Function at 0x14000dc90
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x170
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x14002e0b0]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x98], rdx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
mov qword [r11 - 0x28], 7
mov qword [r11 - 0x30], 0
mov word [r11 - 0x40], 0
xor r8d, r8d
lea edx, [r8 + 0x26]
lea rcx, [r11 - 0x48]
call fcn.1400053f0
lea rcx, [rsp + 0x148]
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x148]
add rdx, rdx
mov r9d, 0x4c
lea r8, str.ProcUtil::ExecuteProcessAsProcessToken
call fcn.1400100b0
mov qword [rsp + 0x158], 0x26
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae rax, qword [rsp + 0x148]
mov word [rax + 0x4c], 0
lea r9, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae r9, qword [rsp + 0x148]
lea r8, str._s__entering
mov edx, 0x65
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
xor ebp, ebp
mov dword [rsp + 0x68], ebp
test rbx, rbx
je 0x14000e1ba
xor esi, esi
mov qword [rsp + 0x90], rsi
lea r8, [rsp + 0x90]
lea edx, [rbp + 0xb]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e196
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov ebp, 1
mov dword [rsp + 0x20], ebp
mov r9d, ebp
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x14000e179
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rsi
lea r9d, [rsi + 4]
lea r8, [rsp + 0x68]
lea edx, [rsi + 0xc]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov r8d, ebp
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x88]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14000de56
mov dword [rsp + 0x80], 0x430
jmp 0x14000de5e
mov qword [rsp + 0x88], rsi
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14000dec8
test rdi, 0xffffffffffff0000
jne 0x14000deb2
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.140004bf0
test rax, rax
je 0x14000dedf
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140004840
mov rbx, qword [rsp + 0x60]
jmp 0x14000dedf
xor eax, eax
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, qword [rsp + 0x70]
jmp 0x14000deca
xor ecx, ecx
mov r8d, ecx
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1400046e0
mov rbx, qword [rsp + 0x60]
mov edx, dword [rbx - 0x10]
mov ecx, ebp
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or ecx, eax
jge 0x14000deff
lea rcx, [rsp + 0x60]
call fcn.1400049e0
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
test rbx, rbx
jne 0x14000df11
xor ecx, ecx
jmp 0x14000df2b
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14000e16e
cmp ecx, dword [rbx - 0xc]
jg 0x14000e16e
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
mov edx, dword [rbx - 0x10]
add edx, 2
sub ebp, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ebp
jge 0x14000df61
lea rcx, [rsp + 0x60]
call fcn.1400049e0
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
test rbx, rbx
jne 0x14000df73
xor ecx, ecx
jmp 0x14000df8d
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14000e163
cmp ecx, dword [rbx - 0xc]
jg 0x14000e163
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14000dfc6
cmp rax, qword [rbx - 0x18]
jne 0x14000dfc6
lea rdi, [rbx - 0x18]
lock add dword [rbx - 8], 1
jmp 0x14000e004
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x14000dfe2
call fcn.1400049d0
int3
mov eax, dword [rbx - 0x10]
mov dword [rdi + 8], eax
mov eax, dword [rbx - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.1400100b0
add rdi, 0x18
mov qword [rsp + 0x70], rdi
mov rbp, qword [rsp + 0x98]
test rbp, rbp
je 0x14000e03d
lea rdx, [0x140028484]
lea rcx, [rsp + 0x70]
call fcn.14000e550
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.14000e550
mov rdi, qword [rsp + 0x70]
mov r9, rdi
lea r8, [0x140028488]
mov edx, 2
lea rcx, [0x14002f750]
call fcn.14000bba0
mov dword [rsp + 0xd0], 0x68
xor ebp, ebp
mov qword [rsp + 0xd8], rbp
lea rax, str.winsta0default
mov qword [rsp + 0xe0], rax
xor edx, edx
lea r8d, [rbp + 0x50]
lea rcx, [rsp + 0xe8]
call fcn.140011570
mov qword [rsp + 0xa0], rbp
xor eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebp, eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
nop
lea rdx, [rdi - 0x18]
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14000e145
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lock xadd dword [rbx - 8], esi
add esi, 0xffffffff
test esi, esi
jg 0x14000e17f
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + 8]
xor esi, esi
jmp 0x14000e181
mov ecx, 0x80070057
call fcn.140004d20
int3
mov ecx, 0x80070057
call fcn.140004d20
nop
mov ebp, dword [rsp + 0x68]
jmp 0x14000e181
xor esi, esi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000e196
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], rsi
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14000e251
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x90], rsi
jmp 0x14000e251
lea rcx, str.winlogon.exe
call fcn.14000e420
mov r8d, eax
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x14000e251
mov r8, rax
mov rdx, rsi
mov rcx, qword [rsp + 0x70]
call fcn.14000dc90
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea r9, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae r9, qword [rsp + 0x148]
lea r8, str._s__leaving
mov edx, 0x65
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
cmp qword [rsp + 0x160], 8
jb 0x14000e24d
mov rcx, qword [rsp + 0x148]
call fcn.14000eef0
mov eax, ebx
jmp 0x14000e2ba
mov r9d, ebp
lea r8, str.CreateProcessAsUser_returns:_x_n
mov edx, 2
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
lea r9, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae r9, qword [rsp + 0x148]
lea r8, str._s__leaving
mov edx, 0x65
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
cmp qword [rsp + 0x160], 8
jb 0x14000e2b8
mov rcx, qword [rsp + 0x148]
call fcn.14000eef0
mov eax, ebp
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14000f470
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret