Function at 0x140036920
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov qword [rbp - 0x38], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea rsi, [rbp - 0x38]
mov rcx, rax
mov edx, 8
mov r8, rsi
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x1400369fe
call fcn.140036840
mov dword [rbp + 0xc0], eax
mov dword [rbp + 0xa8], 0
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xc0]
mov edx, 0x14
mov r9d, 4
call qword [sym.imp.advapi32.dll_GetTokenInformation]
test eax, eax
je 0x140036a22
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400369db
call fcn.14027f3b0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], edx
test edx, edx
sete cl
test rax, rax
sete al
or al, cl
jne 0x1400369db
lea rcx, [rbp + 0x38]
call fcn.14027fa60
cmp dword [rbp + 0xc0], 0
je 0x140036a6d
lea rcx, str.Already_running_as_an_administrator._No_need_to_elevate.kernel32.dlladvapi32.dlluser32.dllgdi32.dll
mov edx, 0x38
call fcn.14003ad10
jmp 0x140036bd3
call fcn.14027f3b0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], edx
test edx, edx
je 0x140036968
test rax, rax
je 0x140036a6d
lea rcx, [rbp + 0x38]
call fcn.14027fa60
jmp 0x140036a6d
call fcn.14027f3b0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], edx
test edx, edx
je 0x1400369a9
test rax, rax
je 0x140036a44
lea rcx, [rbp + 0x38]
call fcn.14027fa60
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x140036a6d
call fcn.14027f3b0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], edx
test edx, edx
sete cl
test rax, rax
sete al
or al, cl
je 0x140036a17
xor ecx, ecx
mov edx, 2
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0xe4], eax
test eax, eax
je 0x140036ade
lea rax, [rbp + 0xe4]
mov qword [rbp - 0x38], rax
lea rax, [0x14027fcf0]
mov qword [rbp - 0x30], rax
lea rax, [0x140302120]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 1
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], 1
lea rsi, [rbp - 0x50]
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.1402db0a0
mov rcx, rsi
call fcn.1402daa50
jmp 0x140036bd5
lea rdx, [0x140302088]
lea rcx, [rbp + 0xc0]
mov r8d, 0x42
call fcn.14003a410
lea rdx, [0x1403020ca]
lea rcx, [rbp + 0xa8]
mov r8d, 5
call fcn.14003a410
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xd8], rax
mov rsi, qword [rbp + 0xc8]
lea rcx, [rbp + 0x38]
call fcn.14027f0c0
movabs rax, 0x10000000070
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 0
mov rcx, qword [rbp + 0xd8]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov dword [rbp - 8], 1
movups xmm0, xmmword [rbp + 0x70]
movups xmm1, xmmword [rbp + 0x80]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov eax, dword [rbp + 0x90]
mov dword [rbp + 0x20], eax
movups xmm0, xmmword [rbp + 0x98]
movups xmmword [rbp + 0x28], xmm0
mov rdx, qword [rbp + 0xa8]
test rdx, rdx
je 0x140036ba2
add rdx, rdx
mov r8d, 2
call fcn.140061f30
lea rcx, [rbp - 0x38]
call qword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
je 0x140036be0
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x140036bd3
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.140061f30
xor eax, eax
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
call fcn.14027f3b0
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], edx
test edx, edx
je 0x140036bb0
test rax, rax
je 0x140036bfe
lea rcx, [rbp + 0x38]
call fcn.14027fa60
lea rcx, [0x1403020cf]
mov edx, 0x34
call fcn.1402dab00
mov r9, qword [rbp + 0xc0]
test r9, r9
je 0x140036bd5
add r9, r9
mov r8d, 2
mov rcx, rsi
mov rsi, rdx
mov rdx, r9
mov rdi, rax
call fcn.140061f30
mov rdx, rsi
mov rax, rdi
jmp 0x140036bd5