Function at 0x140045030
Capabilities:
Check if file exists
Create process on windows
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], r9
mov r15, qword [rbp + 0x300]
mov qword [rbp - 0x20], r15
mov r12, qword [rbp + 0x308]
mov qword [rbp - 0x18], r12
mov r13, qword [rbp + 0x310]
cmp qword [rdx + 0x10], 0
je 0x1400455bc
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400450aa
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400455bc
xor ebx, ebx
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
mov qword [rbp + 8], 7
mov word [rbp - 0x10], bx
mov qword [rsp + 0x68], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov dword [rbp + 0x74], eax
mov dword [rbp + 0x10], 0x68
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x10]
cmp rax, rdi
je 0x14004512f
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140045122
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140011160
cmp qword [r14 + 0x10], 0
je 0x140045166
mov r8d, 1
lea rdx, [0x1401001bc]
lea rcx, [rbp - 0x10]
call fcn.140012440
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140045159
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140012440
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400451da
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x40], rbx
mov dword [rbp - 0x70], 0x38
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x80]
call fcn.1400a83f0
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400451ab
mov r8, qword [rsi]
lea rdx, [0x140103020]
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x80]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x6c], 1
mov rax, qword [rsi + 0x10]
test rax, rax
jne 0x140045254
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x14004523d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Execute::CreateProcess_Error_d
jmp 0x1400453b8
test r13, r13
je 0x1400453c7
mov rax, qword [rsp + 0x78]
mov qword [r13], rax
jmp 0x1400453c7
cmp qword [r15 + 0x10], 0
jne 0x140045264
lea rdx, [0x140103070]
jmp 0x140045271
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x140045271
mov rdx, qword [r15]
mov r8, r12
cmp qword [r12 + 0x18], 8
jb 0x140045280
mov r8, qword [r12]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14004528d
mov rcx, qword [rsi]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x1400453ab
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x14004539c
mov r8d, 1
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14004536f
lea r8, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae r8, qword [rbp - 0x10]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [rsp + 0x60], eax
test eax, eax
jne 0x140045350
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Execute::CreateProcessAsUserW_Error_d
jmp 0x14004537c
test r13, r13
je 0x14004538b
mov rax, qword [rsp + 0x78]
mov qword [r13], rax
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
jmp 0x1400453c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Execute::CreateEnvironmentBlock_Error_d
mov r8d, eax
mov rcx, qword [0x140132990]
call fcn.140011f10
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
jmp 0x1400453c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Execute::LoadUserProfileW_Error_d
jmp 0x1400453b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Execute::LogonUser_Error_d
mov r8d, eax
mov rcx, qword [0x140132990]
call fcn.140011f10
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400453d7
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400453e8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140045428
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045423
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045780
call fcn.1400a59a4
mov qword [rbp], rbx
mov qword [rbp + 8], 7
mov word [rbp - 0x10], bx
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140045477
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140045472
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045786
mov rcx, r8
call fcn.1400a59a4
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x1400454c5
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400454c0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004578c
mov rcx, r8
call fcn.1400a59a4
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x140045514
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004550f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045792
mov rcx, r8
call fcn.1400a59a4
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x140045562
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004555d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045774
mov rcx, r8
call fcn.1400a59a4
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov word [r15], bx
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x1400455b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x1400455ae
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004577a
mov rcx, r8
call fcn.1400a59a4
mov eax, dword [rsp + 0x60]
jmp 0x140045737
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400455fb
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400455f6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045786
mov rcx, r8
call fcn.1400a59a4
xor ebx, ebx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14004564b
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140045646
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004578c
mov rcx, r8
call fcn.1400a59a4
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14004569a
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140045695
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045792
mov rcx, r8
call fcn.1400a59a4
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x1400456e8
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400456e3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045774
mov rcx, r8
call fcn.1400a59a4
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov word [r15], bx
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x140045735
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x140045730
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004577a
mov rcx, r8
call fcn.1400a59a4
xor eax, eax
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], 7
mov word [r12], bx
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400a5460
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
int3