Function at 0x1400404b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rdi, r9
mov r15, r8
mov r14, rdx
call fcn.140014190
mov rcx, rax
lea r9, [0x1400e8328]
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
xor edx, edx
call fcn.14009cf00
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x60], rbx
call fcn.140014190
cmp byte [rax + 0x64], r12b
je 0x140040568
lea ecx, [r12 + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140040560
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x140040563
mov rbx, r12
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov rsi, r12
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x80], r12
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x78]
mov edx, 0x28
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
jne 0x1400405b9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rsi, str.OpenProcessToken_failed._Error:_0x_08X
jmp 0x140040a74
lea r8, [rbp + 0x38]
lea rdx, str.SeTcbPrivilege
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400405e2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rsi, str.LookupPrivilegeValue_failed._Error:_0x_08X
jmp 0x140040a74
mov dword [rbp + 0x40], 1
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x44], rax
mov dword [rbp + 0x4c], 2
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140040a67
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x514
jne 0x14004065e
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], 0x514
lea r9, str.AdjustTokenPrivileges_failed_with_a_warning._No_problem_in_executing_other_codes._Error:_0x_08X
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 4
call fcn.14009cf00
mov eax, dword [rdi]
test eax, eax
jne 0x1400406de
call fcn.140015f40
mov edi, eax
test eax, eax
jne 0x140040685
call fcn.140014190
mov dword [rsp + 0x20], r12d
lea r9, str.WTSGetActiveConsoleSessionId_failed._Error:_0x_08X
jmp 0x140040a82
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Current_Session_ID___d
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 2
call fcn.14009cf00
mov ecx, edi
call fcn.140015d00
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140040706
call fcn.140014190
lea r9, str.GetActiveSessionToken_failed
mov rcx, rax
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 5
call fcn.14009cf00
jmp 0x140040a96
cmp eax, 1
jne 0x140040706
call fcn.140015f40
lea rdx, [rsp + 0x68]
mov ecx, eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x140040750
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140040851
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x14004089c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
lea r9, str.DuplicateTokenEx_failed._Error:_0x_08X
jmp 0x140040a7e
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x24]
lea edx, [r9 + 0xe]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x1400407c7
cmp dword [rbp + 0x24], 3
jne 0x1400407fa
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp - 0x78]
lea edx, [r9 + 0xb]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x1400407b8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
mov qword [rsp + 0x68], rcx
jmp 0x1400407ff
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rsi, str.GetTokenInformation_with_TokenLinkedToken_failed._Error:_0x_08X
jmp 0x1400407d4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rsi, str.GetTokenInformation_with_TokenElevationType_failed._Error:_0x_08X
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
mov r9, rsi
lea r8, str.Utils::GetElevatedUserToken
mov edx, 5
call fcn.14009cf00
test edi, edi
jne 0x140040851
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x28]
lea edx, [r9 + 4]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetTokenInformation]
test eax, eax
je 0x140040862
cmp dword [rbp + 0x28], 1
je 0x140040892
call fcn.140014190
mov rcx, rax
lea r9, str.GetTokenInformation_failed___Invalid_Handle
lea r8, str.Utils::GetElevatedUserToken
mov edx, 5
call fcn.14009cf00
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call fcn.140014190
lea r9, str.GetElevatedUserToken_failed
jmp 0x1400406c5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.GetTokenInformation_with_TokenType_failed._Error:_0x_08X
lea r8, str.Utils::GetElevatedUserToken
mov edx, 5
call fcn.14009cf00
test edi, edi
jne 0x140040846
mov rsi, qword [rsp + 0x68]
jmp 0x140040706
mov dword [rbp + 0x2c], 1
mov r9d, 4
lea r8, [rbp + 0x2c]
lea edx, [r9 + 0x16]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
test eax, eax
jne 0x1400408d9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
lea r9, str.SetTokenInformation__TokenUIAccess__failed._Error:_0x_08X
jmp 0x140040a7e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x50], 0x68
lea rax, str.winsta0default
mov qword [rbp - 0x40], rax
mov r8d, 1
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x80]
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x14004093d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
lea r9, str.CreateEnvironmentBlock_failed._Error:_0x_08X
jmp 0x140040a7e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x60], xmm1
mov qword [rbp + 0x70], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
mov dword [rsp + 0x28], r12d
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x78]
mov r8, r15
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
mov edi, eax
test eax, eax
jne 0x1400409c2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
lea r9, str.CreateProcessAsUser_failed._Error:_0x_08X
jmp 0x140040a7e
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400409d1
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400409e0
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400409f0
call sub.USERENV.dll_DestroyEnvironmentBlock
mov edi, eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140040a00
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test rsi, rsi
je 0x140040a0e
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140040a41
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rbp + 0x50]
xor edx, edx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
mov edi, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Return:_0x_08X
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 1
call fcn.14009cf00
jmp 0x140040a99
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
lea rsi, str.AdjustTokenPrivileges_failed._Error:_0x_08X
mov edi, eax
call fcn.140014190
mov r9, rsi
mov dword [rsp + 0x20], edi
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 5
mov rcx, rax
call fcn.14009cf00
mov edi, r12d
test rbx, rbx
je 0x140040ab3
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov eax, edi
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400964b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret