Function at 0x1400d4560
Capabilities:
Create process on windows
Impersonate user

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x128]
sub rsp, 0x228
xorps xmm0, xmm0
mov dword [rbp + 0x10], 0x68
xor esi, esi
xor r15b, r15b
test byte [0x14018ac20], 1
mov r14d, edx
mov rdi, rcx
mov qword [rsp + 0x70], rsi
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
jne 0x1400d4658
lock bts qword [0x14018ac20], 0x1f
setb al
test al, al
je 0x1400d45ea
test byte [0x14018ac20], 1
jne 0x1400d4658
xor edx, edx
lea rcx, [0x14018ac20]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfWaitForEvent
jmp 0x1400d4658
lea rcx, str.winsta.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [0x1401666d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.userenv.dll
mov qword [0x1401901d8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.CreateEnvironmentBlock
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
mov qword [0x140190200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14018ac20]
mov qword [0x1401901c8], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfSetEvent
mov ecx, r14d
and ecx, 0x3000
cmp ecx, 0x3000
jne 0x1400d467e
mov eax, 0xc00000f0
add rsp, 0x228
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp qword [rdi], rsi
jne 0x1400d469e
cmp qword [rdi + 8], rsi
jne 0x1400d469e
mov eax, 0xc0000030
add rsp, 0x228
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x260], r12
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x220], r13
bt r14d, 0x12
jae 0x1400d48c6
test ecx, ecx
mov r8d, esi
sete al
bt r14d, 0x10
movzx ecx, al
cmovae r8d, ecx
bt r14d, 0x11
jae 0x1400d46fa
mov rax, qword gs:[0x30]
movzx r8d, r8b
mov rax, qword [rax + 0x60]
mov eax, dword [rax + 0x2c0]
cmp dword [rdi + 0x28], eax
cmovne r8d, esi
mov eax, dword [rdi + 0x48]
test eax, eax
je 0x1400d470a
cmp eax, 2
jne 0x1400d48c6
test r8b, r8b
je 0x1400d48c6
mov r13, qword [rdi + 8]
mov r15, 0xffffffffffffffff
test r13, r13
je 0x1400d4771
mov rbx, r15
nop word [rax + rax]
inc rbx
cmp word [r13 + rbx*2], si
jne 0x1400d4730
mov rdx, qword [0x140191180]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r8, rbx
mov rdx, r13
mov r12, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rcx, qword [rax + 8]
call fcn.1401317c0
jmp 0x1400d4774
mov r12, rsi
mov r9, qword [rdi + 0x18]
mov r8d, r14d
or r8d, 2
mov r10d, esi
test r9, r9
mov rdx, r9
cmovne r8d, r14d
test r8b, 2
je 0x1400d4798
mov r10d, 0x400
bt r8d, 2
mov rcx, r9
cmovb rcx, rdx
mov edx, r10d
or edx, 4
bt r8d, 2
cmovae edx, r10d
bt r8d, 3
cmovb r9, rcx
mov ecx, edx
bts ecx, 0x18
bt r8d, 3
cmovae ecx, edx
test r8b, 0x10
je 0x1400d47d7
mov r9, qword [rdi + 0x18]
or ecx, 0x10
test r12, r12
je 0x1400d47e3
mov rdx, qword [r12 + 8]
jmp 0x1400d47e6
mov rdx, rsi
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x38], r9
mov r9d, 1
mov dword [rsp + 0x30], ecx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rdi + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x1400d4848
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400d4846
movzx eax, ax
or eax, 0xc0070000
mov esi, eax
test r12, r12
je 0x1400d4863
lea rcx, [r12 - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x1400d4863
call fcn.1400d9400
test esi, esi
js 0x1400d4ec4
mov rcx, qword [rbp + 0x170]
test rcx, rcx
je 0x1400d4884
mov eax, dword [rbp - 0x78]
mov qword [rcx], rax
mov eax, dword [rbp - 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rbp + 0x178]
test rcx, rcx
je 0x1400d489a
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
jmp 0x1400d48a5
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x1400d48bd
mov rax, qword [rbp - 0x80]
mov qword [rcx], rax
jmp 0x1400d4ec4
mov rcx, qword [rbp - 0x80]
jmp 0x1400d4ebe
bt r14d, 0xc
jae 0x1400d49a6
cmp byte [0x1401910b4], sil
mov rax, qword [rdi + 0x30]
mov ebx, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rsi
je 0x1400d48f7
mov eax, ebx
and eax, 0x1410
cmp eax, ebx
je 0x1400d493a
xorps xmm0, xmm0
mov dword [rbp - 0x28], 0x30
lea r9, [rbp - 0x68]
mov qword [rbp - 0x20], rsi
lea r8, [rbp - 0x28]
mov dword [rbp - 0x10], esi
mov edx, ebx
mov qword [rbp - 0x18], rsi
lea rcx, [rsp + 0x68]
movdqu xmmword [rbp - 8], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400d494a
cmp byte [0x1401910b4], sil
je 0x1400d4ec6
lea r8, [rbp - 0x68]
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1400ecc50
test eax, eax
js 0x1400d4ec6
mov r15, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x1400d4990
cmp byte [0x1401910b4], sil
je 0x1400d4990
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.1400ecde0
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x1400d49fa
mov eax, ebx
jmp 0x1400d4ec6
bt r14d, 0xd
jae 0x1400d4a8d
mov rax, qword [0x1401901d8]
test rax, rax
jne 0x1400d49c7
mov eax, 0xc000007a
jmp 0x1400d4ec6
mov edx, dword [rdi + 0x30]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
lea r9, [rbp - 0x28]
xor ecx, ecx
mov dword [rsp + 0x20], 0x18
mov r8d, 0xe
call rax
test al, al
je 0x1400d4b61
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x60], rax
mov r15d, r14d
shr r15d, 0x11
and r15b, 1
bt r14d, 0x10
jae 0x1400d4b85
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x54]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x48]
mov edx, 0x13
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x1400d4b85
mov rbx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x168]
mov edx, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x1400d4b7c
cmp dword [rbp + 0x168], 1
jne 0x1400d4b7c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], rbx
jmp 0x1400d4bf8
mov ebx, dword [rdi + 0x48]
test ebx, ebx
jne 0x1400d4b36
mov rcx, qword [rdi + 0x30]
mov ebx, 2
movzx eax, word [rcx]
xor ax, 0x4e
test al, 0x1f
jne 0x1400d4b36
lea rdx, str.NT_AUTHORITY
call fcn.14011341c
test eax, eax
jne 0x1400d4b36
mov rcx, qword [rdi + 0x38]
mov r12d, 5
movzx eax, word [rcx]
xor ax, 0x53
test al, 0x1f
jne 0x1400d4af5
lea rdx, str.SYSTEM
call fcn.14011341c
test eax, eax
jne 0x1400d4af5
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3c
mov ebx, 9
cmovae ebx, r12d
mov rcx, qword [rdi + 0x38]
movzx eax, word [rcx]
xor ax, 0x4c
test al, 0x1f
jne 0x1400d4b18
lea rdx, str.LOCAL_SERVICE
call fcn.14011341c
test eax, eax
je 0x1400d4b33
mov rcx, qword [rdi + 0x38]
movzx eax, word [rcx]
xor ax, 0x4e
test al, 0x1f
jne 0x1400d4b36
lea rdx, str.NETWORK_SERVICE
call fcn.14011341c
test eax, eax
jne 0x1400d4b36
mov ebx, r12d
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rdi + 0x30]
mov r9d, ebx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x1400d4a05
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400d4ec6
movzx eax, ax
or eax, 0xc0070000
jmp 0x1400d4ec6
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test r15b, r15b
je 0x1400d4bf8
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0x80]
mov dword [rbp + 0x80], 0x30
mov edx, 0xf01ff
mov qword [rbp + 0x88], rsi
mov dword [rbp + 0x98], esi
mov qword [rbp + 0x90], rsi
movdqu xmmword [rbp + 0xa0], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400d4c30
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x60], rax
bt r14d, 0x11
jae 0x1400d4c37
mov eax, dword [rdi + 0x28]
lea r8, [rbp - 0x70]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov edx, 0xc
mov dword [rbp - 0x70], eax
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
jns 0x1400d4c37
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
jmp 0x1400d4ec6
cmp qword [rdi + 0x18], rsi
jne 0x1400d4c68
mov rax, qword [0x140190200]
test rax, rax
je 0x1400d4c68
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
xor r8d, r8d
call rax
mov r13, qword [rsp + 0x70]
test r13, r13
je 0x1400d4c6d
or r14d, 2
jmp 0x1400d4c6d
mov r13, qword [rsp + 0x70]
mov rax, qword [rdi + 0x18]
mov r15, 0xffffffffffffffff
mov r12, qword [rdi + 8]
test rax, rax
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi]
cmovne r13, rax
mov rbx, qword [rsp + 0x60]
mov rdi, rsi
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x38], r10
mov qword [rbp - 0x30], r11
test r12, r12
je 0x1400d4cf0
mov rbx, r15
inc rbx
cmp word [r12 + rbx*2], si
jne 0x1400d4ca6
mov rdx, qword [0x140191180]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r8, rbx
mov rdx, r12
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov r10, qword [rbp - 0x38]
mov r11, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x68]
movaps xmm0, xmmword [rbp + 0x10]
mov ecx, r14d
movaps xmm1, xmmword [rbp + 0x20]
and ecx, 2
shl ecx, 9
mov edx, ecx
movaps xmmword [rbp + 0xb0], xmm0
movaps xmm0, xmmword [rbp + 0x30]
or edx, 4
test r14b, 4
movaps xmmword [rbp + 0xc0], xmm1
movaps xmm1, xmmword [rbp + 0x40]
cmove edx, ecx
movaps xmmword [rbp + 0xd0], xmm0
movaps xmm0, xmmword [rbp + 0x50]
mov ecx, edx
bts ecx, 0x18
movaps xmmword [rbp + 0xe0], xmm1
movaps xmm1, xmmword [rbp + 0x60]
test r14b, 8
movaps xmmword [rbp + 0xf0], xmm0
movsd xmm0, qword [rbp + 0x70]
cmove ecx, edx
mov r9d, ecx
movaps xmmword [rbp + 0x100], xmm1
or r9d, 0x10
movsd qword [rbp + 0x110], xmm0
test r14b, 0x10
cmove r9d, ecx
test rbx, rbx
jne 0x1400d4dc2
test rdi, rdi
je 0x1400d4d80
mov rdx, qword [rdi + 8]
jmp 0x1400d4d83
mov rdx, rsi
lea rax, [rsp + 0x78]
and r14d, 1
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0xb0]
mov rcx, r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x1400d4e12
test rdi, rdi
je 0x1400d4dcd
mov r8, qword [rdi + 8]
jmp 0x1400d4dd0
mov r8, rsi
lea rax, [rsp + 0x78]
and r14d, 1
mov qword [rsp + 0x50], rax
mov rdx, r11
lea rax, [rbp + 0xb0]
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r9d
xor r9d, r9d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400d4e2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400d4e28
movzx eax, ax
or eax, 0xc0070000
mov esi, eax
test rdi, rdi
je 0x1400d4e44
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x1400d4e44
call fcn.1400d9400
test esi, esi
js 0x1400d4ea1
mov rcx, qword [rbp + 0x170]
test rcx, rcx
je 0x1400d4e61
mov eax, dword [rbp - 0x78]
mov qword [rcx], rax
mov eax, dword [rbp - 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rbp + 0x178]
test rcx, rcx
je 0x1400d4e77
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
jmp 0x1400d4e82
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x1400d4e97
mov rax, qword [rbp - 0x80]
mov qword [rcx], rax
jmp 0x1400d4ea1
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400d4eb9
mov rax, qword [0x1401901c8]
test rax, rax
je 0x1400d4eb9
call rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov r12, qword [rsp + 0x260]
mov r13, qword [rsp + 0x220]
add rsp, 0x228
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret