Function at 0x14013b320
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0xc0]
xorps xmm0, xmm0
mov rbx, rcx
mov qword [rbp - 0x80], r9
xor esi, esi
mov qword [rsp + 0x78], rax
mov ecx, edx
mov qword [rsp + 0x68], rsi
and ecx, 0x3000
mov dword [rbp - 0x40], 0x68
xor r14b, r14b
mov r13, r8
mov edi, edx
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
cmp ecx, 0x3000
jne 0x14013b3a5
mov eax, 0xc00000f0
jmp 0x14013ba6d
cmp qword [rbx], rsi
jne 0x14013b3ba
cmp qword [rbx + 8], rsi
jne 0x14013b3ba
mov eax, 0xc0000030
jmp 0x14013ba6d
mov rax, qword [rbx + 0x20]
mov r8d, 1
mov qword [rsp + 0x1a8], r12
mov dword [rbp - 4], r8d
mov word [rbp], r8w
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x160], r15
bt edi, 0x12
jae 0x14013b612
test ecx, ecx
mov r12d, esi
mov r15, 0xffffffffffffffff
sete al
bt edi, 0x10
movzx ecx, al
cmovae r12d, ecx
bt edi, 0x11
jae 0x14013b444
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x48]
mov edx, 0x18
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, 0xffffffff
movzx r12d, r12b
test eax, eax
mov r8d, 1
cmovns ecx, dword [rbp + 0x48]
cmp dword [rbx + 0x28], ecx
cmovne r12d, esi
mov eax, dword [rbx + 0x48]
test eax, eax
je 0x14013b454
cmp eax, 2
jne 0x14013b612
test r12b, r12b
je 0x14013b612
xor eax, eax
xorps xmm0, xmm0
mov r14, rsi
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x30], xmm0
cmp dword [rbx + 0x4c], eax
jne 0x14013b476
mov dword [rbx + 0x4c], r8d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14013b488
nop
call sym.SystemInformer.exe_PhCreateString
mov r14, rax
mov edx, edi
mov ecx, esi
or edx, 2
cmp qword [rbx + 0x18], rsi
cmovne edx, edi
test dl, 0x20
je 0x14013b4a3
lfence
mov ecx, 1
test dl, 0x40
je 0x14013b4ae
lfence
or ecx, 2
test dl, 4
je 0x14013b4b9
lfence
or ecx, 4
test dl, 0x10
je 0x14013b4c4
lfence
or ecx, 0x10
test dl, 2
je 0x14013b4d0
lfence
bts ecx, 0xa
test dl, dl
jns 0x14013b4db
lfence
bts ecx, 0x13
nop dword [rax + rax]
test dl, 8
je 0x14013b4ec
lfence
bts ecx, 0x18
bt edx, 8
jae 0x14013b4f9
lfence
bts ecx, 0x1a
test r14, r14
je 0x14013b504
mov rdx, qword [r14 + 8]
jmp 0x14013b507
mov rdx, rsi
mov r9d, dword [rbx + 0x4c]
lea rax, [rbp + 0x30]
mov r8, qword [rbx + 0x40]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbx + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x14013b57c
cmp dword [0x1402bff40], 0xffffffff
jae 0x14013b56d
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14013b573
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov esi, eax
nop dword [rax]
test r14, r14
je 0x14013b59a
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x14013b59a
call fcn.140141ea0
test esi, esi
js 0x14013b5ec
nop
test r13, r13
je 0x14013b5b3
mov eax, dword [rbp + 0x40]
mov qword [r13], rax
mov eax, dword [rbp + 0x44]
mov qword [r13 + 8], rax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14013b5c5
mov rax, qword [rbp + 0x30]
mov qword [rcx], rax
jmp 0x14013b5d4
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013b5d4
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14013b5fb
mov rax, qword [rbp + 0x38]
mov qword [rcx], rax
mov eax, esi
jmp 0x14013ba5d
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013b5fb
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp + 0x38]
test rcx, rcx
je 0x14013b60b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013ba5d
bt edi, 0xc
jae 0x14013b6e5
cmp dword [0x1402cddd8], 3
lea rcx, [rsp + 0x70]
mov rax, qword [rbx + 0x30]
mov edx, 0x1000
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rsi
jl 0x14013b647
lea r8, ds:[rbp + 0x30]
call fcn.140177760
jmp 0x14013b676
xorps xmm0, xmm0
mov dword [rbp - 0x78], 0x30
lea r9, [rbp + 0x30]
mov qword [rbp - 0x70], rsi
lea r8, [rbp - 0x78]
mov dword [rbp - 0x60], esi
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
je 0x14013b6dd
test eax, eax
js 0x14013b6dd
mov r15, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
mov r12d, dword [0x1402cddd8]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov r14d, eax
cmp eax, 0xc0000022
jne 0x14013b6c2
cmp r12d, 5
jne 0x14013b6c2
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.1401778a0
mov r14d, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
jns 0x14013b737
lfence
mov eax, r14d
jmp 0x14013ba5d
lfence
jmp 0x14013ba5d
bt edi, 0xd
jae 0x14013b7c7
mov edx, dword ds:[rbx + 0x30]
lea r9, [rbp + 0x30]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x40], rax
mov r8d, 0xe
lea rax, [rbp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
movups xmmword [rbp + 0x30], xmm0
call qword [sym.imp.WINSTA.dll_WinStationQueryInformationW]
test al, al
je 0x14013b888
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov r14d, edi
shr r14d, 0x11
and r14b, 1
bt edi, 0x10
jae 0x14013b8c6
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x50]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x30]
mov edx, 0x13
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x14013b8c6
mov r15, qword [rbp + 0x30]
lea rax, [rsp + 0x70]
mov rcx, r15
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x48]
mov edx, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax]
test eax, eax
js 0x14013b8bc
cmp dword [rbp + 0x48], 1
jne 0x14013b8bc
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], r15
jmp 0x14013b931
mov r15d, dword [rbx + 0x48]
test r15d, r15d
jne 0x14013b85a
mov rcx, qword [rbx + 0x30]
mov r15d, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013b85a
lea rdx, str.NT_AUTHORITY
call fcn.1401eace4
test eax, eax
jne 0x14013b85a
mov rcx, qword [rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x14013b814
lea rdx, str.SYSTEM
call fcn.1401eace4
test eax, eax
je 0x14013b854
mov rcx, qword ds:[rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x14013b838
lea rdx, str.LOCAL_SERVICE
call fcn.1401eace4
test eax, eax
je 0x14013b854
mov rcx, qword [rbx + 0x38]
movzx eax, byte ds:[rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013b85a
lea rdx, str.NETWORK_SERVICE
call fcn.1401eace4
test eax, eax
jne 0x14013b85a
mov r15d, 5
mov r8, qword [rbx + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rbx + 0x30]
mov r9d, r15d
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
nop dword [rax]
test eax, eax
jne 0x14013b742
cmp dword [0x1402bff40], 0xffffffff
jae 0x14013b8aa
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
jmp 0x14013ba5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
jmp 0x14013ba5d
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtClose]
test r14b, r14b
je 0x14013b931
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp - 0x78]
mov dword [rbp - 0x78], 0x30
mov edx, 0xf01ff
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x60], esi
mov qword [rbp - 0x68], rsi
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x60]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x14013b928
lfence
mov eax, esi
jmp 0x14013ba5d
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x60], rax
bt edi, 0x11
jae 0x14013b95d
mov eax, dword [rbx + 0x28]
lea r8, [rbp + 0x48]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov edx, 0xc
mov dword [rbp + 0x48], eax
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
js 0x14013b98c
bt edi, 0x13
jae 0x14013b9a5
mov rcx, qword ds:[rsp + 0x60]
lea r8, [rbp + 0x48]
mov r9d, 4
mov dword [rbp + 0x48], 1
mov edx, 0x1a
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
jns 0x14013b9a5
lfence
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013ba5d
cmp qword [rbx + 0x18], 0
jne 0x14013b9d9
call fcn.140172d40
test rax, rax
je 0x14013b9d9
call fcn.140172d40
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call qword [case.0x14013d84a.0]
cmp qword [rsp + 0x68], 0
je 0x14013b9d9
or edi, 2
mov rax, qword [rbx + 0x18]
mov rcx, qword [rsp + 0x78]
test rax, rax
mov r8, qword [rsp + 0x68]
mov r9, qword [rbx + 0x10]
cmovne r8, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call sym.SystemInformer.exe_PhCreateProcessWin32Ex
mov ebx, eax
call fcn.140172f00
test rax, rax
je 0x14013ba50
cmp qword [rsp + 0x68], 0
je 0x14013ba50
nop dword [rax]
call fcn.140172f00
mov rcx, qword [rsp + 0x68]
call qword [case.0x14013d84a.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov r12, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x160]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x168
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret