Function at 0x140053100
Capabilities:
Create process on windows
Impersonate user

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
xor ebp, ebp
mov rdi, r8
mov r15, rcx
mov rsi, rdx
lea rcx, [rax - 0x78]
lea r8d, [rbp + 0x38]
xor edx, edx
mov rbx, r9
mov qword [rsp + 0x68], rbp
mov r12, rbp
mov r14, rbp
mov r13, rbp
mov qword [rax - 0x88], rbp
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x60], rbp
mov qword [rax - 0x90], rbp
call fcn.140017520
mov eax, dword [rsp + 0x140]
lea edx, [rbp + 1]
movzx ecx, bpl
mov r9, rbx
test dl, al
mov r8, rdi
mov dword [rsp + 0xa0], gethostname
cmovne ecx, edx
mov rdx, rsi
mov qword [rsp + 0xa8], rsi
mov dword [rsp + 0x128], ecx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
mov rcx, r15
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], eax
call fcn.140043e30
cmp al, bpl
je 0x14005346f
mov ebx, dword [rsp + 0x140]
test bl, 2
je 0x14005320b
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
lea r9d, [rbp + 2]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp eax, ebp
je 0x14005346f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x70]
mov qword [rsp + 0x68], r11
lea rcx, str.winsta0
xor edx, edx
mov r8d, 0x60000
call qword [sym.imp.USER32.dll_OpenWindowStationW]
mov r12, rax
cmp rax, rbp
je 0x14005346f
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x14005346f
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, r12
mov qword [rsp + 0x98], rax
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
cmp eax, ebp
je 0x14005346f
lea rcx, [0x14009b758]
mov r9d, 0x60081
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_OpenDesktopW]
mov r14, rax
cmp rax, rbp
je 0x14005346f
cmp rax, rdi
je 0x14005346f
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x90]
mov rcx, r15
call fcn.140043e80
mov r13, qword [rsp + 0x90]
cmp al, bpl
je 0x14005346f
lea r9, [rsp + 0x70]
mov r8, r13
mov rdx, r12
mov rcx, r15
mov byte [rsp + 0x70], bpl
mov byte [rsp + 0x71], reloc.WSOCK32.dll_inet_ntoa
mov dword [rsp + 0x74], 0xf0000000
mov byte [rsp + 0x7c], bpl
mov byte [rsp + 0x7d], 4
mov dword [rsp + 0x80], 0xf037f
mov dword [rsp + 0x20], 2
call fcn.140052e70
cmp al, bpl
je 0x14005346f
lea r9, [rsp + 0x70]
mov r8, r13
mov rdx, r14
mov rcx, r15
mov byte [rsp + 0x70], bpl
mov byte [rsp + 0x71], bpl
mov dword [rsp + 0x74], 0xf01ff
mov dword [rsp + 0x20], 1
call fcn.140052be0
cmp al, bpl
je 0x14005346f
mov rdi, qword [rsp + 0x168]
mov r15, qword [rsp + 0x150]
lea rcx, str.winsta0default
mov esi, dword [rdi + 0x3c]
mov qword [rdi + 0x10], rcx
and esi, 0x100
cmp r15, rbp
je 0x140053396
mov rcx, r15
call fcn.140016a44
mov rcx, 0xffffffffffffffff
lea rbx, [rax + 1]
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140016ed8
mov r8, rbx
mov rdx, r15
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.14001760c
mov ebx, dword [rsp + 0x140]
mov r15d, dword [rsp + 0x128]
cmp r15b, bpl
je 0x1400533be
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
cmp eax, ebp
je 0x140053468
test bl, 4
jne 0x1400533e1
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x88]
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
cmp eax, ebp
je 0x140053468
mov rax, qword [rsp + 0x160]
mov ecx, dword [rsp + 0x158]
mov rbx, qword [rsp + 0x170]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rdi
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x88]
bts ecx, 0xa
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, ebp
je 0x140053472
cmp r15b, bpl
je 0x140053463
mov rcx, qword [rsp + 0x120]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xd0]
mov rdx, rbx
call fcn.140043d50
mov bpl, 1
jmp 0x14005348a
mov rdi, qword [rsp + 0x60]
jmp 0x140053472
mov rdi, rbp
mov rdx, qword [rsp + 0xd0]
cmp rdx, rbp
je 0x14005348a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, r13
call fcn.140043b80
mov rcx, r12
call qword [sym.imp.USER32.dll_CloseWindowStation]
mov rcx, r14
call qword [sym.imp.USER32.dll_CloseDesktop]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140016a60
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rbx, qword [rsp + 0x130]
mov al, bpl
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret