Function at 0x140014060
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r15, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r14, r9
call fcn.140003ed0
mov rcx, rax
lea r9, str.false
mov r8, r15
lea rdx, str.startSystemUi__lpcommandline___S__showUI___s
call fcn.140005b00
cmp dword [rsi + 0x128], 0
jne 0x1400141bf
xor r13d, r13d
mov dword [rsi + 0x128], 1
mov ebp, r13d
mov dword [rsp + 0x70], 0x238
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor edx, edx
mov edi, eax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x60], r13d
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14001419a
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14001419a
mov qword [rsp + 0x310], r12
lea r12, str.winlogon.exe
nop dword [rax]
lea rdx, [rsp + 0x9c]
mov rax, 0xffffffffffffffff
nop
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r12 + rax*2 + 2]
jne 0x140014179
add rax, 2
cmp rax, 0xd
je 0x140014164
movzx ecx, word [rdx + rax*2]
cmp cx, word [r12 + rax*2]
je 0x140014140
jmp 0x140014179
mov ecx, dword [rsp + 0x78]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rsp + 0x60], edi
je 0x14001418e
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140014130
jmp 0x140014192
mov ebp, dword [rsp + 0x78]
mov r12, qword [rsp + 0x310]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
test ebp, ebp
jne 0x1400141e3
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.not_found_winlogon
call fcn.140005b00
xor al, al
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14001fab0
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8d, ebp
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsi + 0x10], rax
test rax, rax
je 0x1400141bf
lea r8, [rsi + 8]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140014225
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.OpenProcessToken_fail
jmp 0x1400141ba
mov rcx, qword [rsi + 8]
lea rbx, [rsi + 0x20]
mov r8, rbx
mov qword [rsp + 0x28], rsi
mov r9d, 1
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400141bf
lea rax, [rsi + 0x38]
mov r9, rbx
mov qword [rsp + 0x50], rax
lea rcx, [rsi + 0xb8]
mov qword [rsp + 0x48], rcx
mov r8, r15
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400142c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call fcn.140003ed0
mov rcx, rax
lea rdx, str.CreateProcessAsUser_fail__lu
mov r8d, ebx
call fcn.140005b00
jmp 0x1400141bf
mov r8, r14
mov rcx, rsi
call fcn.140013fb0
jmp 0x1400141c1