Function at 0x1400f4340
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x1e0]
xorps xmm0, xmm0
mov rdi, rcx
mov qword [rbp - 0x70], r9
xor esi, esi
mov qword [rsp + 0x68], r8
mov ecx, edx
mov qword [rbp - 0x78], rax
and ecx, 0x3000
mov qword [rsp + 0x78], rsi
xor r12b, r12b
mov dword [rbp + 0xc0], 0x68
mov r13, r8
mov r14d, edx
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
cmp ecx, 0x3000
jne 0x1400f43e5
mov eax, 0xc00000f0
jmp 0x1400f4bc5
cmp qword [rdi], rsi
jne 0x1400f43fa
cmp qword [rdi + 8], rsi
jne 0x1400f43fa
mov eax, 0xc0000030
jmp 0x1400f4bc5
mov qword [rsp + 0x2c8], rbx
mov eax, 1
mov dword [rbp + 0xfc], eax
mov word [rbp + 0x100], ax
mov rax, qword [rdi + 0x20]
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x280], r15
bt r14d, 0x12
jae 0x1400f4652
test ecx, ecx
mov r13d, esi
mov r15, 0xffffffffffffffff
sete al
and edx, 0x10000
movzx ecx, al
cmove r13d, ecx
bt r14d, 0x11
jae 0x1400f448b
lea r9d, [r15 + 5]
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x170]
mov rcx, r15
lea edx, [r15 + 0x19]
mov ebx, 0xffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
movzx r13d, r13b
cmovns ebx, dword [rbp + 0x170]
cmp dword [rdi + 0x28], ebx
cmovne r13d, esi
test dword [rdi + 0x48], 0xfffffffd
jne 0x1400f464d
nop dword [rax + rax]
test r13b, r13b
je 0x1400f464d
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400f44bc
call sym.ProcessHacker.exe_PhCreateString
mov rbx, rax
jmp 0x1400f44bf
mov rbx, rsi
mov r9, qword ds:[rdi + 0x18]
mov r8d, r14d
or r8d, 2
test r9, r9
cmovne r8d, r14d
mov eax, r8d
mov ecx, r8d
shr ecx, 5
and ecx, 1
mov edx, ecx
or edx, 2
and al, 0x40
mov eax, r8d
cmove edx, ecx
mov ecx, edx
or ecx, 4
and al, 4
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
and al, 2
mov eax, r8d
cmove ecx, edx
mov edx, ecx
bts edx, 0x13
and al, 0x80
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
cmove ecx, edx
mov edx, ecx
bts edx, 0x1a
and r8d, 0x100
cmove edx, ecx
test rbx, rbx
je 0x1400f454b
mov rcx, qword [rbx + 8]
jmp 0x1400f454e
mov rcx, rsi
mov r8, qword [rdi + 0x40]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x38], r9
mov r9d, 1
mov dword [rsp + 0x30], edx
mov rdx, qword [rdi + 0x30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x1400f45b7
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400f45ae
mov esi, eax
jmp 0x1400f45b7
movzx esi, ax
or esi, 0xc0070000
test rbx, rbx
je 0x1400f45d1
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x1400f45d1
call fcn.1400fbcc0
test esi, esi
js 0x1400f4625
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400f45ec
mov eax, dword [rbp - 0x58]
mov qword [rcx], rax
mov eax, dword [rbp - 0x54]
mov qword [rcx + 8], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400f45fe
mov rax, qword [rbp - 0x68]
mov qword [rcx], rax
jmp 0x1400f460d
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400f460d
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400f4634
mov rax, qword ds:[rbp - 0x60]
mov qword [rcx], rax
mov eax, esi
jmp 0x1400f4bb5
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400f4634
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400f4646
nop dword [rax]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x1400f4bb5
mov r13, qword [rsp + 0x68]
bt r14d, 0xc
jae 0x1400f4856
cmp byte [0x140240e3f], sil
mov rax, qword [rdi + 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rsi
je 0x1400f46bc
lea rax, [rsp + 0x68]
mov dword [rbp - 0x28], 0x1000
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x18]
lea rax, [rbp - 0x50]
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x20], rax
call fcn.14011f9e0
mov dword [rsp + 0x48], esi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x148]
jmp 0x1400f4746
xorps xmm0, xmm0
mov dword [rbp + 0x58], 0x30
lea r9, [rbp - 0x50]
mov qword [rbp + 0x60], rsi
lea r8, [rbp + 0x58]
mov dword [rbp + 0x70], esi
mov edx, 0x1000
mov qword [rbp + 0x68], rsi
lea rcx, [rsp + 0x68]
movdqu xmmword [rbp + 0x78], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400f4768
cmp byte [0x140240e3f], sil
je 0x1400f476c
lea rax, ds:[rsp + 0x68]
mov dword [rbp - 8], 0x1000
mov qword [rbp - 0x10], rax
lea rcx, [rbp + 8]
lea rax, [rbp - 0x50]
mov dword [rbp + 8], esi
mov qword [rbp], rax
call fcn.14011f9e0
mov dword [rsp + 0x48], esi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], 0x20
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x158]
mov rcx, qword [0x140241b70]
xor r9d, r9d
mov dword [rsp + 0x28], 0x999920cb
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
jns 0x1400f4774
lfence
jmp 0x1400f4bb5
mov rbx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rcx, rbx
