8, r14
lea rdx, [rbp + 0x70]
cmp rsi, 8
cmovae rdx, r13
lea rcx, [rsp + 0x68]
call fcn.140013240
lea rax, [rsp + 0x68]
mov r15d, r12d
jmp 0x140016d6a
movabs rax, 0x7ffffffffffffffe
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rsi, r13
cmp r14, 8
jae 0x140016d1c
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x40], 7
jmp 0x140016d60
mov rdi, r14
or rdi, 7
cmp rdi, rax
cmova rdi, rax
mov rdx, rdi
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140012fe0
mov qword [rbp - 0x58], rax
lea r8, [r14*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.1400a5110
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r14
lea rax, [rbp - 0x58]
xor edi, edi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
test r15b, 2
je 0x140016dd9
and r15d, 0xfffffffd
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140016dd9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016dd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017251
call fcn.140095e90
nop
test r15b, 1
je 0x140016e20
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016e20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016e1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017257
call fcn.140095e90
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rbp + 0xd8]
sub rax, r15
cmp rax, 1
jb 0x14001725d
lea rdx, [rbp + 0xc8]
mov r14, qword [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, r14
mov qword [rbp - 0x70], rdx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
lea r13, [r15 + 1]
mov edi, 7
lea rsi, [rsp + 0x68]
cmp r13, rdi
jbe 0x140016f1d
mov rdi, r13
or rdi, 7
cmp rdi, rcx
jbe 0x140016e95
mov rdi, rcx
jmp 0x140016ea1
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
mov rax, rdi
add rax, 1
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140017269
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140016f03
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140017269
mov rcx, rax
call fcn.140095e50
test rax, rax
je 0x140017263
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rdx, qword [rbp - 0x70]
jmp 0x140016f18
test rcx, rcx
je 0x140016f16
call fcn.140095e50
mov rsi, rax
mov rdx, qword [rbp - 0x70]
jmp 0x140016f18
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], rdi
lea rdi, [r15 + r15]
mov r8, rdi
mov rcx, rsi
call fcn.1400a5110
mov eax, 0x5c
mov word [rsi + rdi], ax
xor r15d, r15d
mov word [rsi + r13*2], r15w
lea rdx, str.HPHotkeyNotification.exe
lea rcx, [rsp + 0x68]
call fcn.140017280
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp + 0x90]
call fcn.140012b50
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rbp + 0xa0], xmm1
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140016fd9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016fd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017263
call fcn.140095e90
lea rdi, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdi, qword [rbp + 0x90]
call fcn.140014190
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, str.HPHotkeyNotification_complete_path_:__s
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14009cf00
nop
mov rax, qword [rbp + 0xe0]
cmp rax, 8
jb 0x140017059
lea rdx, [rax*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140017050
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001726f
mov rcx, r14
call fcn.140095e90
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x14001709c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017097
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140017275
call fcn.140095e90
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r15w
mov r14, qword [rbp - 0x60]
mov r13d, dword [rbp - 0x78]
jmp 0x1400169bf
cmp esi, 4
jne 0x1400169bc
call fcn.140014190
mov rcx, rax
lea r9, str.Launching_Windows_Power_Options
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [rsi - 1]
call fcn.14009cf00
lea rdi, str.C:WindowsSystem32control.exe
call fcn.140014190
mov rcx, rax
lea rsi, str.__name_Microsoft.PowerOptions
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r9, str.Power_Options_complete_path_:__s_s
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14009cf00
xor r15d, r15d
jmp 0x1400169c4
call fcn.140014190
mov rcx, rax
lea r9, str.Process_launched_successfully
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14009cf00
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140017155
call sub.USERENV.dll_DestroyEnvironmentBlock
mov rcx, qword [rbp - 0x20]
cmp rcx, 0xffffffffffffffff
je 0x140017165
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
cmp rcx, 0xffffffffffffffff
je 0x140017175
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call fcn.140014190
mov rcx, rax
lea r9, str.Exit_StartApplicationLauncher
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14009cf00
mov dil, 1
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x1400171e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400171de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001724b
call fcn.140095e90
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r15w
test rbx, rbx
je 0x140017217
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
movzx eax, dil
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400964b0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400b1720
nop
call fcn.1400b1720
nop
call fcn.1400b1720
int3
call fcn.140012ec0
int3
call fcn.1400b1720
int3
call fcn.140012a80
nop
call fcn.1400b1720
nop
call fcn.1400b1720
int3