Function at 0x140001000
Capabilities:
Check if file exists
Create process on windows
Get session information
Get session user name
Impersonate user

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x3a0
mov rax, qword [0x14001e168]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov dword [rsp + 0x300], 0x68
mov qword [rsp + 0x308], 0
lea rdi, [rsp + 0x310]
xor eax, eax
mov ecx, 0x58
rep stosb byte [rdi], al
mov qword [rsp + 0x2d0], 0
lea rdi, [rsp + 0x2d8]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x2c0], 0
xor eax, eax
mov word [rsp + 0x70], ax
lea rdi, [rsp + 0x72]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2e8], 0
mov qword [rsp + 0x2f0], 0
mov dword [rsp + 0x280], 0x38
mov dword [rsp + 0x284], 0
lea rdi, [rsp + 0x288]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x2c8], 1
lea rax, str.WinSta0Default
mov qword [rsp + 0x310], rax
mov eax, 5
mov word [rsp + 0x340], ax
mov rax, qword [rsp + 0x3b8]
mov qword [rsp + 0x20], rax
lea r9, [0x14001f590]
lea r8, str._s_s
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140002170
test eax, eax
jl 0x140001129
mov dword [rsp + 0x370], 1
jmp 0x140001134
mov dword [rsp + 0x370], 0
mov eax, dword [rsp + 0x370]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x14000116e
lea rdx, str.Lenovo_Japan_Ltd.
lea rcx, [rsp + 0x70]
call fcn.140002260
test eax, eax
je 0x14000116e
mov dword [rsp + 0x374], 1
jmp 0x140001179
mov dword [rsp + 0x374], 0
mov eax, dword [rsp + 0x374]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x1400011f7
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [0x14001f7a0]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400011f7
mov r9d, 4
lea r8, [rsp + 0x3b0]
mov edx, 0xc
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x1400011f7
mov dword [rsp + 0x378], 1
jmp 0x140001202
mov dword [rsp + 0x378], 0
mov eax, dword [rsp + 0x378]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x14000124c
mov r9d, 4
lea r8, [rsp + 0x2c8]
mov edx, 0x1a
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x14000124c
mov dword [rsp + 0x37c], 1
jmp 0x140001257
mov dword [rsp + 0x37c], 0
mov eax, dword [rsp + 0x37c]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x14000128e
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x14000128e
mov dword [rsp + 0x380], 1
jmp 0x140001299
mov dword [rsp + 0x380], 0
mov eax, dword [rsp + 0x380]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x1400012eb
lea rax, [rsp + 0x2ec]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x288]
mov r8d, 5
mov edx, dword [rsp + 0x3b0]
xor ecx, ecx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x1400012eb
mov dword [rsp + 0x384], 1
jmp 0x1400012f6
mov dword [rsp + 0x384], 0
mov eax, dword [rsp + 0x384]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x140001335
lea rdx, [rsp + 0x280]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x140001335
mov dword [rsp + 0x388], 1
jmp 0x140001340
mov dword [rsp + 0x388], 0
mov eax, dword [rsp + 0x388]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x140001385
mov r8d, 1
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x140001385
mov dword [rsp + 0x38c], 1
jmp 0x140001390
mov dword [rsp + 0x38c], 0
mov eax, dword [rsp + 0x38c]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x140001472
mov dword [rsp + 0x2b8], 0
jmp 0x1400013ca
mov eax, dword [rsp + 0x2b8]
add eax, 1
mov dword [rsp + 0x2b8], eax
cmp dword [rsp + 0x2b8], 0xa
jge 0x14000146c
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x300]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [rsp + 0x2e8], eax
cmp dword [rsp + 0x2e8], 0
je 0x14000144f
jmp 0x14000146c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000145c
jmp 0x14000146c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400013b9
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp qword [rsp + 0x2d8], 0
je 0x14000148b
mov rcx, qword [rsp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x2d0], 0
je 0x1400014a4
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x2f0], 0
je 0x1400014bd
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp qword [rsp + 0x2b0], 0
je 0x1400014de
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
cmp qword [rsp + 0x288], 0
je 0x1400014f6
mov rcx, qword [rsp + 0x288]
call sub.WTSAPI32.dll_WTSFreeMemory
cmp qword [rsp + 0x2c0], 0
je 0x14000150f
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1400026e0
add rsp, 0x3a0
pop rdi
ret