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov r15d, eax
cmp eax, 0xc0000022
jne 0x1400f4838
cmp byte [0x140240e3f], sil
je 0x1400f4838
mov rcx, qword [0x140241b70]
lea rax, ds:[rsp + 0x60]
mov qword [rbp + 0x20], rax
lea r8, [0x14011f940]
mov dword [rsp + 0x48], esi
lea rax, [0x14011fb00]
mov qword [rbp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x10]
mov qword [rbp + 0x48], rax
xor edx, edx
mov dword [rsp + 0x38], 4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x10], rbx
mov ebx, 2
mov dword [rsp + 0x28], 0x9999200b
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x18], 0xf01ff
mov dword [rbp + 0x28], esi
mov dword [rbp - 0x80], ebx
mov dword [rbp + 0x50], 0xc0000001
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov r15d, dword [rbp + 0x50]
test ebx, ebx
cmovs r15d, ebx
mov rcx, qword ds:[rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
test r15d, r15d
jns 0x1400f48bc
lfence
mov eax, r15d
jmp 0x1400f4bb5
bt r14d, 0xd
jae 0x1400f495b
call fcn.140123c00
test rax, rax
jne 0x1400f487a
mov eax, 0xc000007a
jmp 0x1400f4bb5
call fcn.140123c00
mov edx, dword [rdi + 0x30]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x28], rcx
lea r9, [rbp + 0x130]
xor ecx, ecx
mov dword [rsp + 0x20], 0x18
mov r8d, 0xe
call qword [case.0x1400f654f.0]
test al, al
je 0x1400f4a19
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x60], rax
mov r12d, r14d
shr r12d, 0x11
and r12b, 1
bt r14d, 0x10
jae 0x1400f4a3e
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x174]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x168]
lea edx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop word [rax + rax]
test eax, eax
js 0x1400f4a3e
mov rbx, qword [rbp + 0x168]
lea rax, [rbp - 0x3c]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x7c]
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x1400f4a35
cmp dword ds:[rbp - 0x7c], 1
jne 0x1400f4a35
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], rbx
jmp 0x1400f4abf
mov ebx, dword ds:[rdi + 0x48]
test ebx, ebx
jne 0x1400f49ee
mov rcx, qword [rdi + 0x30]
mov ebx, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x1400f49ee
lea rdx, str.NT_AUTHORITY
call fcn.140188e04
test eax, eax
jne 0x1400f49ee
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x1400f49af
lea rdx, str.SYSTEM
call fcn.140188e04
test eax, eax
je 0x1400f49e9
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x1400f49cd
lea rdx, str.LOCAL_SERVICE
nop
call fcn.140188e04
test eax, eax
je 0x1400f49e9
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x1400f49ee
lea rdx, str.NETWORK_SERVICE
nop dword [rax]
call fcn.140188e04
test eax, eax
jne 0x1400f49ee
mov ebx, 5
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rdi + 0x30]
mov r9d, ebx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x1400f48c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
jle 0x1400f4bb5
movzx eax, ax
or eax, 0xc0070000
jmp 0x1400f4bb5
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
nop
test r12b, r12b
je 0x1400f4abf
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x38]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0x88]
mov dword [rbp + 0x88], 0x30
mov edx, 0xf01ff
mov qword [rbp + 0x90], rsi
mov dword [rbp + 0xa0], esi
mov qword [rbp + 0x98], rsi
movdqu xmmword [rbp + 0xa8], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x1400f4ab6
lfence
jmp 0x1400f4bb3
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x60], rax
bt r14d, 0x11
jae 0x1400f4af5
mov eax, dword [rdi + 0x28]
lea r8, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x70], eax
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
jns 0x1400f4af5
lfence
jmp 0x1400f4ba8
cmp qword [rdi + 0x18], rsi
jne 0x1400f4b31
nop dword [rax + rax]
call fcn.140123480
test rax, rax
je 0x1400f4b31
call fcn.140123480
mov rdx, qword ds:[rsp + 0x60]
lea rcx, [rsp + 0x78]
xor r8d, r8d
call qword [case.0x1400f654f.0]
cmp qword [rsp + 0x78], rsi
je 0x1400f4b31
or r14d, 2
mov rax, qword ds:[rdi + 0x18]
mov rcx, qword [rbp - 0x78]
test rax, rax
mov r8, qword [rsp + 0x78]
mov r9, qword [rdi + 0x10]
cmovne r8, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc0]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov ebx, eax
call fcn.140123600
test rax, rax
je 0x1400f4ba8
cmp qword [rsp + 0x78], rsi
je 0x1400f4ba8
call fcn.140123600
mov rcx, qword [rsp + 0x78]
call qword [case.0x1400f654f.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x2c8]
mov r15, qword [rsp + 0x280]
mov rcx, qword [rbp + 0x178]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x288
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret