Function at 0x1000111f8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x5f0
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
mov ebp, ecx
mov rcx, qword [0x10001dbd0]
xor r14d, r14d
mov r13, r8
mov r12, rdx
cmp rcx, r14
je 0x100011266
lea rdx, [0x100016c50]
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
cmp al, r14b
je 0x100011266
mov rcx, qword [0x10001dbd0]
lea rdx, [0x100016c50]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_EtwEventWrite]
mov edi, ebp
shr edi, 0x1e
and edi, 1
je 0x10001127a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
jmp 0x10001127d
mov esi, r14d
mov qword [rsp + 0x60], r14
cmp ebp, r14d
je 0x1000114ee
call fcn.100011148
mov ebx, eax
cmp eax, r14d
jne 0x1000112f3
mov eax, dword [0x10001d1b8]
lea r9, str.LogonUI.exe
mov edx, 0x100
lea rcx, [rsp + 0x1b0]
cmp edi, r14d
jne 0x1000112c8
lea r8, str.__s___flags:0x_lx
mov dword [rsp + 0x20], eax
call fcn.100002858
jmp 0x1000112dc
lea r8, str.__s___flags:0x_lx__testclientprocessid:0x_08x
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call fcn.100002858
cmp eax, r14d
mov ecx, r14d
setl cl
cmp ecx, r14d
je 0x1000113af
mov ebx, 0x7a
mov rcx, qword [0x10001dbd0]
cmp rcx, r14
je 0x10001132b
lea rdx, [0x100016c90]
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
cmp al, r14b
je 0x10001132b
mov rcx, qword [0x10001dbd0]
lea rdx, [0x100016c90]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_EtwEventWrite]
cmp qword [rsp + 0x60], r14
je 0x10001133d
lea rcx, [rsp + 0x60]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
cmp ebx, r14d
je 0x100011349
mov ecx, ebp
call fcn.100011654
mov rcx, qword [0x10001dbd0]
cmp rcx, r14
je 0x100011381
lea rdx, [0x100016c60]
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
cmp al, r14b
je 0x100011381
mov rcx, qword [0x10001dbd0]
lea rdx, [0x100016c60]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_EtwEventWrite]
mov eax, ebx
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.100001000
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov ebx, 0x68
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rbx
call sub.msvcrt.dll_memset
cmp edi, r14d
lea rax, str.Winsta0Winlogon
cmovne rax, r14
or qword [rsp + 0x100], 0xffffffffffffffff
xor r9d, r9d
mov qword [rsp + 0xb0], rax
mov rax, qword [0x10001e030]
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0xf0], rax
mov rax, qword [0x10001e038]
mov dword [rsp + 0xdc], 0x100
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x80]
cmp r12, r14
jne 0x100011463
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
lea rdx, [rsp + 0x1b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x1000114a4
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
lea r8, [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, r14d
jne 0x1000114be
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp eax, r14d
je 0x10001132b
jmp 0x1000112f3
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov qword [0x10001e070], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x90]
xor edx, edx
mov dword [r13], ecx
call qword [sym.imp.USER32.dll_RegisterLogonProcess]
cmp edi, r14d
jne 0x100011512
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov esi, dword [rcx + 0x2c0]
cmp esi, r14d
jne 0x100011512
mov esi, dword [0x7ffe02d8]
lea r8, str.3BDB59A0_D736_4D44_9074_C1EE_08X
lea rcx, [rsp + 0x160]
mov r9d, esi
mov edx, 0x25
call fcn.100002858
mov ebx, r14d
cmp eax, r14d
jge 0x100011539
movzx ebx, ax
cmp ebx, r14d
jne 0x1000112f3
lea rax, [rsp + 0x60]
lea rdx, str.ncalrpc
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
mov ebx, eax
cmp eax, r14d
jne 0x1000112f3
mov rcx, qword [rsp + 0x60]
lea rdx, [0x10001e028]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
mov ebx, eax
cmp eax, r14d
jne 0x1000112f3
cmp edi, r14d
jne 0x10001132b
xor edx, edx
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x110]
lea ecx, [rdx + 0x16]
mov dword [rsp + 0x68], 0x44
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
cmp eax, r14d
je 0x1000115d9
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x3b0]
call fcn.1000117a0
jmp 0x1000115dc
mov eax, r14d
cmp eax, r14d
je 0x10001132b
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x74], 1
mov dword [rsp + 0x78], r14d
mov dword [rsp + 0x7c], 2
mov rcx, qword [0x10001e028]
mov r9d, 0xa
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea r8d, [r9 - 4]
lea rdx, [rsp + 0x3b0]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov ebx, eax
cmp eax, r14d
je 0x10001132b
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100011602