Function at 0x140020ca0
Capabilities:
Acquire debug privileges
Create process on windows
Print debug messages
Spoof parent pid

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x158]
sub rsp, 0x258
mov rax, qword [0x140081048]
xor rax, rsp
mov qword [rbp + 0x148], rax
mov r12d, r9d
mov r13, r8
mov rsi, rdx
mov r14, rcx
xor r15d, r15d
cmp qword [rcx + 0x10], r15
jne 0x140020dae
cmp qword [rdx + 0x10], r15
jne 0x140020dae
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea r8d, [r15 + 0x45]
lea rdx, str._Error__SpawnProcessInSession__Neither_app_or_args_is_configured.
lea rcx, [rbp - 0x80]
call fcn.140001990
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140020da7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020da2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220b9
call fcn.140025820
xor al, al
jmp 0x140020faf
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
lea r8d, [rax + 0xc]
lea rdx, str.explorer.exe
lea rcx, [rbp - 0x20]
call fcn.140001990
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
mov r8d, recvfrom
lea rdx, str.winlogon.exe
lea rcx, [rbp]
call fcn.140001990
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov ecx, 0x40
call fcn.14002585c
mov rbx, rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
lea rcx, [rax + 0x40]
mov qword [rbp + 0x120], rcx
lea rax, [rbp + 0x110]
mov qword [rbp + 0x20], rax
lea rdi, [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], rbx
lea rax, [rbp + 0x110]
mov qword [rbp + 0xf0], rax
mov rdx, rdi
mov rcx, rbx
call fcn.1400025c0
add rbx, 0x20
mov qword [rbp + 0xe8], rbx
add rdi, 0x20
lea rax, [rbp + 0x20]
cmp rdi, rax
jne 0x140020e75
mov rdx, rbx
mov rcx, rbx
call fcn.140022410
mov qword [rbp + 0x118], rbx
lea r9, [fcn.140001ac0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp - 0x20]
call fcn.140025f10
mov qword [rbp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x30]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140020fd2
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
lea r8d, [rax + 0x4b]
lea rdx, str._Error__SpawnProcessInSession__Failed_to_open_handle_current_process_token.
lea rcx, [rbp - 0x80]
call fcn.140001990
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140020f9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020f99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220bf
call fcn.140025820
xor bl, bl
lea rcx, [rbp + 0x110]
call fcn.140022120
movzx eax, bl
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.140025800
add rsp, 0x258
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, str.SeDebugPrivilege
mov rcx, qword [rbp + 0x30]
call fcn.140020c00
test al, al
jne 0x1400210ab
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov r8d, 0x40
lea rdx, str._Error__SpawnProcessInSession__Failed_to_enable_debug_privilege.
lea rcx, [rbp - 0x80]
call fcn.140001990
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14002117c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021177
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002209b
jmp 0x140021177
lea rdx, str.SeTcbPrivilege
mov rcx, qword [rbp + 0x30]
call fcn.140020c00
test al, al
jne 0x14002118b
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
mov r8d, 0x3e
lea rdx, str._Error__SpawnProcessInSession__Failed_to_enable_Tcb_privilege.
lea rcx, [rbp - 0x80]
call fcn.140001990
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14002117c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021177
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220c5
call fcn.140025820
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140020f9e
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14002119a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], r15d
mov rbx, r15
mov rax, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x110]
sub rax, rdx
sar rax, 5
test rax, rax
je 0x140021212
mov rdi, r15
nop
lea rcx, [rdx + rdi]
lea r8, [rbp + 0x20]
mov edx, r12d
call fcn.140020880
movabs rdx, 0xc000000000000000
mov r15d, dword [rbp + 0x20]
cmp al, 1
je 0x1400212e0
inc rbx
add rdi, 0x20
mov rcx, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x110]
sub rcx, rdx
sar rcx, 5
cmp rbx, rcx
jb 0x1400211c0
test al, al
jne 0x14002141e
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov r8d, 0x43
lea rdx, str._Debug__SpawnProcessInSession__Did_not_find_parent_pid_for_spoofing
lea rcx, [rsp + 0x60]
call fcn.140001990
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140020f9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020f99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220a1
jmp 0x140020f99
shl rbx, 5
add rbx, qword [rbp + 0x110]
lea rax, str._Debug__SpawnProcessInSession__Found_parent_pid_to_spoof:____
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0x41
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002130b
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rax
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x50], rdx
mov dword [rbp - 0x30], r15d
movabs rax, 0x2000000000000010
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x100], 2
lea rax, [rbp - 0x50]
mov qword [rbp + 0x108], rax
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0xe0], xmm0
movaps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x60], xmm1
lea r8, [rbp + 0xe0]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140002ad0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14002141e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021419
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220cb
call fcn.140025820
mov r8d, r15d
xor edx, edx
mov ecx, 0x80
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x38], rax
test rax, rax
jne 0x1400214fa
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
lea r8d, [rax + 0x51]
lea rdx, str._Debug__SpawnProcessInSession__Failed_to_open_handle_to_surragate_parent_process.
