Function at 0x14009d440
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x148], 0xfffffffffffffffe
mov ecx, 1
xor edx, edx
call fcn.140189a20
mov r12, qword [0x1402600c0]
mov rax, qword [r12]
cmp rax, 3
jb 0x14009d4f9
lea rax, str.Attempting_to_launch_terminal_as_SYSTEM...
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
lea rcx, [0x1401d6020]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], 4
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], 4
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x10]
lea r8, [rbp + 0x110]
mov edx, 3
xor r9d, r9d
call fcn.1401289b0
lea rax, str.C:WindowsSystem32cmd.exeActive_session_ID:
mov qword [rbp + 0x80], rax
lea rax, [0x1401d6053]
mov qword [rbp + 0x88], rax
mov word [rbp + 0x90], 0
mov dword [rbp + 0x98], 1
lea rcx, [rbp - 8]
lea rdi, [rbp + 0x80]
mov rdx, rdi
call fcn.14002d8e0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x70], 0
mov dword [rbp + 0x10], 0x68
lea rax, [0x1401d5ecd]
mov qword [rbp + 0x110], rax
lea rax, [0x1401d5edc]
mov qword [rbp + 0x118], rax
mov word [rbp + 0x120], 0
mov dword [rbp + 0x128], 1
lea rbx, [rbp + 0xe8]
lea rsi, [rbp + 0x110]
mov rcx, rbx
mov rdx, rsi
call fcn.14002d8e0
mov rdx, qword [rbp + 0xe8]
mov r14, qword [rbp + 0xf0]
test rdx, rdx
je 0x14009d5d1
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.1400b4820
mov qword [rbp + 0x20], r14
mov dword [rbp + 0x4c], 1
mov word [rbp + 0x50], 5
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
call qword [sym.imp.kernel32.dll_WTSGetActiveConsoleSessionId]
mov dword [rbp + 0xa4], eax
mov rcx, qword [r12]
cmp eax, 0xffffffff
je 0x14009d9f6
cmp rcx, 3
jb 0x14009d6c6
lea rax, [rbp + 0xa4]
mov qword [rbp + 0xd8], rax
lea rax, [0x1401b7d80]
mov qword [rbp + 0xe0], rax
lea rax, [0x1401d6068]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x1401d6078]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 3
xor r9d, r9d
call fcn.1401289b0
call fcn.140046d40
mov qword [rbp + 0xc0], rax
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r8, [rbp + 0xc0]
mov rcx, rax
mov edx, 0xb
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x14009dac7
call fcn.140046d40
mov qword [rbp + 0xb8], rax
mov rcx, qword [rbp + 0xc0]
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov edx, 0x18b
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.advapi32.dll_DuplicateTokenEx]
test eax, eax
je 0x14009dbc7
mov eax, dword [rbp + 0xa4]
mov dword [rbp + 0xa0], eax
mov rcx, qword [rbp + 0xb8]
lea r8, [rbp + 0xa0]
mov edx, 0xc
mov r9d, 4
call qword [sym.imp.advapi32.dll_SetTokenInformation]
test eax, eax
je 0x14009df27
mov dword [rbp + 0xb0], 0
mov rax, qword [r12]
cmp rax, 3
jb 0x14009d818
lea rax, str.Creating_process_in_users_session...
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x120], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x147], 1
lea rcx, [0x1401d6120]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 3
xor r9d, r9d
call fcn.1401289b0
mov rcx, qword [rbp + 0xb8]
mov r14, qword [rbp]
mov byte [rbp + 0x147], 1
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, r14
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14009e090
mov rax, qword [r12]
cmp rax, 3
jb 0x14009d916
lea rax, str.Successfully_launched_terminal_as_SYSTEM.
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x120], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x147], 1
lea rcx, [0x1401d6178]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 3
xor r9d, r9d
call fcn.1401289b0
mov rcx, qword [rbp + 0xc0]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14009d963
mov byte [rbp + 0x147], 1
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009d963
test rax, rax
je 0x14009d963
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov rcx, qword [rbp + 0xb8]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14009d9b0
mov byte [rbp + 0x147], 1
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009d9b0
test rax, rax
je 0x14009d9b0
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov r15d, dword [rbp - 0x10]
cmp dword [rbp + 0xb0], 0
je 0x14009d9d3
cmp qword [rbp + 0xa8], 0
je 0x14009d9d3
lea rcx, [rbp + 0xa8]
call fcn.14017f2a0
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14009ddf2
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.1400b4820
jmp 0x14009ddf2
test rcx, rcx
je 0x14009dabd
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14017ef10]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_get_active_session_ID._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x1401d62c8]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.1401289b0
call fcn.14017f2b0
jmp 0x14009dcfa
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009d6f5
test rax, rax
je 0x14009daf2
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov rax, qword [r12]
test rax, rax
je 0x14009dbbd
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14017ef10]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_open_SYSTEM_token._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x1401d6278]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.1401289b0
call fcn.14017f2b0
jmp 0x14009dcfa
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009d738
test rax, rax
je 0x14009dbf2
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov rax, qword [r12]
test rax, rax
je 0x14009dcbd
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14017ef10]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_duplicate_SYSTEM_token._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x1401d6228]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.1401289b0
