Function at 0x140119980
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1f0], rbx
mov rax, qword [0x1402c4148]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x48], r9
movzx edi, r8b
mov qword [rbp - 0x58], rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0
je 0x140119f46
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x14024e320]
movdqu xmmword [rsp + 0x78], xmm1
xor r14d, r14d
mov word [rsp + 0x68], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x68]
call fcn.140006b60
nop
call fcn.1400dbbd0
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400dbc80
mov rbx, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140119a62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119a5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119f78
call fcn.140187064
movdqa xmm0, xmmword [0x14024e320]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
test rbx, rbx
je 0x140119f46
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x50], rax
lea rdx, str.RevertToSelf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.SetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x140119f46
test r12, r12
je 0x140119f46
test r13, r13
je 0x140119f46
test rax, rax
je 0x140119f46
xor r15d, r15d
mov qword [rbp + 0x68], r15
lea rcx, [rbp + 0x68]
call fcn.1400f4110
nop
mov qword [rsp + 0x60], r15
mov dword [rbp + 0x60], 0xffffffff
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x60]
call fcn.1400f5880
test al, al
je 0x140119f36
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140119f36
cmp dword [rbp + 0x60], 0xffffffff
je 0x140119f2d
mov qword [rsp + 0x60], r15
test dil, dil
je 0x140119b59
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14011a130
test al, al
jne 0x140119b6e
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140119fe0
test al, al
je 0x140119f2d
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140119f2d
mov r9d, 4
lea r8, [rbp + 0x60]
lea edx, [r9 + 8]
mov rcx, rdi
call r14
mov qword [rbp - 0x38], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x14024e320]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rsp + 0x68]
call fcn.140006b60
nop
call fcn.1400dbbd0
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400dbc80
mov r15, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140119c1f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119c1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119f7e
call fcn.140187064
movdqa xmm0, xmmword [0x14024e320]
movdqu xmmword [rsp + 0x78], xmm0
xor eax, eax
mov word [rsp + 0x68], ax
test r15, r15
je 0x140119d0d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e320]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], ax
lea r8d, [rax + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x78]
call fcn.140006b60
nop
call fcn.1400dbbd0
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbc80
mov r14, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140119cbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119cba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119f84
call fcn.140187064
movdqa xmm0, xmmword [0x14024e320]
movdqu xmmword [rbp - 0x68], xmm0
xor eax, eax
mov word [rbp - 0x78], ax
test r14, r14
je 0x140119d0d
lea rdx, str.SetTokenInformation
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140119d0d
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140119d0d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x38]
call rax
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x10]
call fcn.14018da90
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 0x68
lea rax, str.WinSta0Default
mov qword [rbp], rax
mov eax, 1
mov word [rbp + 0x30], ax
mov dword [rbp + 0x2c], 0x81
mov r8, qword [rbp - 0x58]
mov rdx, rsi
lea rcx, [rbp + 0x70]
call fcn.1401192d0
nop
xor r15d, r15d
mov r14d, r15d
mov rcx, rdi
call qword [rbp - 0x50]
test eax, eax
je 0x140119e03
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
cmp qword [rsi + 0x18], 8
jb 0x140119d8c
mov rsi, qword [rsi]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rsi
mov rcx, rdi
call r13
mov r14d, eax
test eax, eax
je 0x140119dda
mov ecx, dword [rbp - 0x20]
mov rax, qword [rbp - 0x48]
mov dword [rax], ecx
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140119ded
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x28], r15
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140119e00
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x38], r15
je 0x140119ed1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x14024e320]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rbp - 0x78]
call fcn.140006b60
nop
call fcn.1400dbbd0
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400dbc80
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140119ea4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119e9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119f8a
call fcn.140187064
movdqa xmm0, xmmword [0x14024e320]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140119ed1
mov rcx, qword [rbp - 0x38]
call rax
test r14d, r14d
setne bl
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140119f16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140119f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140119f72
call fcn.140187064
movdqa xmm0, xmmword [0x14024e320]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], r15w
jmp 0x140119f38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea rcx, [rbp + 0x68]
call fcn.1400f4190
movzx eax, bl
jmp 0x140119f48
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140187610
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140199e4c
nop
call fcn.140199e4c
nop
call fcn.140199e4c
int3
call fcn.140199e4c
nop
call fcn.140199e4c
int3