Function at 0x140036bb0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r14
lea rbp, [rsp - 0x678]
sub rsp, 0x778
mov edi, ecx
mov rsi, r8
mov rcx, qword [rdx]
mov r14, rdx
test rcx, rcx
je 0x140036f5c
lea rax, [rbp + 0x6a8]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140036f5c
mov rcx, qword [rbp + 0x6a8]
mov qword [rsp + 0x770], r15
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rdx, qword [rbp + 0x6a8]
lea rcx, [rbp + 0x6b8]
xor r15d, r15d
xor r8d, r8d
mov qword [rbp + 0x6b8], r15
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x140036f58
xor edx, edx
mov qword [rsp + 0x7a0], rbx
mov r8d, 0x100
lea rcx, [rbp + 0x170]
call fcn.1400514f0
xor edx, edx
lea r8d, [r15 + 0x50]
lea rcx, [rbp + 0x20]
call fcn.1400514f0
lea rcx, [rbp + 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140036c80
mov eax, dword [0x1400b2ee8]
lea rdx, [rbp + 0x170]
movsd xmm0, qword [0x1400b2ee0]
mov r8d, 0x100
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
movzx eax, byte [0x1400b2eec]
mov byte [rcx + 0xc], al
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rcx, [rbp + 0x170]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140036cd0
mov eax, dword [0x1400b0ed0]
mov rbx, 0xffffffffffffffff
movups xmm0, xmmword [str.System32_atieclxx.exe]
mov r8, rbx
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [0x1400b0ed4]
mov word [rcx + 0x14], ax
movzx eax, byte [0x1400b0ed6]
mov byte [rcx + 0x16], al
lea rax, [rbp + 0x170]
inc r8
cmp byte [rax + r8], r15b
jne 0x140036d13
inc r8
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x470]
call fcn.14007749c
xor eax, eax
lea rcx, [rbp - 0x50]
xor edx, edx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea r8d, [rax + 0x68]
call fcn.1400514f0
lea rax, str.winsta0default
mov dword [rbp - 0x50], 0x68
xor edx, edx
mov qword [rbp - 0x40], rax
mov r8d, 0x100
lea rcx, [rbp + 0x70]
call fcn.1400514f0
sub edi, 1
je 0x140036dc3
sub edi, 1
je 0x140036da3
cmp edi, 1
jne 0x140036f39
lea rax, [rbp + 0x70]
dec rax
nop
cmp byte [rax + 1], r15b
lea rax, [rax + 1]
jne 0x140036d90
movups xmm0, xmmword [str.ShowACRMessage3]
jmp 0x140036de1
lea rax, [rbp + 0x70]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], r15b
lea rax, [rax + 1]
jne 0x140036db0
movups xmm0, xmmword [str.ShowACRMessage2]
jmp 0x140036de1
lea rax, [rbp + 0x70]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], r15b
lea rax, [rax + 1]
jne 0x140036dd0
movups xmm0, xmmword [str.ShowACRMessage1]
lea rcx, [rbp + 0x70]
dec rcx
movups xmmword [rax], xmm0
nop dword [rax + rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140036df0
movzx eax, word [0x1400af6dc]
lea rdx, str._d__d__d__lu__x__x__lu__lu
mov r9d, dword [rsi + 4]
mov r8d, dword [rsi]
mov word [rcx], ax
lea rcx, [rsp + 0x78]
mov eax, dword [rsi + 0x18]
mov dword [rsp + 0x48], eax
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x40], eax
mov eax, dword [rsi + 0x20]
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 0x1c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 8]
mov dword [rsp + 0x20], eax
call fcn.140036b50
lea rcx, [rbp + 0x70]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x140036e50
lea r8, [rsp + 0x78]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140036e70
lea rax, [rbp + 0x70]
cmp byte [rax + rbx + 1], r15b
lea rbx, [rbx + 1]
jne 0x140036e84
lea r8, [rbx + 1]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x270]
call fcn.14007749c
mov rcx, qword [rbp + 0x6a8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x270]
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x470]
mov rax, qword [rbp + 0x6b8]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140036f11
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x6b8]
call sub.USERENV.dll_DestroyEnvironmentBlock
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x6a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x7a0]
xor eax, eax
mov r15, qword [rsp + 0x770]
add rsp, 0x778
pop r14
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x140036f43
xor eax, eax
add rsp, 0x778
pop r14
pop rdi
pop rsi
pop rbp
ret