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14009dcf5
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009dcf5
test rax, rax
je 0x14009dcf5
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
call fcn.14017f2b0
mov r15, rax
mov r14d, edx
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14009dd1b
mov rcx, qword [rbp]
add rdx, rdx
mov r8d, 2
call fcn.1400b4820
test r14d, r14d
je 0x14009ddf2
mov qword [rbp + 0x80], r15
mov dword [rbp + 0x88], r14d
mov rax, qword [r12]
test rax, rax
je 0x14009ddd8
mov qword [rbp + 0xe8], rdi
lea rax, [0x14017f3b0]
mov qword [rbp + 0xf0], rax
lea rax, str.Failed_to_launch_terminal._Error:
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 1
lea rcx, [0x1401d5608]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], 4
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], 4
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x10]
lea r8, [rbp + 0x110]
mov edx, 1
xor r9d, r9d
call fcn.1401289b0
mov r15, qword [rbp + 0x80]
test r15, r15
je 0x14009df15
lea rcx, [rbp + 0x80]
call fcn.14017f2a0
jmp 0x14009df15
mov dword [rbp + 0x80], r15d
mov rax, qword [r12]
cmp rax, 3
jb 0x14009de99
mov qword [rbp + 0xe8], rdi
lea rax, [0x1401b7d80]
mov qword [rbp + 0xf0], rax
lea rax, str.Successfully_launched_terminal_as_SYSTEM_with_PID:
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 1
lea rcx, [0x1401d5530]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], 4
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], 4
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x10]
lea r8, [rbp + 0x110]
mov edx, 3
xor r9d, r9d
call fcn.1401289b0
mov rax, qword [0x140260020]
cmp rax, 3
jne 0x14009e281
mov rdi, qword [0x140260028]
lea rsi, [rdi + 0x10]
mov cl, 1
xor eax, eax
lock cmpxchg byte [rdi + 0x10], cl
jne 0x14009e2b6
mov rbx, qword [0x1402600e8]
mov rax, qword [rbx]
shl rax, 1
test rax, rax
jne 0x14009e2c3
movzx eax, byte [rdi + 0x11]
test al, al
jne 0x14009e325
lea r14, [rdi + 0x11]
mov eax, dword [rbp + 0x80]
mov dword [rdi + 0x14], 1
mov dword [rdi + 0x18], eax
mov rax, qword [rbx]
shl rax, 1
test rax, rax
jne 0x14009e302
xor eax, eax
xchg byte [rsi], al
cmp al, 2
je 0x14009e318
add rsp, 0x1d0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.14017f2b0
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xb0], edx
test edx, edx
je 0x14009d775
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0xd0], edx
mov rax, qword [r12]
test rax, rax
je 0x14009e00d
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14017f3b0]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_set_session_ID_on_the_token._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x1401d60d0]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.1401289b0
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14009e045
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009e045
test rax, rax
je 0x14009e045
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14009e07d
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009e07d
test rax, rax
je 0x14009e07d
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov r15, qword [rbp + 0xc8]
mov r14d, dword [rbp + 0xd0]
jmp 0x14009dd00
mov byte [rbp + 0x147], 1
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009d873
test rax, rax
je 0x14009e0c9
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov rax, qword [r12]
test rax, rax
je 0x14009e1a9
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14017ef10]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_create_terminal_process._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
mov byte [rbp + 0x147], 1
lea rcx, [0x1401d61d0]
call fcn.140128aa0
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.1401289b0
mov rcx, qword [rbp + 0xc0]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14009e1f6
mov byte [rbp + 0x147], 1
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009e1f6
test rax, rax
je 0x14009e1f6
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov rcx, qword [rbp + 0xb8]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x14009e243
mov byte [rbp + 0x147], 1
call fcn.14017f2b0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x14009e243
test rax, rax
je 0x14009e243
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14017f2a0
mov byte [rbp + 0x147], 1
call fcn.14017f2b0
mov r15, rax
mov r14d, edx
cmp dword [rbp + 0xb0], 0
je 0x14009dd00
cmp qword [rbp + 0xa8], 0
je 0x14009dd00
lea rcx, [rbp + 0xa8]
call fcn.14017f2a0
jmp 0x14009dd00
lea rcx, [0x140260020]
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x10], rsi
lea rax, str._rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_std_src_synclazy_lock.rs
mov qword [rsp + 0x20], rax
lea r9, [0x1401d29e0]
lea r8, [rbp + 0x10]
xor edx, edx
call fcn.1401bf1c0
jmp 0x14009deaa
mov rcx, rsi
call fcn.1401bf0f0
jmp 0x14009dec4
call fcn.1401bf020
movzx ecx, byte [rdi + 0x11]
test cl, cl
jne 0x14009e358
mov ecx, dword [rbp + 0x80]
mov dword [rdi + 0x14], 1
mov dword [rdi + 0x18], ecx
test al, al
je 0x14009df09
add rdi, 0x11
mov r14, rdi
mov rax, qword [rbx]
shl rax, 1
test rax, rax
je 0x14009df09
call fcn.1401bf020
test al, al
jne 0x14009df09
mov byte [r14], 1
jmp 0x14009df09
mov rcx, rsi
call fcn.1401bf1b0
jmp 0x14009df15
xor eax, eax
mov qword [rbp + 0x10], rsi
mov byte [rbp + 0x18], al
lea rax, [0x1401d55b8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401d2b90]
lea r9, fcn.14000cc80
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.1401c0470
ud2
xor al, 1
jmp 0x14009e327