Function at 0x140009470
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get program files directory
Get session user name
Get startup folder
Impersonate user

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rsp + 0x430], rbx
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
movzx esi, r8b
mov r14, rdx
mov qword [rbp - 0x28], rdx
mov r15, rcx
mov qword [rbp - 0x30], rcx
mov r13d, 0x80004005
call fcn.140091150
test al, al
je 0x1400094e7
call fcn.140008d90
test al, al
jne 0x1400094f7
mov rcx, r15
call fcn.140008b80
test al, al
jne 0x1400094f7
jmp 0x140009c99
mov rcx, r15
call fcn.140008b80
test al, al
je 0x140009c99
lea rcx, [rbp - 8]
call fcn.1400386c0
lea rcx, [rbp - 8]
call fcn.1400415c0
test al, al
jne 0x140009524
mov r13d, 0x80040200
lea rcx, str.ShowSoftwareHomepage:E_VU_INTERNETNOTAVAILABLE
call fcn.1400191f0
jmp 0x140009c99
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x60]
call fcn.1400386c0
nop
xor bl, bl
lea rdi, [rbp + 0x18]
xor eax, eax
mov ecx, reloc.ATL100.DLL_Ordinal_56
rep stosb byte [rdi], al
xor edi, edi
mov qword [rbp - 0x80], rdi
mov dword [rsp + 0x78], edi
lea rdx, [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
or r12, 0xffffffffffffffff
mov ecx, dword [rsp + 0x78]
test eax, eax
jne 0x140009582
test ecx, ecx
je 0x140009615
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.1400ca8e8
mov rdi, rax
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140009606
test rdi, rdi
je 0x140009613
mov dword [rbp + 0x18], reloc.ATL100.DLL_Ordinal_56
mov qword [rbp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rbp - 0x80]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140009606
lea rdx, [rbp + 0x18]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x140009606
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140009606
mov r8, qword [rbp + 0x48]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.140002db0
movzx ebx, al
test rdi, rdi
je 0x140009613
mov rcx, rdi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x140009633
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140009646
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140009646
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], rdi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.1400034f0
test sil, sil
je 0x14000967c
test al, al
jne 0x140009673
mov r13d, 0x80040205
lea rcx, [rsp + 0x60]
call fcn.1400036a0
nop
jmp 0x140009c7a
mov dword [rbp - 0x78], 2
jmp 0x140009699
test bl, bl
jne 0x140009696
mov r13d, 0x80040206
lea rcx, [rsp + 0x60]
call fcn.1400036a0
nop
jmp 0x140009c7a
mov dword [rbp - 0x78], edi
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x68], rsi
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea rdi, [rbp + 0xc0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor r9d, r9d
lea r8d, [rax + 0x26]
lea rdx, [rbp + 0xc0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
setne al
test al, al
je 0x1400099a0
xor eax, eax
mov rcx, r12
lea rdi, [rbp + 0xc0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140009784
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14000980b
cmp dword [rdx + 0x10], eax
jge 0x140009751
cmp dword [rsi - 0xc], eax
jge 0x140009741
mov ecx, 0x80070057
call fcn.140001000
int3
xor r15d, r15d
mov dword [rsi - 0x10], r15d
mov word [rsi], r15w
jmp 0x14000980e
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009768
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rbx, qword [rsp + 0x70]
jmp 0x14000980b
mov r15d, dword [rsi - 0x10]
lea r14, [rbp + 0xc0]
sub r14, rsi
sar r14, 1
test ecx, ecx
jns 0x1400097a4
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400097c6
mov edx, edi
lea rcx, [rsp + 0x68]
call fcn.140001c20
mov rsi, qword [rsp + 0x68]
movsxd rax, edi
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
add rdx, rdx
cmp r14, r15
lea r15, [rax + rax]
mov r9, r15
ja 0x1400097eb
lea r8, [rsi + r14*2]
call qword [sym.imp.MSVCR100.dll_memmove_s]
jmp 0x1400097f8
lea r8, [rbp + 0xc0]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp edi, dword [rsi - 0xc]
jg 0x140009995
mov dword [rsi - 0x10], edi
xor edi, edi
mov word [r15 + rsi], di
xor r15d, r15d
mov r8d, reloc.ATL100.DLL_Ordinal_17
lea rdx, str.SonyVAIO_Update
lea rcx, [rsp + 0x68]
call fcn.140003c10
mov rdi, qword [rsp + 0x68]
lea rcx, [rdi - 0x18]
lea rsi, [rbx - 0x18]
cmp rcx, rsi
je 0x14000996d
cmp dword [rsi + 0x10], 0
jl 0x140009874
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140009874
call fcn.140001b90
mov rbx, rax
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000986b
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
add rbx, 0x18
jmp 0x140009968
movsxd r14, dword [rdi - 0x10]
test r14d, r14d
jne 0x1400098da
mov rdi, qword [rsi]
cmp dword [rsi + 8], r14d
je 0x14000996d
cmp dword [rsi + 0x10], r14d
jge 0x1400098ae
cmp dword [rbx - 0xc], r14d
jge 0x1400098a1
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x14000996d
mov eax, r12d
lock xadd dword [rsi + 0x10], eax
dec eax
test eax, eax
jg 0x1400098c8
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
jmp 0x140009968
mov eax, dword [rbx - 0x10]
mov dword [rbp - 0x40], eax
mov r15, rdi
sub r15, rbx
sar r15, 1
test r14d, r14d
jns 0x1400098f9
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
sub eax, r14d
or eax, ecx
jge 0x14000991d
mov edx, r14d
lea rcx, [rsp + 0x70]
call fcn.140001c20
mov rbx, qword [rsp + 0x70]
mov eax, dword [rbp - 0x40]
lea rsi, [r14 + r14]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, rsi
add rdx, rdx
cmp r15, rax
ja 0x140009942
lea r8, [rbx + r15*2]
call qword [sym.imp.MSVCR100.dll_memmove_s]
jmp 0x14000994b
mov r8, rdi
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp r14d, dword [rbx - 0xc]
jg 0x14000995d
mov dword [rbx - 0x10], r14d
xor edi, edi
mov word [rsi + rbx], di
jmp 0x14000996f
mov ecx, 0x80070057
call fcn.140001000
int3
mov qword [rsp + 0x70], rbx
xor edi, edi
mov r8d, Ordinal_20
lea rdx, str.ShellExeProxy.exe
lea rcx, [rsp + 0x68]
call fcn.140003c10
mov rsi, qword [rsp + 0x68]
mov r14, qword [rbp - 0x28]
mov r15, qword [rbp - 0x30]
jmp 0x1400099a2
mov ecx, 0x80070057
call fcn.140001000
int3
xor edi, edi
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140009c32
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
test r14, r14
je 0x140009a29
test r14, 0xffffffffffff0000
jne 0x140009a16
movzx edi, r14w
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x140009a3b
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140001f70
jmp 0x140009a3b
xor eax, eax
mov rcx, r12
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140009a2b
mov ecx, edi
mov r8d, ecx
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.140001e80
nop
lea r8, [rbp - 0x50]
mov rdx, qword [rbp - 0x68]
mov rcx, r15
call fcn.1400ae8f0
mov r13d, eax
test eax, eax
js 0x140009bee
mov rdx, qword [rbp - 0x50]
cmp dword [rdx - 0x10], 0
je 0x140009bee
lea rcx, [0x14011d880]
mov rdx, qword [0x14011d880]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp - 0x50]
mov r8, rsi
lea rdx, str.__s_____s____d
lea rcx, [rbp - 0x58]
call fcn.140004440
xor esi, esi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp + 0x10], rsi
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rbp - 0x60]
call sub.WTSAPI32.dll_WTSQueryUserToken
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
lea r9d, [rsi + 2]
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov qword [rbp - 0x48], rsi
xor r8d, r8d
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x48]
call sub.USERENV.dll_CreateEnvironmentBlock
mov qword [rbp - 0x20], rsi
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
xor edx, edx
lea r8d, [rsi + 0x60]
lea rcx, [rbp + 0x58]
call sub.MSVCR100.dll_memset
mov dword [rbp + 0x50], 0x68
mov rdi, qword [rbp - 0x58]
cmp dword [rdi - 8], 1
jle 0x140009b33
mov edx, dword [rdi - 0x10]
lea rcx, [rbp - 0x58]
call fcn.140001930
mov rdi, qword [rbp - 0x58]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x4000410
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x140009be3
cmp eax, dword [rdi - 0xc]
jg 0x140009be3
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140009ba7
call sub.USERENV.dll_DestroyEnvironmentBlock
mov qword [rbp - 0x48], rsi
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140009bb6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140009bc6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009bee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140009bee
mov ecx, 0x80070057
call fcn.140001000
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009c0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009c2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x70]
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009c4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140009c6f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x60]
call fcn.1400036a0
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140009c99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, r13d
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x430]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret