Function at 0x1400ab288
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4040]
mov eax, 0x4140
call fcn.1401dc320
sub rsp, rax
mov rax, qword [0x14030ef00]
xor rax, rsp
mov qword [rbp + 0x4030], rax
mov eax, dword [rbp + 0x40b0]
mov r13, rcx
mov r15, qword [rbp + 0x40a8]
mov r14d, r9d
mov rsi, qword [rbp + 0x40a0]
mov rbx, r8
mov dword [rsp + 0x60], eax
xorps xmm0, xmm0
mov qword [rbp - 0x50], rcx
mov eax, r9d
mov ecx, 0x8000
mov qword [rbp - 0x78], rdx
and eax, ecx
mov dword [rsp + 0x7c], r9d
xor r14d, ecx
mov qword [rbp - 0x58], r15
xor ecx, ecx
test eax, eax
mov qword [rsp + 0x68], rcx
mov r12d, ecx
mov qword [rsp + 0x70], rcx
cmove r14d, r9d
mov dword [rsp + 0x64], ecx
xor eax, eax
lea r8d, [rcx + 0x64]
xor edx, edx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x3c]
movups xmmword [rbp - 0x70], xmm0
call fcn.140211420
mov edi, 0xffffffff
cmp r14d, 5
je 0x1400ab362
test r14d, r14d
je 0x1400ab44e
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x78], eax
cmp eax, edi
je 0x1400aba24
cmp r14d, 4
je 0x1400ab44e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, 2
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400ab3a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x216
mov r9d, edi
mov dword [rsp + 0x20], eax
lea rdx, str.C:Users_anfdhDownloads_bvavMeshAgent_mastermicrostackILibProcessPipe.c
xor ecx, ecx
call fcn.1400aa2f8
jmp 0x1400aba24
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400ab3ec
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x217
jmp 0x1400ab38d
cmp r14d, 5
jne 0x1400ab3f6
mov dword [rsp + 0x78], esi
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov r9d, 4
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1400ab43b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x219
jmp 0x1400ab38d
cmp r14d, edi
lea rax, str.Winsta0Winlogon
cmovne rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rax
test rbx, rbx
je 0x1400ab517
mov rax, qword [rbx]
test rax, rax
je 0x1400ab517
cmp qword [rbx + 8], r12
jne 0x1400ab471
mov r12, rax
jmp 0x1400ab517
xor esi, esi
xor edi, edi
mov edx, 0x10000
mov rcx, rax
call fcn.1401ecbac
inc eax
inc rdi
add r12d, eax
inc esi
mov rax, qword [rbx + rdi*8]
test rax, rax
jne 0x1400ab475
lea eax, [r12 - 1]
add eax, esi
movsxd rcx, eax
mov dword [rbp - 0x7c], eax
call fcn.1401ed1fc
mov r8, qword [rbx]
xor edi, edi
and dword [rbp - 0x80], 0
mov r12, rax
mov dword [rsp + 0x64], 1
test r8, r8
je 0x1400ab517
mov r15d, dword [rbp - 0x80]
xor esi, esi
mov r13d, dword [rbp - 0x7c]
lea rax, [0x140271e88]
mov qword [rsp + 0x20], r8
test r15d, r15d
movsxd rcx, edi
lea r9, [0x14027cdac]
cmove r9, rax
lea r8, [0x140275b10]
mov eax, r13d
add rcx, r12
sub eax, edi
movsxd rdx, eax
call fcn.140001114
inc rsi
add edi, eax
inc r15d
mov r8, qword [rbx + rsi*8]
test r8, r8
jne 0x1400ab4ca
mov r15, qword [rbp - 0x58]
mov r13, qword [rbp - 0x50]
mov ecx, 0x80
call fcn.1401ed1fc
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea edx, [r9 + 0x68]
call fcn.14009fb24
mov edi, dword [rsp + 0x60]
mov rsi, rax
lea rbx, [rax + 0x38]
cmp r14d, 4
je 0x1400ab556
mov r9d, edi
mov rcx, r13
call fcn.1400aaf34
mov qword [rbx], rax
mov qword [rax + 0x40], rsi
mov qword [rsi + 0x10], r13
mov rax, qword [r13 + 0x20]
mov qword [rsi + 0x60], rax
mov dword [rbp - 0x40], 0x68
cmp r14d, 4
je 0x1400ab5f6
mov r9d, edi
mov rcx, r13
call fcn.1400aaf34
mov qword [rsi + 0x28], rax
mov r9d, edi
mov rcx, r13
mov qword [rax + 0x40], rsi
call fcn.1400aaf34
mov qword [rsi + 0x30], rax
mov qword [rax + 0x40], rsi
mov rcx, qword [rsi + 0x28]
add rcx, 0x88
call fcn.1400aaed0
mov rcx, qword [rsi + 0x30]
mov edi, 0x80
add rcx, rdi
call fcn.1400aaed0
mov rcx, qword [rbx]
add rcx, rdi
call fcn.1400aaed0
mov rax, qword [rbx]
mov rcx, qword [rax + 0x88]
mov qword [rbp + 0x20], rcx
mov rax, qword [rsi + 0x28]
mov rcx, qword [rax + 0x80]
mov qword [rbp + 0x10], rcx
mov rax, qword [rsi + 0x30]
mov rcx, qword [rax + 0x88]
bts dword [rbp - 4], 8
mov qword [rbp + 0x18], rcx
xor r13d, r13d
test r15, r15
je 0x1400ab77c
mov ecx, r13d
mov r13, r15
mov dword [rsp + 0x60], ecx
xor edi, edi
cmp qword [r13], rdi
je 0x1400ab68a
mov r8, qword [r13 + 8]
or r9d, 0xffffffff
mov dword [rsp + 0x28], edi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or r9d, 0xffffffff