lea rcx, [rbp - 0x80]
call fcn.140001990
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140020f9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020f99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220a7
jmp 0x140020f99
xor r15d, r15d
mov qword [rbp + 0x40], r15
lea r9, [rbp + 0x40]
xor r8d, r8d
lea edx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14002170f
mov qword [rbp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov r8d, eax
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140001990
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rax, str._Error__SpawnProcessInSession__Unexpected_error_for_init_proc_thread_attr:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x4d
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x108], rax
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x100], 1
lea rax, [rbp - 0x80]
mov qword [rbp + 0x108], rax
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0xe0], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm1
lea r8, [rbp + 0xe0]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140002ad0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400216ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400216a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220d1
call fcn.140025820
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140021700
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400216fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220d7
call fcn.140025820
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140020f9e
mov rbx, qword [rbp + 0x40]
mov rcx, rbx
call fcn.140025f08
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140027e60
mov qword [rbp + 0x100], rdi
lea r9, [rbp + 0x40]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x14002192a
mov qword [rbp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov r8d, eax
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140001990
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rax, str._Error__SpawnProcessInSession__InitializeProcThreadAttributeList__:_
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 0x46
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x58], rax
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x60], 1
lea rax, [rbp - 0x80]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
movaps xmm1, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0xe0], xmm1
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x60]
call fcn.140002ad0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400218ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400218c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220dd
call fcn.140025820
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140021d31
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021d2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220ad
jmp 0x140021d2c
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x38]
xor edx, edx
mov r8d, 0x20000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x140021b3f
mov qword [rbp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov r8d, eax
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140001990
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rax, str._Error__SpawnProcessInSession__UpdateProcThreadAttribute__:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x3e
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0xe8], rax
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x80], rax
mov qword [rbp + 0xe0], 1
lea rax, [rbp - 0x80]
mov qword [rbp + 0xe8], rax
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0xe0], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm1
lea r8, [rbp + 0xe0]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140002ad0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140021ae3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021ade
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220e3
call fcn.140025820
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140021d31
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021d2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220b3
jmp 0x140021d2c
lea rdx, [rbp + 0x48]
mov ecx, r12d
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x140021d42
mov qword [rbp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov r8d, eax
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140001990
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rax, str._Error__SpawnProcessInSession__WTSQueryUserToken__:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x36
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0xe8], rax
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x80], rax
mov qword [rbp + 0xe0], 1
lea rax, [rbp - 0x80]
mov qword [rbp + 0xe8], rax
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0xe0], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm1
lea r8, [rbp + 0xe0]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140002ad0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140021cdd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021cd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220e9
call fcn.140025820
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140021d31
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021d2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220ef
call fcn.140025820
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x140022088
mov bl, 1
movups xmm0, xmmword [str.WinSta0Default]
movups xmmword [rbp + 0x128], xmm0
movups xmm1, xmmword [0x140078fb0]
movups xmmword [rbp + 0x138], xmm1
mov rdx, r15
cmp qword [r14 + 0x10], r15
je 0x140021d76
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140021d76
mov rdx, qword [r14]
mov r8, r15
cmp qword [rsi + 0x10], r15
je 0x140021d8c
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x140021d8c
mov r8, qword [rsi]
mov rax, r15
cmp qword [r13 + 0x10], r15
je 0x140021da3
mov rax, r13
cmp qword [r13 + 0x18], 8
jb 0x140021da3
mov rax, qword [r13]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rcx
xorps xmm1, xmm1
movups xmmword [rbp + 0x70], xmm1
movups xmmword [rbp + 0x80], xmm1
movups xmmword [rbp + 0x90], xmm1
movups xmmword [rbp + 0xa0], xmm1
movups xmmword [rbp + 0xb0], xmm1
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbp + 0xd0], rcx
mov dword [rbp + WSAStartup], 0x70
lea rcx, [rbp + 0x128]
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0xd8], rdi
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x8080020
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140022042
mov qword [rbp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov r8d, eax
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140001990
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rax, str._Error__SpawnProcessInSession__CreateProcessAsUser__:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x38
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0xe8], rax
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp - 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x80], rax
mov qword [rbp + 0xe0], 1
lea rax, [rbp - 0x80]
mov qword [rbp + 0xe8], rax
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0xe0], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm1
lea r8, [rbp + 0xe0]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140002ad0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.140010c40
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140010910
movzx edx, ax
mov rcx, rbx
call fcn.140010760
mov rcx, rbx
call fcn.140010600
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140021ff0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021feb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400220f5
call fcn.140025820
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140022040
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002203b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022095
call fcn.140025820
xor bl, bl
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140022051
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140022060
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14002206f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14002207e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
nop
mov rcx, rdi
call fcn.140025820
jmp 0x140020fa0
call fcn.14002c134
nop
call fcn.14002c134
int3
call fcn.14002c134
int3
call fcn.14002c134
nop
call fcn.14002c134
int3
call fcn.14002c134
nop
call fcn.14002c134
nop
call fcn.14002c134
int3
call fcn.14002c134
int3
call fcn.14002c134
nop
call fcn.14002c134
nop
call fcn.14002c134
nop
call fcn.14002c134
nop
call fcn.14002c134
nop
call fcn.14002c134
nop
call fcn.14002c134
nop
call fcn.14002c134
int3