Function at 0x140115d20
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1f0], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x48], r9
movzx edi, r8b
mov qword [rbp - 0x58], rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0
je 0x1401162e6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rsp + 0x78], xmm1
xor r14d, r14d
mov word [rsp + 0x68], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400d7f70
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400d8020
mov rbx, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140115e02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140115dfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140116318
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
test rbx, rbx
je 0x1401162e6
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x50], rax
lea rdx, str.RevertToSelf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.SetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x1401162e6
test r12, r12
je 0x1401162e6
test r13, r13
je 0x1401162e6
test rax, rax
je 0x1401162e6
xor r15d, r15d
mov qword [rbp + 0x68], r15
lea rcx, [rbp + 0x68]
call fcn.1400f04b0
nop
mov qword [rsp + 0x60], r15
mov dword [rbp + 0x60], 0xffffffff
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x60]
call fcn.1400f1c20
test al, al
je 0x1401162d6
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x1401162d6
cmp dword [rbp + 0x60], 0xffffffff
je 0x1401162cd
mov qword [rsp + 0x60], r15
test dil, dil
je 0x140115ef9
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1401164d0
test al, al
jne 0x140115f0e
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140116380
test al, al
je 0x1401162cd
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1401162cd
mov r9d, 4
lea r8, [rbp + 0x60]
lea edx, [r9 + 8]
mov rcx, rdi
call r14
mov qword [rbp - 0x38], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400d7f70
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400d8020
mov r15, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140115fbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140115fba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011631e
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rsp + 0x78], xmm0
xor eax, eax
mov word [rsp + 0x68], ax
test r15, r15
je 0x1401160ad
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], ax
lea r8d, [rax + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f70
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8020
mov r14, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14011605f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011605a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140116324
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm0
xor eax, eax
mov word [rbp - 0x78], ax
test r14, r14
je 0x1401160ad
lea rdx, str.SetTokenInformation
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401160ad
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401160ad
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x38]
call rax
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x10]
call fcn.140189c40
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 0x68
lea rax, str.WinSta0Default
mov qword [rbp], rax
mov eax, 1
mov word [rbp + 0x30], ax
mov dword [rbp + 0x2c], 0x81
mov r8, qword [rbp - 0x58]
mov rdx, rsi
lea rcx, [rbp + 0x70]
call fcn.140115670
nop
xor r15d, r15d
mov r14d, r15d
mov rcx, rdi
call qword [rbp - 0x50]
test eax, eax
je 0x1401161a3
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
cmp qword [rsi + 0x18], 8
jb 0x14011612c
mov rsi, qword [rsi]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rsi
mov rcx, rdi
call r13
mov r14d, eax
test eax, eax
je 0x14011617a
mov ecx, dword [rbp - 0x20]
mov rax, qword [rbp - 0x48]
mov dword [rax], ecx
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14011618d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x28], r15
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1401161a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x38], r15
je 0x140116271
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f70
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8020
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140116244
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011623f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011632a
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140116271
mov rcx, qword [rbp - 0x38]
call rax
test r14d, r14d
setne bl
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1401162b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401162b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140116312
call fcn.140183214
movdqa xmm0, xmmword [0x140249430]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], r15w
jmp 0x1401162d8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea rcx, [rbp + 0x68]
call fcn.1400f0530
movzx eax, bl
jmp 0x1401162e8
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1401837c0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140195ffc
nop
call fcn.140195ffc
nop
call fcn.140195ffc
int3
call fcn.140195ffc
nop
call fcn.140195ffc
int3