Function at 0x140013e60
Capabilities:
Create process on windows
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x910]
sub rsp, 0xa10
xor edi, edi
mov r14, rcx
lea rcx, [rbp - 0x30]
mov r12, r8
mov r13, rdx
mov dword [rbp - 0x30], 0x68
mov esi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rcx, qword [str.NY_B5TjM9lFpsTx]
xor r11d, r11d
lea rdx, [rbp + 0x110]
mov qword [rbp - 0x80], r11
mov qword [rbp - 0x78], r11
mov qword [rbp - 0x70], r11
call fcn.14000deb0
movzx eax, byte [rbp + 0x110]
lea r11, [rbp + 0x110]
lea rcx, [rbp + 0x40]
test al, al
je 0x140013ef7
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140013ee1
mov word [rcx], di
lea rax, [rbp + 0x40]
mov ecx, 0x7fffffff
cmp word [rax], si
je 0x140013fa2
add rax, 2
dec rcx
jne 0x140013f03
mov rbx, qword [rbp + 0x958]
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x140013f30
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140013f40
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140013f50
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test rsi, rsi
je 0x140013f6a
mov rcx, qword [0x14001e780]
mov r8, rsi
mov edx, 8
call qword [0x14001e798]
test rbx, rbx
je 0x140013f84
mov rcx, qword [0x14001e780]
mov r8, rbx
mov edx, 8
call qword [0x14001e798]
lea r11, [rsp + 0xa10]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
test rcx, rcx
je 0x140013f15
mov ebx, 0x7fffffff
xor edx, edx
sub rbx, rcx
lea ecx, [rbx + 1]
add rcx, rcx
call fcn.14000e210
mov rsi, rax
test rax, rax
je 0x140013f15
lea rdx, [rbx + 1]
test rdx, rdx
je 0x140013f15
cmp rdx, 0x7fffffff
ja 0x140013f15
lea r9, [rbp + 0x40]
mov r8d, 0x7ffffffe
mov rcx, rax
sub r8, rdx
sub r9, rax
mov r10d, edi
nop dword [rax]
lea rax, [r8 + rdx]
test rax, rax
je 0x140014021
movzx eax, word [r9 + rcx]
test ax, ax
je 0x140014021
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140014000
jmp 0x140014026
test rdx, rdx
jne 0x140014030
sub rcx, 2
mov r10d, 0x8007007a
mov word [rcx], di
test r10d, r10d
js 0x140013f15
lea rcx, [rsp + 0x60]
call fcn.140013c70
test eax, eax
je 0x140013f15
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
lea rax, [rbp + 0x958]
lea edx, [r9 + 1]
xor r8d, r8d
mov dword [rbp + 0x958], edi
mov rbx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400140a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140013f1c
mov ecx, dword [rbp + 0x958]
xor edx, edx
call fcn.14000e210
mov rbx, rax
test rax, rax
je 0x140013f1c
mov r9d, dword [rbp + 0x958]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x958]
mov r8, rbx
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140013f1c
lea rax, [rsp + 0x78]
mov dword [rsp + 0x68], pe_nt_image_headers64
mov rdx, qword [rbx]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
lea r8, [rbp + 0x510]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x140013f1c
mov rcx, qword [rsp + 0x60]
xor eax, eax
lea rdx, [rbp - 0x68]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x510]
mov dword [rbp - 0x68], 0x38
mov qword [rbp - 0x60], rax
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x140013f1c
mov rcx, qword [str.9hpHNYSyrctO_E_y9Etn]
lea rdx, [rbp + 0x110]
mov word [rbp + 0x10], di
call fcn.14000deb0
movzx eax, byte [rbp + 0x110]
lea r11, [rbp + 0x110]
lea rcx, [rbp + 0x40]
test al, al
je 0x1400141a6
nop dword [rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140014190
mov rdx, qword [rsp + 0x60]
mov word [rcx], di
lea rax, [rbp + 0x40]
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rbp - 0x20], rax
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x140013f1c
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov r8, rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8000404
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140013f1c
mov rax, qword [rbp - 0x80]
mov edi, 1
mov qword [r13], rax
mov rax, qword [rbp - 0x78]
mov dword [r14 + 0xa4], edi
mov qword [r12], rax
jmp 0x140013f1c