Function at 0x140115ce0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1f0], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x48], r9
movzx edi, r8b
mov qword [rbp - 0x58], rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0
je 0x1401162a6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rsp + 0x78], xmm1
xor r14d, r14d
mov word [rsp + 0x68], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400d7fe0
mov rbx, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140115dc2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140115dbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401162d8
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
test rbx, rbx
je 0x1401162a6
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x50], rax
lea rdx, str.RevertToSelf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.SetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x1401162a6
test r12, r12
je 0x1401162a6
test r13, r13
je 0x1401162a6
test rax, rax
je 0x1401162a6
xor r15d, r15d
mov qword [rbp + 0x68], r15
lea rcx, [rbp + 0x68]
call fcn.1400f0470
nop
mov qword [rsp + 0x60], r15
mov dword [rbp + 0x60], 0xffffffff
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x60]
call fcn.1400f1be0
test al, al
je 0x140116296
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140116296
cmp dword [rbp + 0x60], 0xffffffff
je 0x14011628d
mov qword [rsp + 0x60], r15
test dil, dil
je 0x140115eb9
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140116490
test al, al
jne 0x140115ece
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140116340
test al, al
je 0x14011628d
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x14011628d
mov r9d, 4
lea r8, [rbp + 0x60]
lea edx, [r9 + 8]
mov rcx, rdi
call r14
mov qword [rbp - 0x38], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400d7fe0
mov r15, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140115f7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140115f7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401162de
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rsp + 0x78], xmm0
xor eax, eax
mov word [rsp + 0x68], ax
test r15, r15
je 0x14011606d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], ax
lea r8d, [rax + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d7fe0
mov r14, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14011601f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011601a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401162e4
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm0
xor eax, eax
mov word [rbp - 0x78], ax
test r14, r14
je 0x14011606d
lea rdx, str.SetTokenInformation
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011606d
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011606d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x38]
call rax
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x10]
call fcn.140189b30
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 0x68
lea rax, str.WinSta0Default
mov qword [rbp], rax
mov eax, 1
mov word [rbp + 0x30], ax
mov dword [rbp + 0x2c], 0x81
mov r8, qword [rbp - 0x58]
mov rdx, rsi
lea rcx, [rbp + 0x70]
call fcn.140115630
nop
xor r15d, r15d
mov r14d, r15d
mov rcx, rdi
call qword [rbp - 0x50]
test eax, eax
je 0x140116163
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
cmp qword [rsi + 0x18], 8
jb 0x1401160ec
mov rsi, qword [rsi]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rsi
mov rcx, rdi
call r13
mov r14d, eax
test eax, eax
je 0x14011613a
mov ecx, dword [rbp - 0x20]
mov rax, qword [rbp - 0x48]
mov dword [rax], ecx
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14011614d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x28], r15
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140116160
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x38], r15
je 0x140116231
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f30
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d7fe0
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140116204
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401161ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401162ea
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140116231
mov rcx, qword [rbp - 0x38]
call rax
test r14d, r14d
setne bl
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140116276
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140116271
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401162d2
call fcn.140183104
movdqa xmm0, xmmword [0x140249480]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], r15w
jmp 0x140116298
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea rcx, [rbp + 0x68]
call fcn.1400f04f0
movzx eax, bl
jmp 0x1401162a8
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1401836b0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140195eec
nop
call fcn.140195eec
nop
call fcn.140195eec
int3
call fcn.140195eec
nop
call fcn.140195eec
int3