Function at 0x1400a46f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4040]
mov eax, 0x4140
call fcn.1401cd3c0
sub rsp, rax
mov rax, qword [0x1402e0ed0]
xor rax, rsp
mov qword [rbp + 0x4030], rax
mov eax, dword [rbp + 0x40b0]
mov rdi, rcx
mov r12, qword [rbp + 0x40a8]
mov r15d, r9d
mov r14, qword [rbp + 0x40a0]
btc r15d, 0xf
mov dword [rbp - 0x80], eax
mov rbx, r8
mov eax, r9d
mov qword [rbp - 0x78], rcx
xor ecx, ecx
shr eax, 0xf
and eax, 1
mov qword [rbp - 0x70], rdx
test eax, eax
mov dword [rsp + 0x64], eax
mov r13d, ecx
mov qword [rsp + 0x70], rcx
cmove r15d, r9d
mov qword [rsp + 0x78], rcx
xor eax, eax
mov dword [rsp + 0x68], ecx
lea r8d, [rcx + 0x68]
mov qword [rbp - 0x68], rax
xor edx, edx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], r12
call fcn.1401ce320
mov esi, 0xffffffff
cmp r15d, 5
je 0x1400a47c7
test r15d, r15d
je 0x1400a48c3
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x60], eax
cmp eax, esi
jne 0x1400a47c7
xor eax, eax
jmp 0x1400a4e4d
test r15d, 0xfffffffb
je 0x1400a48c3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, 2
lea r8, [rsp + 0x70]
mov edx, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400a4816
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x216
mov r9d, esi
mov dword [rsp + 0x20], eax
lea rdx, str...microstackILibProcessPipe.c
xor ecx, ecx
call fcn.1400a3d30
jmp 0x1400a47c0
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400a485b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x217
jmp 0x1400a47ff
mov eax, dword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov r9d, 4
cmp r15d, 5
cmove eax, r14d
lea edx, [r9 + 8]
mov dword [rsp + 0x60], eax
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1400a48b0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x219
jmp 0x1400a47ff
cmp r15d, esi
lea rax, str.Winsta0Winlogon
cmovne rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rax
test rbx, rbx
je 0x1400a499d
mov rax, qword [rbx]
test rax, rax
je 0x1400a499d
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x1400a48e9
mov r13, rax
jmp 0x1400a499d
xor esi, esi
xor r14d, r14d
cmp rax, rsi
je 0x1400a4921
xor edi, edi
mov rax, rbx
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400a4904
xor eax, eax
jmp 0x1400a490e
mov edx, 0x10000
call fcn.1401d6600
inc eax
inc rdi
add r14d, eax
inc esi
lea rax, [rbx + rdi*8]
cmp qword [rax], r13
jne 0x1400a48f8
lea eax, [r14 - 1]
add eax, esi
movsxd rcx, eax
mov dword [rbp - 0x7c], eax
call fcn.1401d6c94
xor r14d, r14d
mov dword [rsp + 0x68], 1
xor edi, edi
mov r13, rax
cmp qword [rbx], rdi
je 0x1400a4999
mov r8, qword [rbx]
xor esi, esi
mov r12d, dword [rbp - 0x7c]
lea rax, [0x1402592a8]
mov qword [rsp + 0x20], r8
test r14d, r14d
movsxd rcx, edi
lea r9, [0x14026343c]
cmove r9, rax
lea r8, [0x14025c700]
mov eax, r12d
add rcx, r13
sub eax, edi
movsxd rdx, eax
call fcn.140001138
inc rsi
add edi, eax
inc r14d
mov r8, qword [rbx + rsi*8]
test r8, r8
jne 0x1400a4950
mov r12, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x78]
mov esi, 0x80
mov ecx, esi
call fcn.1401d6c94
mov rcx, rax
lea edx, [rsi - 0x18]
xor r9d, r9d
xor r8d, r8d
call fcn.14009a9c8
mov ebx, dword [rbp - 0x80]
mov r14, rax
cmp r15d, 4
je 0x1400a49d9
mov r9d, ebx
mov rcx, rdi
call fcn.1400a4398
mov qword [r14 + 0x38], rax
mov qword [rax + 0x40], r14
mov qword [r14 + 0x10], rdi
mov rcx, qword [rdi + 0x20]
mov qword [r14 + 0x60], rcx
mov dword [rbp - 0x40], 0x68
cmp r15d, 4
je 0x1400a4a76
mov r9d, ebx
mov rcx, rdi
call fcn.1400a4398
mov qword [r14 + 0x28], rax
mov r9d, ebx
mov rcx, rdi
mov qword [rax + 0x40], r14
call fcn.1400a4398
mov qword [r14 + 0x30], rax
mov qword [rax + 0x40], r14
mov rcx, qword [r14 + 0x28]
add rcx, 0x88
call fcn.1400a4334
mov rcx, qword [r14 + 0x30]
add rcx, rsi
call fcn.1400a4334
mov rcx, qword [r14 + 0x38]
add rcx, rsi
call fcn.1400a4334
mov rax, qword [r14 + 0x38]
mov rcx, qword [rax + 0x88]
mov qword [rbp + 0x20], rcx
mov rax, qword [r14 + 0x28]
mov rcx, qword [rax + 0x80]
mov qword [rbp + 0x10], rcx
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0x88]
bts dword [rbp - 4], 8
mov qword [rbp + 0x18], rcx
test r12, r12
je 0x1400a4bea
xor esi, esi
mov rdi, r12
xor eax, eax
cmp qword [rdi], rax
je 0x1400a4af9
mov r8, qword [rdi + 8]
or r9d, 0xffffffff
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [rsp + 0x28], 0
lea r8, [0x14025b7c4]
and qword [rsp + 0x20], 0
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [rdi]
or r9d, 0xffffffff
and dword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov ecx, 0xfde9
add ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add eax, ebx
add esi, eax
add rdi, 0x10
jne 0x1400a4a84
lea eax, [rsi + rsi]
movsxd rbx, eax
mov eax, 0xffffffff
cmp rbx, rax
jae 0x1400a4b23
cmp rax, rbx
je 0x1400a4b23
mov eax, 0xffffffe7
cmp rbx, rax
jae 0x1400a4b23
lea rcx, [rbx + 0x18]
call fcn.1401d6c94
jmp 0x1400a4b25
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14009a9c8
xor ebx, ebx
mov rdi, rax
or esi, 0xffffffff
mov r8, qword [r12]
test r8, r8
je 0x1400a4be7
mov eax, dword [rdi - 0x18]
mov r9d, esi
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
lea rdx, [rdi + rcx*2]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, esi
lea r8, [0x14025b7c4]
dec eax
add ebx, eax
mov eax, dword [rdi - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [rdi + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [r12 + 8]
mov r9d, esi
dec eax
add ebx, eax
mov eax, dword [rdi - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [rdi + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add ebx, eax
add r12, 0x10
jne 0x1400a4b3e
mov r12, rdi
test r15d, 0xfffffffb
jne 0x1400a4c85
mov eax, dword [rsp + 0x64]
lea r8, [rbp + 0x30]
neg eax
mov r9d, 0x1000
mov rcx, r13
sbb esi, esi
xor edi, edi
and esi, 0x208
or esi, 0x8000400
cmp r15d, 4
setne dil
or edx, 0xffffffff
call fcn.14009a2e0
mov rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x2030]
mov r9d, 0x1000
or edx, 0xffffffff
mov rbx, rax
call fcn.14009a2e0
mov rcx, rax
xor r9d, r9d
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rdx, rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400a4d19
test r15d, r15d
je 0x1400a4d8d
neg dword [rsp + 0x64]
lea r8, [rbp + 0x30]
mov r9d, 0x1000
mov rcx, r13
sbb edi, edi
or esi, 0xffffffff
and edi, 0x208
mov edx, esi
or edi, 0x8000400
call fcn.14009a2e0
mov rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x2030]
mov r9d, 0x1000
mov edx, esi
mov rbx, rax
call fcn.14009a2e0
mov rcx, qword [rsp + 0x78]
mov rdx, rax
lea rax, [rbp - 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400a4d8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp r15d, 4
je 0x1400a4d40
mov rcx, qword [r14 + 0x38]
call fcn.1400a41c0
mov rcx, qword [r14 + 0x30]
call fcn.1400a41c0
mov rcx, qword [r14 + 0x28]
call fcn.1400a41c0
cmp dword [rsp + 0x68], 0
je 0x1400a4d4f
mov rcx, r13
call fcn.1401d5838
mov rcx, r14
call fcn.14009aab0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400a4d67
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400a4d77
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x1400a47c0
mov rcx, r12
call fcn.14009aab0
jmp 0x1400a47c0
test r12, r12
je 0x1400a4d9a
mov rcx, r12
call fcn.14009aab0
cmp dword [rsp + 0x68], 0
je 0x1400a4da9
mov rcx, r13
call fcn.1401d5838
cmp r15d, 4
je 0x1400a4e06
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14 + 0x30]
and qword [rax + 0x88], 0
mov rcx, qword [r14 + 0x38]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14 + 0x38]
and qword [rax + 0x88], 0
mov rcx, qword [r14 + 0x28]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14 + 0x28]
and qword [rax + 0x80], 0
mov rax, qword [rbp - 0x68]
mov qword [r14 + 0x50], rax
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400a4e1d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x58]
mov dword [r14 + 0x18], eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400a4e3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400a4e4a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r14
mov rcx, qword [rbp + 0x4030]
xor rcx, rsp
call fcn.1401cce50
mov rbx, qword [rsp + 0x4180]
add rsp, 0x4140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret