Function at 0x14013b680
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0xc0]
xorps xmm0, xmm0
mov rbx, rcx
mov qword [rbp - 0x80], r9
xor esi, esi
mov qword [rsp + 0x78], rax
mov ecx, edx
mov qword [rsp + 0x68], rsi
and ecx, 0x3000
mov dword [rbp - 0x40], 0x68
xor r14b, r14b
mov r13, r8
mov edi, edx
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
cmp ecx, 0x3000
jne 0x14013b705
mov eax, 0xc00000f0
jmp 0x14013bdcd
cmp qword [rbx], rsi
jne 0x14013b71a
cmp qword [rbx + 8], rsi
jne 0x14013b71a
mov eax, 0xc0000030
jmp 0x14013bdcd
mov rax, qword [rbx + 0x20]
mov r8d, 1
mov qword [rsp + 0x1a8], r12
mov dword [rbp - 4], r8d
mov word [rbp], r8w
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x160], r15
bt edi, 0x12
jae 0x14013b972
test ecx, ecx
mov r12d, esi
mov r15, 0xffffffffffffffff
sete al
bt edi, 0x10
movzx ecx, al
cmovae r12d, ecx
bt edi, 0x11
jae 0x14013b7a4
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x48]
mov edx, 0x18
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, 0xffffffff
movzx r12d, r12b
test eax, eax
mov r8d, 1
cmovns ecx, dword [rbp + 0x48]
cmp dword [rbx + 0x28], ecx
cmovne r12d, esi
mov eax, dword [rbx + 0x48]
test eax, eax
je 0x14013b7b4
cmp eax, 2
jne 0x14013b972
test r12b, r12b
je 0x14013b972
xor eax, eax
xorps xmm0, xmm0
mov r14, rsi
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x30], xmm0
cmp dword [rbx + 0x4c], eax
jne 0x14013b7d6
mov dword [rbx + 0x4c], r8d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14013b7e8
nop
call sym.SystemInformer.exe_PhCreateString
mov r14, rax
mov edx, edi
mov ecx, esi
or edx, 2
cmp qword [rbx + 0x18], rsi
cmovne edx, edi
test dl, 0x20
je 0x14013b803
lfence
mov ecx, 1
test dl, 0x40
je 0x14013b80e
lfence
or ecx, 2
test dl, 4
je 0x14013b819
lfence
or ecx, 4
test dl, 0x10
je 0x14013b824
lfence
or ecx, 0x10
test dl, 2
je 0x14013b830
lfence
bts ecx, 0xa
test dl, dl
jns 0x14013b83b
lfence
bts ecx, 0x13
nop dword [rax + rax]
test dl, 8
je 0x14013b84c
lfence
bts ecx, 0x18
bt edx, 8
jae 0x14013b859
lfence
bts ecx, 0x1a
test r14, r14
je 0x14013b864
mov rdx, qword [r14 + 8]
jmp 0x14013b867
mov rdx, rsi
mov r9d, dword [rbx + 0x4c]
lea rax, [rbp + 0x30]
mov r8, qword [rbx + 0x40]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbx + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x14013b8dc
cmp dword [0x1402c0f40], 0xffffffff
jae 0x14013b8cd
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14013b8d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov esi, eax
nop dword [rax]
test r14, r14
je 0x14013b8fa
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x14013b8fa
call fcn.140142200
test esi, esi
js 0x14013b94c
nop
test r13, r13
je 0x14013b913
mov eax, dword [rbp + 0x40]
mov qword [r13], rax
mov eax, dword [rbp + 0x44]
mov qword [r13 + 8], rax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14013b925
mov rax, qword [rbp + 0x30]
mov qword [rcx], rax
jmp 0x14013b934
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013b934
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14013b95b
mov rax, qword [rbp + 0x38]
mov qword [rcx], rax
mov eax, esi
jmp 0x14013bdbd
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013b95b
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp + 0x38]
test rcx, rcx
je 0x14013b96b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013bdbd
bt edi, 0xc
jae 0x14013ba45
cmp dword [0x1402ced08], 3
lea rcx, [rsp + 0x70]
mov rax, qword [rbx + 0x30]
mov edx, 0x1000
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rsi
jl 0x14013b9a7
lea r8, ds:[rbp + 0x30]
call fcn.1401783e0
jmp 0x14013b9d6
xorps xmm0, xmm0
mov dword [rbp - 0x78], 0x30
lea r9, [rbp + 0x30]
mov qword [rbp - 0x70], rsi
lea r8, [rbp - 0x78]
mov dword [rbp - 0x60], esi
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
je 0x14013ba3d
test eax, eax
js 0x14013ba3d
mov r15, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
mov r12d, dword [0x1402ced08]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov r14d, eax
cmp eax, 0xc0000022
jne 0x14013ba22
cmp r12d, 5
jne 0x14013ba22
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.140178520
mov r14d, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
jns 0x14013ba97
lfence
mov eax, r14d
jmp 0x14013bdbd
lfence
jmp 0x14013bdbd
bt edi, 0xd
jae 0x14013bb27
mov edx, dword ds:[rbx + 0x30]
lea r9, [rbp + 0x30]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x40], rax
mov r8d, 0xe
lea rax, [rbp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
movups xmmword [rbp + 0x30], xmm0
call qword [sym.imp.WINSTA.dll_WinStationQueryInformationW]
test al, al
je 0x14013bbe8
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov r14d, edi
shr r14d, 0x11
and r14b, 1
bt edi, 0x10
jae 0x14013bc26
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x50]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x30]
mov edx, 0x13
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x14013bc26
mov r15, qword [rbp + 0x30]
lea rax, [rsp + 0x70]
mov rcx, r15
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x48]
mov edx, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax]
test eax, eax
js 0x14013bc1c
cmp dword [rbp + 0x48], 1
jne 0x14013bc1c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], r15
jmp 0x14013bc91
mov r15d, dword [rbx + 0x48]
test r15d, r15d
jne 0x14013bbba
mov rcx, qword [rbx + 0x30]
mov r15d, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013bbba
lea rdx, str.NT_AUTHORITY
call fcn.1401ebed4
test eax, eax
jne 0x14013bbba
mov rcx, qword [rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x14013bb74
lea rdx, str.SYSTEM
call fcn.1401ebed4
test eax, eax
je 0x14013bbb4
mov rcx, qword ds:[rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x14013bb98
lea rdx, str.LOCAL_SERVICE
call fcn.1401ebed4
test eax, eax
je 0x14013bbb4
mov rcx, qword [rbx + 0x38]
movzx eax, byte ds:[rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013bbba
lea rdx, str.NETWORK_SERVICE
call fcn.1401ebed4
test eax, eax
jne 0x14013bbba
mov r15d, 5
mov r8, qword [rbx + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rbx + 0x30]
mov r9d, r15d
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
nop dword [rax]
test eax, eax
jne 0x14013baa2
cmp dword [0x1402c0f40], 0xffffffff
jae 0x14013bc0a
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
jmp 0x14013bdbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
jmp 0x14013bdbd
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtClose]
test r14b, r14b
je 0x14013bc91
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp - 0x78]
mov dword [rbp - 0x78], 0x30
mov edx, 0xf01ff
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x60], esi
mov qword [rbp - 0x68], rsi
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x60]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x14013bc88
lfence
mov eax, esi
jmp 0x14013bdbd
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x60], rax
bt edi, 0x11
jae 0x14013bcbd
mov eax, dword [rbx + 0x28]
lea r8, [rbp + 0x48]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov edx, 0xc
mov dword [rbp + 0x48], eax
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
js 0x14013bcec
bt edi, 0x13
jae 0x14013bd05
mov rcx, qword ds:[rsp + 0x60]
lea r8, [rbp + 0x48]
mov r9d, 4
mov dword [rbp + 0x48], 1
mov edx, 0x1a
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
jns 0x14013bd05
lfence
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013bdbd
cmp qword [rbx + 0x18], 0
jne 0x14013bd39
call fcn.1401739c0
test rax, rax
je 0x14013bd39
call fcn.1401739c0
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call qword [case.0x14013dbaa.0]
cmp qword [rsp + 0x68], 0
je 0x14013bd39
or edi, 2
mov rax, qword [rbx + 0x18]
mov rcx, qword [rsp + 0x78]
test rax, rax
mov r8, qword [rsp + 0x68]
mov r9, qword [rbx + 0x10]
cmovne r8, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call sym.SystemInformer.exe_PhCreateProcessWin32Ex
mov ebx, eax
call fcn.140173b80
test rax, rax
je 0x14013bdb0
cmp qword [rsp + 0x68], 0
je 0x14013bdb0
nop dword [rax]
call fcn.140173b80
mov rcx, qword [rsp + 0x68]
call qword [case.0x14013dbaa.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov r12, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x160]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x168
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret