Function at 0x14005a9d0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rbp - 8], rax
mov r13, r9
mov r12d, r8d
mov rsi, rdx
mov r14, rcx
xor r15d, r15d
test r9, r9
je 0x14005acca
xor edx, edx
lea r8d, [r15 + 0x68]
lea rcx, [rbp - 0x80]
call fcn.140222790
mov dword [rbp - 0x80], 0x68
mov dword [rbp - 0x44], 0x100
movdqa xmm0, xmmword [0x1403a9d30]
movdqa xmmword [rbp - 0x30], xmm0
mov rdi, 0xffffffffffffffff
mov qword [rbp - 0x20], rdi
call fcn.140039c50
mov rcx, rax
test rax, rax
je 0x14005aced
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14004487d.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
test r14, r14
je 0x14005aa97
mov r8, r14
lea rcx, [rsp + 0x60]
test rsi, rsi
je 0x14005aaa4
mov r9, rsi
lea rdx, [0x1403285e0]
call fcn.140058ab0
jmp 0x14005aab0
test rsi, rsi
je 0x14005aab5
mov r8, rsi
lea rcx, [rsp + 0x60]
lea rdx, [0x14031b830]
call fcn.140058ab0
mov rbx, qword [rsp + 0x60]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], rbx
lea rax, str.CreateProcessWithCommandArgs_____s__d__d
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 2]
lea r8, [0x1404675c0]
mov edx, 0x306
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedutilities.cpp
call fcn.140039f30
test r12d, r12d
je 0x14005ac1f
lea rax, str.winsta0default
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x70], r14
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov esi, eax
mov dword [rbp - 0x10], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rbp - 0x10], esi
je 0x14005ac1f
lea rdx, [rsp + 0x70]
mov ecx, esi
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
test eax, eax
je 0x14005acac
mov qword [rsp + 0x78], r14
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14005ac0f
cmp dword [rbx - 8], 1
jle 0x14005ab84
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14003b6e0
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8000420
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
mov r15d, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
lea rax, str.CreateProcessWithCommandArgs__s_____CreateProcessAsUser_____d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, [0x1404675c0]
mov edx, 0x322
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedutilities.cpp
call fcn.140039f30
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005acac
cmp dword [rbx - 8], 1
jle 0x14005ac37
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14003b6e0
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x48], r13
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r15d, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
lea rax, str.CreateProcessWithCommandArgs__s_____CreateProcess_____d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
lea r8, [0x1404675c0]
mov edx, 0x333
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedutilities.cpp
call fcn.140039f30
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14005acca
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004487d.0]
mov eax, r15d
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140202880
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140039950
int3