Function at 0x1400736d0
Capabilities:
Impersonate user

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x148
mov rbp, rdx
xor edx, edx
mov r13, r8
mov r12, rcx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0xd8]
mov dword [rsp + 0xd0], 0x68
call fcn.14009e740
xor bl, bl
test r12, r12
jne 0x140073724
test rbp, rbp
jne 0x140073724
mov eax, 0xc0000030
add rsp, 0x148
pop r13
pop r12
pop rbp
pop rbx
ret
mov rdx, qword [rsp + 0x190]
mov qword [rsp + 0x178], rsi
mov esi, dword [rsp + 0x1b8]
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], r14
xor r14d, r14d
mov qword [rsp + 0x140], r15
mov r15d, 1
test rdx, rdx
je 0x1400737d8
mov rcx, qword [rsp + 0x198]
test rcx, rcx
je 0x1400737d8
mov rax, qword [rsp + 0x1a0]
test rax, rax
je 0x1400737d8
mov r8, qword [rsp + 0x1b0]
test r8, r8
jne 0x1400737ef
mov r9d, dword [rsp + 0x1a8]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], r8
mov r8, rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x1400738bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400737c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140073ad3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xc0070000
jmp 0x140073ad3
mov r8, qword [rsp + 0x1b0]
test r8, r8
jne 0x1400737ef
mov eax, 0xc0000030
jmp 0x140073ad3
mov edx, dword [0x1400d8fbc]
lea rcx, [rsp + 0x58]
call sym.ProcessHacker.exe_PhOpenProcess
test eax, eax
js 0x140073ad3
mov rcx, qword [0x1400d62b8]
test rcx, rcx
je 0x140073888
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x48], 8
xor r9d, r9d
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x170]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
xor edx, edx
mov dword [rsp + 0x28], 0x999920cc
mov dword [rsp + 0x68], 0xf01ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov edi, eax
mov rax, qword [rsp + 0x50]
test edi, edi
cmovns rax, qword [rsp + 0x170]
mov qword [rsp + 0x50], rax
jmp 0x14007389f
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov edi, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
jns 0x1400738b5
mov eax, edi
jmp 0x140073ad3
movzx ebx, bl
cmp esi, 0xffffffff
cmovne ebx, r15d
cmp byte [rsp + 0x1c8], r14b
je 0x14007390b
mov rcx, qword [rsp + 0x50]
mov r9d, 8
lea rax, [rsp + 0x80]
lea edx, [r9 + 0xb]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x14007390b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rcx
jmp 0x140073918
test bl, bl
je 0x1400739b4
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x98]
xor r9d, r9d
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x88]
mov edx, 0xf01ff
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x60], 0xc
mov dword [rsp + 0x64], 2
mov dword [rsp + 0x20], r15d
mov byte [rsp + 0x68], r15b
mov byte [rsp + 0x69], r14b
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], r14
mov dword [rsp + 0xb0], r14d
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb8], r14
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140073ad1
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
cmp esi, 0xffffffff
je 0x1400739e7
mov rcx, qword [rsp + 0x50]
mov r9d, 4
lea r8, [rsp + 0x170]
lea edx, [r9 + 8]
mov dword [rsp + 0x170], esi
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
js 0x140073ac6
mov rax, qword [0x1400d6510]
test rax, rax
je 0x1400739fc
cmp qword [0x1400d6518], r14
jne 0x140073a41
lea rcx, str.userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.CreateEnvironmentBlock
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
mov qword [0x1400d6510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400d6518], rax
mov rax, qword [0x1400d6510]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x70], r14
call rax
mov rax, qword [rsp + 0x1c0]
mov r8, qword [rsp + 0x70]
mov qword [rsp + 0x48], r14
test rax, rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
lea r11, str.WinSta0Default
cmovne r11, rax
mov rax, qword [rsp + 0x50]
mov r9, r13
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xd0]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x28], 2
mov qword [rsp + 0xe0], r11
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov rcx, qword [rsp + 0x70]
mov ebx, eax
test rcx, rcx
je 0x140073ac6
call qword [0x1400d6518]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov r14, qword [rsp + 0x188]
mov rdi, qword [rsp + 0x180]
mov rsi, qword [rsp + 0x178]
mov r15, qword [rsp + 0x140]
add rsp, 0x148
pop r13
pop r12
pop rbp
pop rbx
ret