Function at 0x1401199b0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1f0], rbx
mov rax, qword [0x1402c5168]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x48], r9
movzx edi, r8b
mov qword [rbp - 0x58], rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0
je 0x140119f76
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rsp + 0x78], xmm1
xor r14d, r14d
mov word [rsp + 0x68], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400dbc00
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400dbcb0
mov rbx, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140119a92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119a8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119fa8
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
test rbx, rbx
je 0x140119f76
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x50], rax
lea rdx, str.RevertToSelf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.SetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x140119f76
test r12, r12
je 0x140119f76
test r13, r13
je 0x140119f76
test rax, rax
je 0x140119f76
xor r15d, r15d
mov qword [rbp + 0x68], r15
lea rcx, [rbp + 0x68]
call fcn.1400f4140
nop
mov qword [rsp + 0x60], r15
mov dword [rbp + 0x60], 0xffffffff
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x60]
call fcn.1400f58b0
test al, al
je 0x140119f66
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140119f66
cmp dword [rbp + 0x60], 0xffffffff
je 0x140119f5d
mov qword [rsp + 0x60], r15
test dil, dil
je 0x140119b89
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14011a160
test al, al
jne 0x140119b9e
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14011a010
test al, al
je 0x140119f5d
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140119f5d
mov r9d, 4
lea r8, [rbp + 0x60]
lea edx, [r9 + 8]
mov rcx, rdi
call r14
mov qword [rbp - 0x38], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400dbc00
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400dbcb0
mov r15, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140119c4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119c4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119fae
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rsp + 0x78], xmm0
xor eax, eax
mov word [rsp + 0x68], ax
test r15, r15
je 0x140119d3d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], ax
lea r8d, [rax + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400dbc00
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbcb0
mov r14, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140119cef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119cea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119fb4
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm0
xor eax, eax
mov word [rbp - 0x78], ax
test r14, r14
je 0x140119d3d
lea rdx, str.SetTokenInformation
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140119d3d
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140119d3d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x38]
call rax
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x10]
call fcn.14018d8d0
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 0x68
lea rax, str.WinSta0Default
mov qword [rbp], rax
mov eax, 1
mov word [rbp + 0x30], ax
mov dword [rbp + 0x2c], 0x81
mov r8, qword [rbp - 0x58]
mov rdx, rsi
lea rcx, [rbp + 0x70]
call fcn.140119300
nop
xor r15d, r15d
mov r14d, r15d
mov rcx, rdi
call qword [rbp - 0x50]
test eax, eax
je 0x140119e33
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
cmp qword [rsi + 0x18], 8
jb 0x140119dbc
mov rsi, qword [rsi]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rsi
mov rcx, rdi
call r13
mov r14d, eax
test eax, eax
je 0x140119e0a
mov ecx, dword [rbp - 0x20]
mov rax, qword [rbp - 0x48]
mov dword [rax], ecx
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140119e1d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x28], r15
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140119e30
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x38], r15
je 0x140119f01
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400dbc00
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbcb0
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140119ed4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119ecf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119fba
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140119f01
mov rcx, qword [rbp - 0x38]
call rax
test r14d, r14d
setne bl
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140119f46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119f41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119fa2
call fcn.140186ea4
movdqa xmm0, xmmword [0x14024e620]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], r15w
jmp 0x140119f68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea rcx, [rbp + 0x68]
call fcn.1400f41c0
movzx eax, bl
jmp 0x140119f78
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140187450
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140199c8c
nop
call fcn.140199c8c
nop
call fcn.140199c8c
int3
call fcn.140199c8c
nop
call fcn.140199c8c
int3