Function at 0x140008400
Capabilities:
Create process on windows
Get common file path

Disassembly:
jmp 0x140008400
mov r11, rsp
push rbp
lea rbp, [r11 - 0x28]
sub rsp, 0x120
mov rax, qword [0x140117010]
xor rax, rsp
mov qword [rbp], rax
xorps xmm0, xmm0
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
xor eax, eax
mov qword [r11 - 0x10], rdi
mov rsi, rdx
mov qword [r11 - 0x18], r14
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov ebx, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
movups xmmword [rbp - 0x6c], xmm0
mov dword [rbp - 0xc], eax
movups xmmword [rbp - 0x5c], xmm0
mov dword [rbp - 0x70], 0x68
movups xmmword [rbp - 0x4c], xmm0
mov qword [rbp - 0x78], rax
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
je 0x14000868f
lea rcx, str.___ImpersonateNamedPipeClient_OK._n
call fcn.140002630
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rcx, rax
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x140008680
lea rcx, str.___OpenThreadToken_OK._n
call fcn.140002630
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9d, [r14 + 2]
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140008671
lea rcx, str.___DuplicateTokenEx_OK._n
call fcn.140002630
cmp dword [0x14011700c], ebx
mov eax, 0x400
mov edi, 0x410
mov ecx, 0x208
cmovne edi, eax
call fcn.140002b8a
mov rbx, rax
test rax, rax
je 0x1400086a3
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140008549
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____GetSystemDirectory___Error:__i._n
jmp 0x14000869c
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x140008571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____CreateEnvironmentBlock___Error:__i._n
jmp 0x14000869c
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov r8, rsi
mov qword [rsp + 0x48], rax
xor edx, edx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1400085fb
lea rcx, str.___CreateProcessAsUser_OK._n
call fcn.140002630
cmp dword [0x14011700c], r14d
je 0x1400086a3
mov ecx, 1
call fcn.140004228
mov rcx, rax
call fcn.140003611
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400086a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400085c7
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea rcx, str.____CreateProcessAsUser___failed__possibly_due_to_missing_privileges__retrying_with_CreateProcessWithTokenW__._n
call fcn.140002630
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rbx
lea edx, [r8 + 1]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x140008662
lea rcx, str.___CreateProcessWithTokenW_OK._n
jmp 0x1400085c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____CreateProcessWithTokenW_failed___d_._n
jmp 0x14000869c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____DupicateTokenEx___Error:__i._n
jmp 0x14000869c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____OpenThreadToken___Error:__i._n
jmp 0x14000869c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____ImpersonateNamedPipeClient___Error:__i._n
mov edx, eax
call fcn.140002630
mov rcx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x148]
test rcx, rcx
je 0x1400086cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400086db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400086e8
mov rcx, rbx
call fcn.140002108
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x140]
test rcx, rcx
je 0x1400086ff
call sub.USERENV.dll_DestroyEnvironmentBlock
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000870f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14000871e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400026b7
add rsp, 0x120
pop rbp
ret