Function at 0x140012430
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push rbp
push rdi
push r12
push r14
sub rsp, 0x2a8
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx r12d, r8b
mov r14, r9
mov r8, rdx
lea r9, str.true
mov rbp, rdx
mov rdi, rcx
lea rdx, str.startNormalUi__lpcommandline___S__showUI___s
lea rcx, [0x140077e88]
call fcn.140004170
cmp dword [rdi + 0x128], 0
jne 0x1400124ce
xor edx, edx
mov dword [rdi + 0x128], 1
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140026cc0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x60], 0x104
cmp eax, 0xffffffff
jne 0x1400124d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetSessionIdOfUser__lx
lea rcx, [0x140077e88]
call fcn.140004170
xor al, al
jmp 0x140012697
lea rdx, [rdi + 0x18]
mov qword [rsp + 0x298], rsi
mov ecx, eax
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x140012507
lea rdx, str.WTSQueryUserToken_fail
lea rcx, [0x140077e88]
call fcn.140004ef0
xor al, al
jmp 0x14001268f
mov rdx, qword [rdi + 0x18]
lea rcx, [rdi + 0x120]
mov r8d, 1
mov qword [rsp + 0x290], r15
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x140012544
lea rdx, str.CreateEnvironmentBlock_fail
lea rcx, [0x140077e88]
call fcn.140004ef0
xor al, al
jmp 0x140012687
mov rcx, qword [rdi + 0x18]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x140012576
lea rdx, str.GetUserProfileDirectory_fail
lea rcx, [0x140077e88]
call fcn.140004ef0
xor al, al
jmp 0x140012687
mov rcx, qword [rdi + 0x18]
lea rax, [rdi + 0x50]
mov qword [rsp + 0x2a0], rbx
xor r9d, r9d
lea rbx, [rdi + 0x38]
mov r8, rbp
mov qword [rsp + 0x50], rbx
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x120]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140012605
mov r8, rbp
lea rdx, str.lpcommandline___s
lea rcx, [0x140077e88]
call fcn.140004170
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateProcessAsUser__lx
lea rcx, [0x140077e88]
call fcn.140004170
xor al, al
jmp 0x14001267f
test r12b, r12b
je 0x140012676
mov rcx, qword [rbx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001262a
mov rcx, qword [rbx]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x14001267d
cmp eax, 0x102
jne 0x140012656
mov rcx, qword [rbx]
mov edx, 0x7d00
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, str.system_UI_timeout
lea rcx, [0x140077e88]
call fcn.140004170
xor al, al
jmp 0x14001267f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.wait_UI_Error__lu
lea rcx, [0x140077e88]
call fcn.140004170
xor al, al
jmp 0x14001267f
mov dword [r14], 0x7d01
mov al, 1
mov rbx, qword [rsp + 0x2a0]
mov r15, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x2a8
pop r14
pop r12
pop rdi
pop rbp
ret