mov dword [rsp + 0x28], edi
lea r8, [0x140274af4]
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [rsp + 0x28], 0
or r9d, 0xffffffff
mov r8, qword [r13]
xor edx, edx
and qword [rsp + 0x20], 0
mov ecx, 0xfde9
lea edi, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [rsp + 0x60]
add eax, edi
add ecx, eax
mov dword [rsp + 0x60], ecx
add r13, 0x10
jne 0x1400ab60c
lea eax, [rcx + rcx]
movsxd rbx, eax
mov eax, 0xffffffff
cmp rbx, rax
jae 0x1400ab6b2
mov eax, 0xffffffe7
cmp rbx, rax
jae 0x1400ab6b2
lea rcx, [rbx + 0x18]
call fcn.1401ed1fc
xor r13d, r13d
jmp 0x1400ab6b8
xor r13d, r13d
mov eax, r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14009fb24
mov rdi, rax
mov ebx, r13d
mov r8, qword [r15]
test r8, r8
je 0x1400ab779
mov eax, dword [rdi - 0x18]
or r9d, 0xffffffff
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
lea rdx, [rdi + rcx*2]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or r9d, 0xffffffff
lea r8, [0x140274af4]
dec eax
add ebx, eax
mov eax, dword [rdi - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [rdi + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [r15 + 8]
or r9d, 0xffffffff
dec eax
add ebx, eax
mov eax, dword [rdi - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [rdi + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add ebx, eax
add r15, 0x10
jne 0x1400ab6cf
mov r15, rdi
mov rdi, qword [rbp - 0x78]
mov ebx, 0x1000
test r14d, 0xfffffffb
jne 0x1400ab84a
lea rax, [rbp + 0x2030]
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [rsp + 0x7c]
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x48], rdx
mov eax, ebx
and eax, 0x8000
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rdx
neg eax
mov eax, r13d
mov qword [rsp + 0x38], r13
sbb ecx, ecx
mov qword [rsp + 0x30], r15
and ecx, 0x208
lea rdx, [rbp + 0x30]
or ecx, 0x8000400
mov dword [rsp + 0x28], ecx
cmp r14d, 4
lea rcx, [rbp + 0x2030]
setne al
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400ab9b9
test r14d, r14d
je 0x1400ab8fc
jmp 0x1400ab84e
mov ebx, dword [rsp + 0x7c]
mov r8, rdi
mov dword [rsp + 0x28], 0x1000
lea rax, [rbp + 0x2030]
mov edi, 0xfde9
mov ecx, edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r12
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp - 0x70]
and ebx, 0x8000
mov qword [rsp + 0x50], rcx
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x40]
neg ebx
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x2030]
mov rcx, qword [rsp + 0x70]
sbb eax, eax
mov qword [rsp + 0x40], r13
and eax, 0x208
mov qword [rsp + 0x38], r15
or eax, 0x8000400
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1400ab9b9
test r15, r15
je 0x1400ab909
mov rcx, r15
call fcn.14009fc04
cmp dword [rsp + 0x64], r13d
je 0x1400ab918
mov rcx, r12
call fcn.1401ebcd0
cmp r14d, 4
je 0x1400ab972
mov rcx, qword [rsi + 0x30]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x88], r13
mov rcx, qword [rsi + 0x38]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x38]
mov qword [rax + 0x88], r13
mov rcx, qword [rsi + 0x28]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x28]
mov qword [rax + 0x80], r13
mov rax, qword [rbp - 0x70]
mov qword [rsi + 0x50], rax
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400ab989
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x60]
mov dword [rsi + 0x18], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400ab9a4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400ab9b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x1400aba26
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp r14d, 4
je 0x1400ab9e0
mov rcx, qword [rsi + 0x38]
call fcn.1400aad58
mov rcx, qword [rsi + 0x30]
call fcn.1400aad58
mov rcx, qword [rsi + 0x28]
call fcn.1400aad58
cmp dword [rsp + 0x64], r13d
je 0x1400ab9ef
mov rcx, r12
call fcn.1401ebcd0
mov rcx, rsi
call fcn.14009fc04
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400aba07
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400aba17
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1400aba24
mov rcx, r15
call fcn.14009fc04
xor eax, eax
mov rcx, qword [rbp + 0x4030]
xor rcx, rsp
call fcn.1401dbdb0
mov rbx, qword [rsp + 0x4180]
add rsp, 0x4140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret