Function at 0x180087100
Capabilities:
Create process on windows
Get user security identifier

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd0
lea r8, [rbp - 0x49]
xor edi, edi
mov rsi, r9
mov r15, rcx
mov qword [rbp - 0x49], 0xffffffffffffffff
mov ebx, edi
call fcn.180086df0
mov r13d, eax
test eax, eax
js 0x180087473
mov r12d, dword [rbp + 0x87]
xor r14b, r14b
mov qword [rbp - 0x51], 0xffffffffffffffff
test r12b, 4
je 0x1800872b8
lea rax, [rbp - 0x61]
lea r9, [rbp - 0x69]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x59]
mov rdx, r15
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rbp - 0x69], edi
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x59], edi
mov dword [rbp - 0x61], 1
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1800872b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x7a
jne 0x1800872b0
mov ecx, dword [rbp - 0x69]
test ecx, ecx
je 0x1800873f7
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winprocess_win.cpp
add rcx, rcx
mov ebx, edi
call sym.VBoxRT.dll_RTMemAllocTag
mov rdi, rax
lea rcx, [rax + 0x1000]
cmp rcx, 0x2000
jb 0x180087491
movabs rax, 0xffff800000000000
test rax, rdi
jne 0x180087491
mov eax, dword [rbp - 0x59]
xor esi, esi
test eax, eax
je 0x180087241
mov ecx, eax
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3winprocess_win.cpp
add rcx, rcx
call sym.VBoxRT.dll_RTMemAllocTag
mov rsi, rax
lea rcx, [rax + 0x1000]
cmp rcx, 0x2000
jb 0x180087491
movabs rax, 0xffff800000000000
test rax, rsi
jne 0x180087491
lea rax, [rbp - 0x61]
lea r9, [rbp - 0x69]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x59]
mov rdx, r15
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x180087294
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x180087294
lea r8, [rbp - 0x51]
lea rcx, str.VBoxTray.exe
mov rdx, rdi
call fcn.180086c90
movzx r14d, al
jmp 0x18008729c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call sym.VBoxRT.dll_RTMemFree
mov rcx, rsi
call sym.VBoxRT.dll_RTMemFree
mov rsi, qword [rbp + 0x5f]
test ebx, ebx
jne 0x1800873f7
lea rax, [rbp - 0x49]
lea rdi, [rbp - 0x51]
lea r8, [rbp - 0x61]
lea rcx, str.Userenv.dll
test r14b, r14b
mov dl, 1
cmove rdi, rax
call sym.VBoxRT.dll_RTLdrLoadSystem
test eax, eax
js 0x1800873f7
mov rcx, qword [rbp - 0x61]
lea r8, [rbp - 0x59]
lea rdx, str.LoadUserProfileW
call sym.VBoxRT.dll_RTLdrGetSymbol
test eax, eax
js 0x1800873ee
mov rcx, qword [rbp - 0x61]
lea r8, [rbp - 0x41]
lea rdx, str.UnloadUserProfile
call sym.VBoxRT.dll_RTLdrGetSymbol
test eax, eax
js 0x1800873ee
and r12d, 0x10
jne 0x18008736d
mov rcx, qword [rdi]
xor eax, eax
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov dword [rbp - 0x39], 0x38
mov qword [rbp - 0x31], r15
mov dword [rbp - 0x35], 1
call qword [rbp - 0x59]
test eax, eax
jne 0x18008736d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1800873ee
mov rdx, qword [rbp + 0x67]
mov rcx, qword [rdi]
lea r8, [rbp - 0x69]
call fcn.180086fb0
test eax, eax
js 0x1800873df
mov rax, qword [rbp + 0x7f]
mov rdx, qword [rbp + 0x57]
mov rcx, qword [rdi]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x77]
xor ebx, ebx
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x69]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x6f]
xor r9d, r9d
mov dword [rsp + 0x30], eax
mov r8, rsi
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1800873d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp - 0x69]
call sym.VBoxRT.dll_RTEnvFreeUtf16Block
test r12d, r12d
jne 0x1800873ee
mov rdx, qword [rbp - 9]
mov rcx, qword [rdi]
call qword [rbp - 0x41]
mov rcx, qword [rbp - 0x61]
call sym.VBoxRT.dll_RTLdrClose
mov rcx, qword [rbp - 0x51]
cmp rcx, 0xffffffffffffffff
je 0x180087407
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x180087473
mov ecx, ebx
call fcn.180086810
mov r13d, eax
cmp eax, 0xffffffdd
jne 0x180087473
call sym.VBoxRT.dll_RTLogRelDefaultInstance
test rax, rax
je 0x180087473
test byte [rax + 0xc008], 1
jne 0x180087473
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], ebx
lea rcx, str.dwErr_u___x___rc_Rrc_n
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rcx
lea rcx, str.int___cdecl_rtProcWinCreateAsUser2_unsigned_short__unsigned_short__unsigned_short__unsigned_short__struct_RTENVINTERNAL__unsigned_long_struct__STARTUPINFOW__struct__PROCESS_INFORMATION__unsigned_int_
mov qword [rsp + 0x20], rcx
lea r9, str._Rfn:__M
lea edx, [r13 + 0x25]
lea r8d, [r13 + 0x2b]
mov rcx, rax
call sym.VBoxRT.dll_RTLogLoggerEx
mov eax, r13d
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xfffffff8
jmp 0x180087476