Function at 0x140005190
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x328
mov rax, qword [0x140016008]
xor rax, rsp
mov qword [rsp + 0x310], rax
xor r9d, r9d
lea r8, str.EnableLUA
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call fcn.140004fe0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140005277
lea rdi, [rsp + 0x40]
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x500
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x78], 0
lea rax, str.runas
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x368]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rax, qword [rsp + 0x78]
jmp 0x1400054f2
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x2d0], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x2d8], rax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x2d0]
movzx eax, byte [rax]
mov byte [rsp + 0x2e8], al
mov rcx, qword [rsp + 0x2d8]
movzx eax, byte [rsp + 0x2e8]
mov byte [rcx], al
mov rax, qword [rsp + 0x2d0]
add rax, 1
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x2d8]
add rax, 1
mov qword [rsp + 0x2d8], rax
cmp byte [rsp + 0x2e8], 0
jne 0x1400052a7
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x350]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jbe 0x14000541f
mov rax, qword [rsp + 0x350]
movsx eax, byte [rax + 1]
cmp eax, 0x3a
jne 0x14000541f
mov edx, 0x22
mov rcx, qword [rsp + 0x350]
call fcn.140005b74
test rax, rax
jne 0x14000541f
mov edx, 0x20
mov rcx, qword [rsp + 0x350]
call fcn.140005b74
test rax, rax
je 0x14000541f
mov byte [rsp + 0xc0], 0x22
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x2f0], rax
lea rax, [rsp + 0xc1]
mov qword [rsp + 0x2f8], rax
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x2f0]
movzx eax, byte [rax]
mov byte [rsp + 0x308], al
mov rcx, qword [rsp + 0x2f8]
movzx eax, byte [rsp + 0x308]
mov byte [rcx], al
mov rax, qword [rsp + 0x2f0]
add rax, 1
mov qword [rsp + 0x2f0], rax
mov rax, qword [rsp + 0x2f8]
add rax, 1
mov qword [rsp + 0x2f8], rax
cmp byte [rsp + 0x308], 0
jne 0x1400053a4
lea rdi, [rsp + 0xc0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x14001472c]
mov ecx, 2
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x368]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x358]
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x340]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov qword [rsp + 0x2c0], rax
mov dword [rsp + 0x2c8], 0
jmp 0x140005483
mov eax, dword [rsp + 0x2c8]
add eax, 1
mov dword [rsp + 0x2c8], eax
cmp dword [rsp + 0x2c8], 5
jge 0x1400054ea
cmp dword [rsp + 0x2c0], 0x20
jg 0x1400054ea
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [rsp + 0x368]
mov dword [rsp + 0x28], edx
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x358]
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x340]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov qword [rsp + 0x2c0], rax
jmp 0x140005472
mov rax, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1400059d0
add rsp, 0x328
pop rdi
pop rsi
ret