Function at 0x1400fffe0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x48]
sub rsp, 0x148
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
mov rdi, rcx
xor esi, esi
mov ecx, edx
mov qword [rbp - 0x78], rsi
and ecx, 0x3000
xor r12b, r12b
mov r13, r8
mov r14d, edx
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
cmp ecx, 0x3000
jne 0x14010005e
mov eax, 0xc00000f0
add rsp, 0x148
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
nop
cmp qword [rdi], rsi
jne 0x140100081
cmp qword [rdi + 8], rsi
jne 0x140100081
mov eax, 0xc0000030
add rsp, 0x148
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x180], rbx
mov eax, 1
mov dword [rbp + 0xc], eax
mov word [rbp + 0x10], ax
mov rax, qword [rdi + 0x20]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x140], r15
bt r14d, 0x12
jae 0x1401002cc
test ecx, ecx
mov r13d, esi
mov r15, 0xffffffffffffffff
sete al
and edx, 0x10000
movzx ecx, al
cmove r13d, ecx
bt r14d, 0x11
jae 0x140100109
lea r9d, [r15 + 5]
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x88]
mov rcx, r15
lea edx, [r15 + 0x19]
mov ebx, 0xffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
movzx r13d, r13b
cmovns ebx, dword [rbp + 0x88]
cmp dword [rdi + 0x28], ebx
cmovne r13d, esi
test dword [rdi + 0x48], 0xfffffffd
jne 0x1401002c5
test r13b, r13b
je 0x1401002c5
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140100132
call sym.ProcessHacker.exe_PhCreateString
mov rbx, rax
jmp 0x140100135
mov rbx, rsi
mov r10, qword [rdi + 0x18]
mov r8d, r14d
or r8d, 2
test r10, r10
cmovne r8d, r14d
mov eax, r8d
mov ecx, r8d
and ecx, 2
shl ecx, 9
mov edx, ecx
or edx, 4
and al, 4
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, r8d
cmove edx, ecx
mov ecx, edx
or ecx, 1
and al, 0x20
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 2
and al, 0x40
cmove edx, ecx
mov r9d, edx
bts r9d, 0x13
and r8b, 0x80
cmove r9d, edx
test rbx, rbx
je 0x1401001ad
mov rcx, qword [rbx + 8]
jmp 0x1401001b0
mov rcx, rsi
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x68]
mov rdx, qword [rdi + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r9d
mov r9d, 1
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x140100217
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14010020e
mov esi, eax
jmp 0x140100217
movzx esi, ax
or esi, 0xc0070000
test rbx, rbx
je 0x140100231
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x140100231
call fcn.140106290
test esi, esi
js 0x14010029a
mov rcx, qword ds:[rbp + 0x90]
test rcx, rcx
je 0x140100254
mov eax, dword [rsp + 0x78]
mov qword [rcx], rax
mov eax, dword [rsp + 0x7c]
mov qword [rcx + 8], rax
mov rcx, qword ds:[rbp + 0x98]
test rcx, rcx
je 0x14010026f
mov rax, qword [rsp + 0x68]
mov qword [rcx], rax
jmp 0x14010027f
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14010027f
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x1401002ab
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
mov eax, esi
jmp 0x1401006ec
mov rcx, qword ds:[rsp + 0x68]
test rcx, rcx
je 0x1401002ab
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1401002bb
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x1401006ec
mov r13, qword [rbp + 0x90]
bt r14d, 0xc
jae 0x140100445
cmp byte [0x1402130ef], sil
lea rcx, [rbp - 0x80]
mov rax, qword [rdi + 0x30]
mov edx, 0x1000
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
jne 0x140100343
xorps xmm0, xmm0
mov dword [rbp - 0x68], 0x30
lea r9, [rsp + 0x68]
mov qword [rbp - 0x60], rsi
lea r8, [rbp - 0x68]
mov dword [rbp - 0x50], esi
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x58], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x14010034d
cmp byte [0x1402130ef], sil
je 0x1401006ec
mov edx, 0x1000
lea rcx, [rbp - 0x80]
lea r8, [rsp + 0x68]
call fcn.140123530
test eax, eax
js 0x1401006ec
mov r15, qword [rbp - 0x80]
lea r8, [rsp + 0x60]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140100392
cmp byte [0x1402130ef], sil
je 0x140100392
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.140123650
mov ebx, eax
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
test ebx, ebx
js 0x1401006ea
mov r12d, r14d
shr r12d, 0x11
and r12b, 1
bt r14d, 0x10
jae 0x14010058e
mov rcx, qword ds:[rsp + 0x60]
lea rax, [rbp - 0x70]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x68]
lea edx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x14010058e
mov rbx, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x88]
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x140100585
cmp dword [rbp + 0x88], 1
jne 0x140100585
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword ds:[rsp + 0x60], rbx
jmp 0x1401005f8
bt r14d, 0xd
jae 0x1401004ab
call fcn.140137a30
test rax, rax
jne 0x140100465
mov eax, 0xc000007a
jmp 0x1401006ec
call fcn.140137a30
mov edx, dword [rdi + 0x30]
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x68]
xor ecx, ecx
mov dword [rsp + 0x20], 0x18
mov r8d, 0xe
call qword [case.0x140101f48.0]
test al, al
je 0x140100568
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
jmp 0x1401003a8
mov ebx, dword [rdi + 0x48]
test ebx, ebx
jne 0x140100539
mov rcx, qword [rdi + 0x30]
mov ebx, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x140100539
lea rdx, str.NT_AUTHORITY
call fcn.1401655e8
test eax, eax
jne 0x140100539
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x1401004fd
lea rdx, str.SYSTEM
call fcn.1401655e8
test eax, eax
je 0x140100534
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x14010051a
lea rdx, str.LOCAL_SERVICE
call fcn.1401655e8
test eax, eax
je 0x140100534
mov rcx, qword [rdi + 0x38]
movzx eax, byte ds:[rcx]
xor al, 0xe
test al, 0x1f
jne 0x140100539
lea rdx, str.NETWORK_SERVICE
call fcn.1401655e8
test eax, eax
jne 0x140100539
mov ebx, 5
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rdi + 0x30]
mov r9d, ebx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
nop dword [rax]
test eax, eax
jne 0x1401003b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1401006ec
movzx eax, ax
or eax, 0xc0070000
jmp 0x1401006ec
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test r12b, r12b
je 0x1401005f8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp - 0x68]
mov dword [rbp - 0x68], 0x30
mov edx, 0xf01ff
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x50], esi
mov qword [rbp - 0x58], rsi
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword ds:[rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1401006ea
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
bt r14d, 0x11
jae 0x140100630
mov eax, dword ds:[rdi + 0x28]
lea r8, [rbp + 0x88]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov dword [rbp + 0x88], eax
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
js 0x1401006df
cmp qword [rdi + 0x18], rsi
jne 0x14010066a
call fcn.140137570
nop dword [rax + rax]
test rax, rax
je 0x14010066a
call fcn.140137570
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x78]
xor r8d, r8d
call qword [case.0x140101f48.0]
nop dword [rax]
cmp qword [rbp - 0x78], rsi
je 0x14010066a
or r14d, 2
mov rax, qword [rdi + 0x18]
mov r8, qword [rbp - 0x78]
test rax, rax
mov rcx, qword [rbp + 0x98]
mov r9, qword [rdi + 0x10]
cmovne r8, rax
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov ebx, eax
call fcn.1401376a0
test rax, rax
je 0x1401006df
cmp qword [rbp - 0x78], rsi
je 0x1401006df
call fcn.1401376a0
mov rcx, qword [rbp - 0x78]
call qword [case.0x140101f48.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x180]
mov r15, qword [rsp + 0x140]
add rsp, 0x148
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret