Function at 0x140044480
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0x100], xmm6
mov r14, rcx
lea rax, [0x140443140]
mov qword [rsp + 0x60], rax
mov rax, qword [0x140443170]
cmp rax, 3
jne 0x140044720
mov rax, qword [rsp + 0x60]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x28]
test rsi, rsi
je 0x140044550
lea rax, [rdi + rsi]
mov rcx, rdi
jmp 0x1400444e8
mov rcx, rdx
cmp rcx, rax
je 0x140044550
lea rdx, [rcx + 1]
movzx ebx, byte [rcx]
test bl, bl
jns 0x1400444e0
add rcx, 2
cmp bl, 0xe0
jae 0x140044505
cmp rdx, rax
cmove rcx, rdx
jmp 0x1400444e3
cmp bl, 0xed
jne 0x140044529
cmp rdx, rax
cmove rcx, rdx
cmp rcx, rax
je 0x140044550
add rcx, 1
cmp rdx, rax
je 0x1400444e3
cmp byte [rdx], 0xa0
jb 0x1400444e3
jmp 0x140044759
cmp rdx, rax
mov rbp, rcx
cmove rbp, rdx
xor ecx, ecx
cmp rbp, rax
setne cl
add rcx, rbp
cmp bl, 0xf0
jb 0x1400444e3
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x1400444e3
call fcn.140091c85
mov r15b, 4
test rax, rax
je 0x140044578
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rbx, rdx
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov rcx, rdx
mov edx, 0xf00ff
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.advapi32.dll_DuplicateTokenEx]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
test ebp, ebp
je 0x14004455d
xorps xmm6, xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0xf0], 0
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x80], 0
mov rbx, qword [rsp + 0x60]
mov rcx, rdi
mov rdx, rsi
call fcn.140090932
mov rdi, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CreateProcessAsUserW]
mov esi, eax
test rdi, rdi
je 0x14004467e
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [rsp + 0x6c], 0
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x6c]
call qword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov edi, eax
mov rcx, qword [rsp + 0x70]
mov rbx, qword [sym.imp.kernel32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x78]
call rbx
test esi, esi
sete al
test edi, edi
sete cl
or cl, al
jne 0x14004455d
mov eax, dword [rsp + 0x6c]
cmp eax, 0xffffffff
sete cl
cmp eax, dword [r14]
setg al
or al, cl
mov cl, byte [r14 + 4]
test cl, cl
jne 0x1400446f0
mov r15b, 1
test al, al
je 0x140044717
test cl, cl
je 0x1400446fb
mov r15b, 3
test al, al
je 0x140044717
test cl, cl
jne 0x140044706
mov r15b, 2
test al, al
jne 0x140044717
test cl, cl
setne r15b
and r15b, al
xor r15b, 1
shl r15b, 2
mov byte [r14 + 4], al
jmp 0x14004455d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x90], rax
lea rcx, [0x140443170]
lea r9, [0x1403eadd8]
lea r8, [rsp + 0x90]
xor edx, edx
call fcn.140096ca7
jmp 0x1400444b7
ud2