Function at 0x1400a2288
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4040]
mov eax, 0x4140
call fcn.1401c9cb0
sub rsp, rax
mov rax, qword [0x1402e8ed8]
xor rax, rsp
mov qword [rbp + 0x4030], rax
mov rax, qword [rbp + 0x40a0]
mov r13, rcx
mov r14, qword [rbp + 0x40a8]
mov esi, r9d
mov r12d, dword [rbp + 0x40b0]
mov rbx, r8
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
mov qword [rbp - 0x48], rcx
mov eax, r9d
mov ecx, 0x8000
mov qword [rbp - 0x70], rdx
and eax, ecx
mov dword [rsp + 0x7c], r9d
xor esi, ecx
mov qword [rbp - 0x50], r14
xor ecx, ecx
mov dword [rsp + 0x78], r12d
test eax, eax
mov qword [rsp + 0x68], rcx
mov r15d, ecx
mov qword [rsp + 0x70], rcx
cmove esi, r9d
mov dword [rsp + 0x64], ecx
xor eax, eax
lea r8d, [rcx + 0x64]
xor edx, edx
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x3c]
movups xmmword [rbp - 0x68], xmm0
call fcn.1401cbcd0
mov edi, 0xffffffff
cmp esi, 5
je 0x1400a2364
test esi, esi
je 0x1400a2454
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x60], eax
cmp eax, edi
je 0x1400a2a28
cmp esi, 4
je 0x1400a2454
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, 2
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400a23a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x216
mov r9d, edi
mov dword [rsp + 0x20], eax
lea rdx, str.C:UsersDELLDesktopProjektySUPMANMeshAgentmicrostackILibProcessPipe.c
xor ecx, ecx
call fcn.1400a1918
jmp 0x1400a2a28
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400a23ee
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x217
jmp 0x1400a238f
mov eax, dword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov r9d, 4
cmp esi, 5
cmove eax, dword [rbp - 0x78]
lea edx, [r9 + 8]
mov dword [rsp + 0x60], eax
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1400a2442
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x219
jmp 0x1400a238f
cmp esi, edi
lea rax, str.Winsta0Winlogon
cmovne rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rax
test rbx, rbx
je 0x1400a2525
mov rax, qword [rbx]
test rax, rax
je 0x1400a2525
cmp qword [rbx + 8], r15
jne 0x1400a2477
mov r15, rax
jmp 0x1400a2525
xor r12d, r12d
xor edi, edi
mov edx, 0x10000
mov rcx, rax
call fcn.1401d7904
inc eax
inc rdi
add r12d, eax
inc r15d
mov rax, qword [rbx + rdi*8]
test rax, rax
jne 0x1400a247c
lea eax, [r15 - 1]
add eax, r12d
movsxd rcx, eax
mov dword [rbp - 0x78], eax
call fcn.1401d7f54
mov r8, qword [rbx]
xor edi, edi
and dword [rbp - 0x80], 0
mov r15, rax
mov dword [rsp + 0x64], 1
test r8, r8
je 0x1400a2520
mov r14d, dword [rbp - 0x80]
xor r12d, r12d
mov r13d, dword [rbp - 0x78]
lea rax, [0x14025b82d]
mov qword [rsp + 0x20], r8
test r14d, r14d
movsxd rcx, edi
lea r9, [0x14026502c]
cmove r9, rax
lea r8, [0x14025e150]
mov eax, r13d
add rcx, r15
sub eax, edi
movsxd rdx, eax
call fcn.1400011e0
inc r12
add edi, eax
inc r14d
mov r8, qword [rbx + r12*8]
test r8, r8
jne 0x1400a24d3
mov r14, qword [rbp - 0x50]
mov r13, qword [rbp - 0x48]
mov r12d, dword [rsp + 0x78]
mov ecx, 0x80
call fcn.1401d7f54
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea ebx, [r9 + 0x68]
mov edx, ebx
call fcn.140098bdc
mov rdi, rax
cmp esi, 4
je 0x1400a255e
mov r9d, r12d
mov rcx, r13
call fcn.1400a1f34
mov qword [rdi + 0x38], rax
mov qword [rax + 0x40], rdi
mov qword [rdi + 0x10], r13
mov rcx, qword [r13 + 0x20]
mov qword [rdi + 0x60], rcx
mov dword [rbp - 0x40], ebx
cmp esi, 4
je 0x1400a25fb
mov r9d, r12d
mov rcx, r13
call fcn.1400a1f34
mov qword [rdi + 0x28], rax
mov r9d, r12d
mov rcx, r13
mov qword [rax + 0x40], rdi
call fcn.1400a1f34
mov qword [rdi + 0x30], rax
mov qword [rax + 0x40], rdi
mov rcx, qword [rdi + 0x28]
add rcx, 0x88
call fcn.1400a1ed0
mov rcx, qword [rdi + 0x30]
mov ebx, 0x80
add rcx, rbx
call fcn.1400a1ed0
mov rcx, qword [rdi + 0x38]
add rcx, rbx
call fcn.1400a1ed0
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 0x88]
mov qword [rbp + 0x20], rcx
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax + 0x80]
mov qword [rbp + 0x10], rcx
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x88]
bts dword [rbp - 4], 8
mov qword [rbp + 0x18], rcx
xor r13d, r13d
test r14, r14
je 0x1400a2780
mov r12, r14
xor eax, eax
cmp qword [r12], rax
je 0x1400a2683
mov r8, qword [r12 + 8]
or r9d, 0xffffffff
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [rsp + 0x28], 0
lea r8, [0x14025d0e4]
and qword [rsp + 0x20], 0
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [r12]
or r9d, 0xffffffff
and dword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov ecx, 0xfde9
add ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add eax, ebx
add r13d, eax
add r12, 0x10
jne 0x1400a260a
lea eax, [r13*2]
movsxd rbx, eax
mov eax, 0xffffffff
cmp rbx, rax
jae 0x1400a26b0
mov eax, 0xffffffe7
cmp rbx, rax
jae 0x1400a26b0
lea rcx, [rbx + 0x18]
call fcn.1401d7f54
xor r13d, r13d
jmp 0x1400a26b6
xor r13d, r13d
mov eax, r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.140098bdc
mov r12, rax
mov ebx, r13d
mov r8, qword [r14]
test r8, r8
je 0x1400a277d
mov eax, dword [r12 - 0x18]
or r9d, 0xffffffff
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
lea rdx, [r12 + rcx*2]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or r9d, 0xffffffff
lea r8, [0x14025d0e4]
dec eax
add ebx, eax
mov eax, dword [r12 - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [r12 + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [r14 + 8]
or r9d, 0xffffffff
dec eax
add ebx, eax
mov eax, dword [r12 - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [r12 + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add ebx, eax
add r14, 0x10
jne 0x1400a26cd
mov r14, r12
mov ebx, 0x1000
test esi, 0xfffffffb
jne 0x1400a284b
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r12, qword [rbp - 0x70]
lea rax, [rbp + 0x2030]
mov r8, r12
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [rsp + 0x7c]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x48], rdx
mov eax, ebx
and eax, 0x8000
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rdx
neg eax
mov eax, r13d
mov qword [rsp + 0x38], r13
sbb ecx, ecx
mov qword [rsp + 0x30], r14
and ecx, 0x208
lea rdx, [rbp + 0x30]
or ecx, 0x8000400
mov dword [rsp + 0x28], ecx
cmp esi, 4
lea rcx, [rbp + 0x2030]
setne al
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400a29be
test esi, esi
je 0x1400a2902
jmp 0x1400a2853
mov ebx, dword [rsp + 0x7c]
mov r12, qword [rbp - 0x70]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x2030]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp - 0x68]
and ebx, 0x8000
mov qword [rsp + 0x50], rcx
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x40]
neg ebx
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x2030]
mov rcx, qword [rsp + 0x70]
sbb eax, eax
mov qword [rsp + 0x40], r13
and eax, 0x208
mov qword [rsp + 0x38], r14
or eax, 0x8000400
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1400a29be
test r14, r14
je 0x1400a290f
mov rcx, r14
call fcn.140098cbc
cmp dword [rsp + 0x64], r13d
je 0x1400a291e
mov rcx, r15
call fcn.1401d6b80
cmp esi, 4
je 0x1400a2977
mov rcx, qword [rdi + 0x30]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x30]
mov qword [rax + 0x88], r13
mov rcx, qword [rdi + 0x38]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x38]
mov qword [rax + 0x88], r13
mov rcx, qword [rdi + 0x28]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x28]
mov qword [rax + 0x80], r13
mov rax, qword [rbp - 0x68]
mov qword [rdi + 0x50], rax
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400a298e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x58]
mov dword [rdi + 0x18], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a29a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400a29b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x1400a2a2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 4
je 0x1400a29e4
mov rcx, qword [rdi + 0x38]
call fcn.1400a1d5c
mov rcx, qword [rdi + 0x30]
call fcn.1400a1d5c
mov rcx, qword [rdi + 0x28]
call fcn.1400a1d5c
cmp dword [rsp + 0x64], r13d
je 0x1400a29f3
mov rcx, r15
call fcn.1401d6b80
mov rcx, rdi
call fcn.140098cbc
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a2a0b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400a2a1b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1400a2a28
mov rcx, r14
call fcn.140098cbc
xor eax, eax
mov rcx, qword [rbp + 0x4030]
xor rcx, rsp
call fcn.1401c9740
mov rbx, qword [rsp + 0x4180]
add rsp, 0x4140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret