Function at 0x14011f990
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x28], r8
mov rdi, rdx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp + 0xd0]
mov qword [rbp - 0x20], rax
xor ebx, ebx
mov qword [rbp - 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x70]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14011fd50
mov qword [rbp - 0x50], rbx
mov r15, rbx
cmp qword [rbp - 0x70], 0xffffffffffffffff
cmovne r15, qword [rbp - 0x70]
mov qword [rbp - 0x50], r15
mov qword [rsp + 0x68], rbx
lea r9, [rsp + 0x68]
mov r8d, dword [rdi + 8]
mov edx, dword [rdi]
mov rcx, r15
call fcn.140122070
test al, al
jne 0x14011fa24
xor dil, dil
jmp 0x14011fd22
mov rsi, rbx
mov qword [rbp - 0x58], rbx
mov r8d, dword [rdi + 8]
mov edx, dword [rdi + 4]
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x60]
mov rcx, r15
call fcn.140122070
test al, al
jne 0x14011fa69
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14011fc92
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], rbx
xor dil, dil
jmp 0x14011fd10
mov qword [rbp - 0x68], rbx
lea r8, [rbp - 0x68]
mov edx, 2
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
jne 0x14011faa7
test rdi, rdi
je 0x14011fc92
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], rbx
xor dil, dil
jmp 0x14011fd10
mov qword [rsp + 0x70], rbx
mov r14, rbx
cmp qword [rbp - 0x68], 0xffffffffffffffff
cmovne r14, qword [rbp - 0x68]
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x60], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0xf01ff
lea r9, [rbp - 0x60]
mov r8, r13
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14011fb10
test r14, r14
je 0x14011fa88
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rbx
jmp 0x14011fa88
cmp qword [rbp - 0x60], 0xffffffffffffffff
cmovne rsi, qword [rbp - 0x60]
mov qword [rbp - 0x58], rsi
test r14, r14
je 0x14011fb31
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rbx
test rdi, rdi
je 0x14011fb44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], rbx
mov r14, rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x18]
lea ecx, [rax + 6]
call fcn.14011f6b0
mov r13d, 4
test al, al
je 0x14011fb95
lea r14, [rbp - 0x18]
mov r8, qword [rbp - 0x10]
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
jne 0x14011fb95
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140126880
xor dil, dil
jmp 0x14011fd10
mov edi, 0x1000004
mov rax, qword [rbp - 0x40]
cmp byte [rax + 0x10], 0
cmove edi, r13d
or edi, dword [rax + 0xc]
cmp byte [rax + 0x12], 0
je 0x14011fbbd
call fcn.14012f3d0
mov rcx, qword [rax + 0x208]
jmp 0x14011fbc0
mov rcx, rbx
mov dword [rbp], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9, r14
mov r8, qword [rbp - 0x38]
mov r8, qword [r8]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x14011fc45
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140126880
xor dil, dil
jmp 0x14011fd10
test r14, r14
je 0x14011fc54
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, rsi
lea rcx, [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x14011fc97
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140126880
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
jmp 0x14011fd10
mov r14, qword [rbp - 0x30]
test r14, r14
je 0x14011fcc0
mov rdi, qword [rbp - 0x80]
mov rcx, qword [r14]
test rcx, rcx
je 0x14011fcb5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], rbx
cmp rdi, 0xffffffffffffffff
je 0x14011fcca
mov qword [r14], rdi
jmp 0x14011fcca
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rbp - 0x28]
test r14, r14
je 0x14011fcf4
mov rdi, qword [rsp + 0x78]
mov rcx, qword [r14]
test rcx, rcx
je 0x14011fce9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14], rbx
cmp rdi, 0xffffffffffffffff
je 0x14011fcff
mov qword [r14], rdi
jmp 0x14011fcff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14011fd0d
mov eax, dword [rbp - 0x78]
mov dword [rcx], eax
mov dil, 1
test rsi, rsi
je 0x14011fd22
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x58], rbx
cmp qword [rsp + 0x68], 0
je 0x14011fd3a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rbx
test r15, r15
je 0x14011fd4c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x50], rbx
movzx eax, dil
add rsp, 0x170
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret