Function at 0x140004ce0
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14005c0d0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x48], r8
xor r13d, r13d
mov dword [rbp - 0x80], r13d
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.14000f6d0
nop
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140004d47
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.14000bd90
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140004dbd
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004db8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005535
call fcn.14001e4c0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x78]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140004f53
lea rcx, str.Privilege_escalation_failed_
call fcn.140001190
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004e38
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005529
call fcn.14001e4c0
mov byte [rbp - 0x20], 0
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], r13
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140004e82
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x140004e7d
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000556d
mov rcx, r8
call fcn.14001e4c0
mov byte [rdi], 0
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r13
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x140004ed0
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [r14]
jb 0x140004ecb
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005523
mov rcx, r8
call fcn.14001e4c0
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140004f1a
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140004f15
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000552f
mov rcx, r8
call fcn.14001e4c0
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], r13
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14001e4a0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x134], xmm1
movups xmmword [rbp + 0x144], xmm1
movups xmmword [rbp + 0x154], xmm1
movups xmmword [rbp + 0x164], xmm1
movups xmmword [rbp + 0x174], xmm1
movups xmmword [rbp + 0x184], xmm1
mov qword [rbp + 0x194], rax
mov dword [rbp + 0x19c], eax
mov dword [rbp + 0x130], 0x70
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
mov rbx, qword [rdi + 0x10]
mov r12, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140004fc1
mov r12, qword [rdi]
movabs r15, 0x7fffffffffffffff
cmp rbx, r15
ja 0x14000553b
mov rdx, 0xffffffffffffffff
cmp rbx, 0x10
jae 0x140004ffc
mov qword [rbp - 0x30], rbx
mov eax, 0xf
mov qword [rbp - 0x28], rax
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x40], xmm0
jmp 0x14000509b
mov qword [rbp - 0x28], 0xf
mov rax, rbx
or rax, 0xf
cmp rax, r15
ja 0x14000501f
mov r15, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r15, rcx
mov rcx, r15
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140005062
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005541
mov rcx, rax
call fcn.14001e4c8
mov rcx, rax
test rax, rax
je 0x140005567
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005071
test rcx, rcx
je 0x14000506e
call fcn.14001e4c8
jmp 0x140005071
mov rax, r13
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], r15
lea r8, [rbx + 1]
mov rdx, r12
mov rcx, rax
call fcn.140020370
mov rax, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
mov rdx, 0xffffffffffffffff
lea rcx, [rbp - 0x40]
cmp rax, 0x10
setae r10b
mov r9, qword [rbp - 0x40]
cmovae rcx, r9
test rbx, rbx
je 0x1400050e3
lea rax, [rbx - 1]
mov r8, rbx
cmp rax, rbx
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x5c
je 0x1400050de
nop dword [rax + rax]
cmp r8, rcx
je 0x1400050e3
dec r8
cmp byte [r8], 0x5c
jne 0x1400050d0
sub r8, rcx
jmp 0x1400050e6
mov r8, rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp - 0x40]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rsp + 0x60]
call fcn.140004450
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000514f
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000514a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005547
call fcn.14001e4c0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x30], xmm1
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000517c
mov rdx, qword [rdi]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x80004
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x140005499
mov r12, r14
cmp qword [r14 + 0x18], 8
jb 0x1400051cf
mov r12, qword [r14]
mov r15, qword [r14 + 0x10]
call fcn.14001cc64
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], al
mov dword [rbp - 0x80], 0x23
test r15, r15
je 0x140005276
cmp r15, 0x7fffffff
ja 0x14000554d
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov ecx, r13d
call fcn.14001ccd4
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x140005553
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14000d240
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r9, qword [rsp + 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, r15d
mov rdx, r12
mov ecx, r13d
call fcn.14001ccd4
shr rax, 0x20
test eax, eax
jne 0x140005559
mov r15, qword [rbp - 0x70]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x20]
call fcn.140020a10
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1b]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.14001bfc0
nop
cmp qword [rbp + 0xb0], 0
jne 0x14000534f
lea rdx, str.Error_while_reading_DLL_file_
lea rcx, [0x14005da20]
call fcn.14000fe60
lea rdx, [0x14001c9f0]
mov rcx, rax
call fcn.14001bf30
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x30]
call fcn.140008b00
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x1c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.14001db48
nop
jmp 0x14000543a
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.14001c060
mov rcx, qword [rbp]
add rcx, qword [rbp + 8]
call fcn.14001e788
mov rbx, rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14001c190
mov r8, qword [rbp + 8]
add r8, qword [rbp]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.14001c370
lea rcx, [rbp + 0x20]
call fcn.14001bf60
mov r8, qword [rbp + 8]
add r8, qword [rbp]
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
mov rcx, r15
call fcn.14001aef0
mov rcx, rbx
call fcn.14001e4c0
nop
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x1c], edx
lea rcx, [rbp + 0x30]
call fcn.140008b00
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x1c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.14001db48
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140005477
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005472
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005561
call fcn.14001e4c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13d, r13d
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400054d4
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005567
call fcn.14001e4c0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004e38
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005529
jmp 0x140004e33
call fcn.14002c654
nop
call fcn.14002c654
nop
call fcn.14002c654
nop
call fcn.14002c654
int3
call fcn.140001410
int3
call fcn.140001340
nop
call fcn.14002c654
nop
call fcn.140001850
int3
call fcn.140001bb0
int3
mov ecx, eax
call fcn.140001bb0
nop
call fcn.14002c654
nop
call fcn.14002c654
nop
call fcn.14002c654
int3