Function at 0x14001cd20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov r14, rdx
mov r12, r8
xor edx, edx
mov r15, rcx
lea rcx, [rbp - 0x30]
mov r13, r9
lea r8d, [rdx + 0x68]
call fcn.1400aeef0
mov rcx, qword [r15]
xor eax, eax
mov qword [rbp - 0x68], rax
mov edx, 0x5c
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov eax, 5
mov word [rbp + 0x10], ax
lea rax, str.Winsta0Default
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 1
call fcn.1400adf44
mov rcx, qword [r15]
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x14001cdad
sub rax, rcx
sar rax, 1
cmp eax, esi
jne 0x14001cdc6
mov edx, 0x2f
call fcn.1400adf44
test rax, rax
jne 0x14001cdc0
mov eax, esi
jmp 0x14001cdc6
sub rax, qword [r15]
sar rax, 1
xor ecx, ecx
mov qword [rsp + 0x190], rbx
test eax, eax
mov edi, ecx
cmovns edi, eax
mov rax, qword [r15]
lea rcx, [rax - 0x18]
cmp edi, dword [rax - 0x10]
jl 0x14001cdf1
call fcn.14000c440
lea rbx, [rax + 0x18]
jmp 0x14001ce81
mov rcx, qword [rcx]
test rcx, rcx
je 0x14001ce07
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001ce18
call fcn.14000ce10
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x20]
mov rcx, rax
mov r14, qword [r15]
test rcx, rcx
je 0x14001d15c
test r14, r14
jne 0x14001ce31
test edi, edi
jne 0x14001d151
mov rax, qword [rcx]
mov r8d, 2
mov edx, edi
call qword [rax]
test rax, rax
je 0x14001d167
lea rbx, [rax + 0x18]
test edi, edi
js 0x14001d151
cmp edi, dword [rbx - 0xc]
jg 0x14001d151
movsxd rax, edi
mov r8, r14
mov dword [rbx - 0x10], edi
mov rcx, rbx
lea rdx, [rax + rax]
xor eax, eax
mov r9, rdx
mov word [rdx + rbx], ax
call fcn.140018b60
mov r14, qword [rbp + 0x88]
call fcn.14000ce10
test rax, rax
je 0x14001d146
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [0x1400f5fd8]
mov qword [rsp + 0x70], rax
cmp rdx, 0x10000
jae 0x14001cec0
movzx edx, dx
lea rcx, [rsp + 0x70]
call fcn.14000d4c0
jmp 0x14001ceda
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14001cec3
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.14000fd40
call fcn.14000ce10
test rax, rax
je 0x14001d146
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [0x1400f5fe0]
mov qword [rsp + 0x68], rax
cmp rdx, 0x10000
jae 0x14001cf19
movzx edx, dx
lea rcx, [rsp + 0x68]
call fcn.14000d4c0
jmp 0x14001cf37
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14001cf20
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.14000fd40
mov r8, r15
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.14001c5a0
mov rdx, rax
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.14001c5a0
mov rdx, rax
lea rcx, [rbp - 0x80]
mov r8, r14
call fcn.14001c5a0
mov rdx, qword [rbp - 0x78]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cf85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x70]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cfa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x68]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cfc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x70]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001cfde
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp - 0x80]
lea r9, [rbp + 0x80]
xor r15d, r15d
lea r8, [rsp + 0x60]
mov word [rsp + 0x60], r15w
mov ecx, dword [rax - 0x10]
inc ecx
movsxd rdi, ecx
lea rcx, [rbp - 0x50]
mov rdx, rdi
call fcn.14001c400
mov r8, qword [rbp - 0x80]
mov rdx, rdi
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call fcn.1400b7b6c
xor r8d, r8d
mov qword [rsp + 0x78], r15
mov rdx, r12
lea rcx, [rsp + 0x78]
call sub.USERENV.dll_CreateEnvironmentBlock
mov rcx, r12
test eax, eax
jne 0x14001d045
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14b, r14b
jmp 0x14001d0b3
lea rax, [rbp - 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rdi
lea rax, [rbp - 0x30]
xor edx, edx
mov qword [rsp + 0x48], rax
mov r14b, 1
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
movzx r14d, r14b
cmove r14d, r15d
test r13, r13
je 0x14001d0a0
mov rax, qword [rbp - 0x68]
mov qword [r13], rax
mov rcx, qword [rsp + 0x78]
call sub.USERENV.dll_DestroyEnvironmentBlock
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14001d0f2
mov rdx, qword [rbp - 0x40]
mov rax, rdi
sub rdx, rdi
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x14001d0ea
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d16d
mov rcx, rdi
call fcn.1400a7308
mov rdx, qword [rbp - 0x80]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001d10f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14001d127
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rbx, qword [rsp + 0x190]
movzx eax, r14b
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80070057
call fcn.14000c310
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
call fcn.140010030
int3
call fcn.1400b7964
int3