Function at 0x1400142e0
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x298
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x280], rax
movzx r13d, byte [rsp + 0x2f0]
lea rax, str.true
mov rbp, rdx
lea rbx, str.false
mov rsi, rcx
test r13b, r13b
mov r14, r9
movzx r12d, r8b
cmovne rbx, rax
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.startNormalUi__lpcommandline___S__showUI___s
mov r9, rbx
mov r8, rbp
call fcn.140005b00
cmp dword [rsi + 0x128], 0
jne 0x1400143a7
xor edx, edx
mov dword [rsi + 0x128], 1
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.1400220d0
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x60], 0x104
cmp eax, 0xffffffff
jne 0x1400143ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call fcn.140003ed0
mov rcx, rax
lea rdx, str.GetSessionIdOfUser__lx
mov r8d, ebx
call fcn.140005b00
xor al, al
jmp 0x140014599
lea rdx, [rsi + 0x18]
mov qword [rsp + 0x2e0], rdi
mov ecx, eax
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
jne 0x1400143e5
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.WTSQueryUserToken_fail
call fcn.1400068e0
xor al, al
jmp 0x140014591
mov rdx, qword [rsi + 0x18]
lea rcx, [rsi + 0x120]
mov r8d, 1
mov qword [rsp + 0x290], r15
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x140014427
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.CreateEnvironmentBlock_fail
call fcn.1400068e0
xor al, al
jmp 0x140014589
mov rcx, qword [rsi + 0x18]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x14001445e
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.GetUserProfileDirectory_fail
call fcn.1400068e0
xor al, al
jmp 0x140014589
mov ecx, 0xb8
lea rbx, [rsi + 0x38]
mov qword [rsp + 0x50], rbx
test r13b, r13b
mov eax, 0x50
mov r8, rbp
cmove eax, ecx
mov rcx, qword [rsi + 0x18]
add rax, rsi
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsi + 0x120]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140014503
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.lpcommandline___s
mov r8, rbp
call fcn.140005b00
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call fcn.140003ed0
mov rcx, rax
lea rdx, str.CreateProcessAsUser__lx
mov r8d, ebx
call fcn.140005b00
xor al, al
jmp 0x140014589
test r12b, r12b
je 0x140014580
mov rcx, qword [rbx]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140014528
mov rcx, qword [rbx]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x140014587
cmp eax, 0x102
jne 0x140014559
mov rcx, qword [rbx]
mov edx, 0x7d00
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.system_UI_timeout
call fcn.140005b00
xor al, al
jmp 0x140014589
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call fcn.140003ed0
mov rcx, rax
lea rdx, str.wait_UI_Error__lu
mov r8d, ebx
call fcn.140005b00
xor al, al
jmp 0x140014589
mov dword [r14], 0x7d01
mov al, 1
mov r15, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14001f550
add rsp, 0x298
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret