Function at 0x14000116c
Capabilities:
Create process on windows
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x228]
sub rsp, 0x320
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.advapi32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.ntdll.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.CheckRemoteDebuggerPresent
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AllocateAndInitializeSid
mov rcx, rdi
mov qword [0x140026200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CheckTokenMembership
mov rcx, rdi
mov qword [0x1400261e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeSid
mov rcx, rdi
mov qword [0x1400261e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rsi
mov qword [0x1400261f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRaiseHardError
mov rcx, rsi
mov qword [0x1400261f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov qword [0x1400261d8], rax
mov dword [rsp + 0x70], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [0x140026200]
cmp dword [rsp + 0x70], edi
jne 0x140001378
xor eax, eax
lea esi, [rdi + 1]
mov qword [rbp - 0x7c], rax
xor ecx, ecx
mov eax, esi
cpuid
mov dword [rbp - 0x80], eax
mov dword [rbp - 0x7c], ebx
mov dword [rbp - 0x74], edx
test ecx, ecx
js 0x140001378
lea rax, [rbp - 0x80]
mov dword [rsp + 0x6c], edi
mov qword [rsp + 0x50], rax
lea r8d, [rdi + 0x20]
mov dword [rsp + 0x48], edi
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x40], edi
mov r9d, 0x220
mov dword [rsp + 0x38], edi
mov dl, 2
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rbp - 0x80], rdi
mov dword [rsp + 0x60], edi
mov word [rsp + 0x64], 0x500
call qword [0x1400261e0]
test eax, eax
je 0x1400012f2
mov rdx, qword [rbp - 0x80]
lea r8, [rsp + 0x6c]
xor ecx, ecx
call qword [0x1400261e8]
mov rcx, qword [rbp - 0x80]
call qword [0x1400261f8]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [rsp + 0x6c], edi
jne 0x140001393
call fcn.140001c64
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
mov dword [rbp - 0x60], 0x70
lea rcx, [rbp - 0x5c]
lea r8d, [rdx + 0x6c]
call fcn.140015650
lea rax, str.runas
mov dword [rbp - 0x30], esi
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x60]
lea rax, [rbp + 0x10]
mov qword [rbp - 0x48], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140001378
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.Error
lea rdx, str.Failed.
call qword [sym.imp.USER32.dll_MessageBoxW]
lea r11, [rsp + 0x320]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, 8
call fcn.1400034c4
lea rcx, [0x1400015e0]
mov r9, rax
lea r8, [0x140002338]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call fcn.1400092e4
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140001476
cmp dword [rbp - 0x68], edi
je 0x140001484
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x68], eax
je 0x14000148c
movaps xmm0, xmmword [rbp - 0x70]
lea rcx, [rbp - 0x80]
xor edx, edx
movdqa xmmword [rbp - 0x80], xmm0
call fcn.1400031c8
test eax, eax
jne 0x140001465
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
call fcn.14000191c
mov rax, qword [0x1400261f0]
test rax, rax
je 0x14000145b
cmp qword [0x1400261d8], rdi
je 0x14000145b
xor r8d, r8d
lea r9, [rsp + 0x68]
mov dl, sil
lea ecx, [r8 + 0x13]
call rax
lea rax, [rsp + 0x6c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000420
call qword [0x1400261d8]
cmp dword [rbp - 0x68], edi
jne 0x140001470
jmp 0x140001378
mov ecx, 2
call fcn.140002c50
int3
call fcn.140009540
int3
mov ecx, 6
mov dword [rbp - 0x68], edi
call fcn.140002c50
int3
mov ecx, esi
call fcn.140002c50
int3
mov ecx, 5
call fcn.140002c50
int3