Function at 0x140002d90
Capabilities:
Create process on windows
Get token membership
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14003f020]
xor rax, rsp
mov qword [rbp + 0xd8], rax
mov rsi, rdx
xor r12d, r12d
mov r14d, 1
mov edx, r14d
lea rcx, [0x140002d70]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rdx, [0x140002d50]
mov r15d, 2
mov ecx, r15d
call fcn.140013a38
lea rdx, [0x140002d50]
lea ecx, [r12 + 0xf]
call fcn.140013a38
lea rcx, [fcn.140002c60]
call fcn.14000aa3c
lea rcx, [fcn.140002c60]
call fcn.14000aa5c
lea rcx, [0x140039350]
call fcn.140013390
lea rcx, [0x140039360]
call fcn.140013390
lea rcx, [0x140039368]
call fcn.140013390
lea rcx, [0x140039378]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
movdqa xmm1, xmmword [0x1400394c0]
movdqu xmmword [rbp + 0xa8], xmm1
mov byte [rbp + 0x98], r12b
lea r8, [0x14003931c]
lea rdx, [rbp + 0x88]
lea rcx, [rbp - 0x38]
call fcn.140014198
mov rax, qword [rbp - 0x38]
lea rdi, [0x14003929d]
mov rdx, rdi
test rax, rax
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140002ec0
lea rcx, [rbp + 0x48]
call fcn.140006b10
nop
mov rcx, qword [rbp - 0x38]
call fcn.14001350c
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xb8]
call fcn.140001ec0
nop
lea r8, [0x140039328]
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x30]
call fcn.140014198
mov rax, qword [rbp - 0x30]
test rax, rax
cmovne rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x140002f22
mov rdx, rdi
lea rcx, [rbp - 0x18]
call fcn.140006b10
nop
mov rcx, qword [rbp - 0x30]
call fcn.14001350c
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x28]
call fcn.140001ec0
mov rdi, rax
lea rax, [rbp - 0x18]
cmp rax, rdi
je 0x140002fc5
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140002f96
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036cb
call fcn.14000a7c0
movdqa xmm0, xmmword [0x1400394c0]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140003000
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ffb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036cb
call fcn.14000a7c0
mov r8d, 0x1d
lea rdx, [0x140039330]
lea rcx, [rbp - 0x18]
call fcn.140005220
mov dword [rbp - 0x20], r12d
mov dword [rbp - 0x28], 0
mov word [rbp - 0x24], 0x500
mov qword [rbp - 0x40], r12
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000308c
lea r8, [rbp - 0x20]
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x14000308c
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x20], 0
jne 0x1400035c0
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
nop dword [rax + rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400030b0
mov r8, rbx
lea rcx, [rbp + 8]
call fcn.140006b10
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
lea rdx, [rbp - 0x1c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000315a
lea ebx, [rax + 4]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x1400393a8]
call fcn.140006660
mov rcx, rax
mov edx, ebx
call fcn.140003710
mov rcx, rax
call fcn.140006940
mov ebx, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400393e0]
call fcn.140013390
jmp 0x140003548
cmp dword [rbp - 0x1c], 0x103
jne 0x140003585
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x80]
call fcn.1400020b0
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140002520
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400031c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036d1
call fcn.14000a7c0
movdqa xmm0, xmmword [0x1400394b0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.140002250
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
lea r13, [0x1400393e8]
cmp rax, 1
jb 0x14000327d
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rdx, 8
jb 0x140003213
mov rsi, qword [rdi]
lea r8, [rcx + rcx]
lea rax, [0x1400393ea]
cmp rax, rsi
jbe 0x140003241
lea rax, [rsi + r8]
cmp r13, rax
ja 0x140003241
cmp rsi, r13
ja 0x140003236
mov rbx, r12
jmp 0x140003244
mov rbx, rsi
sub rbx, r13
sar rbx, 1
jmp 0x140003244
mov rbx, r14
lea rcx, [rsi + 2]
add r8, 2
mov rdx, rsi
call fcn.14000c650
add rbx, rbx
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.14000c650
lea rcx, [rbx + rsi]
sub r15, rbx
lea rdx, [r13 + 2]
add rdx, rbx
mov r8, r15
call fcn.14000c650
jmp 0x140003290
mov qword [rsp + 0x28], r14
mov rdx, r14
mov rcx, rdi
call fcn.140007ac0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400032fe
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 8
cmovae rax, qword [rsp + 0x60]
mov dword [rax + rcx*2], 0x22
lea rax, [rsp + 0x60]
jmp 0x140003316
mov qword [rsp + 0x20], r14
mov r9, r13
xor r8d, r8d
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140007c60
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003377
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003372
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036d7
call fcn.14000a7c0
movdqa xmm0, xmmword [0x1400394b0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400033cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036dd
call fcn.14000a7c0
movdqa xmm0, xmmword [0x1400394b0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
lea r8, [rbp + 0x68]
lea rdx, [0x1400393f0]
lea rcx, [rbp - 0x80]
call fcn.1400064e0
cmp qword [rax + 0x18], 8
jb 0x1400033fb
mov rax, qword [rax]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r12
mov r9, rax
lea r8, [0x1400393f8]
lea rdx, [0x140039408]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140003461
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000345c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036e3
call fcn.14000a7c0
cmp ebx, 0x20
jg 0x1400034c0
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140039418]
call fcn.140006660
mov rcx, rax
call fcn.140006940
mov ebx, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x1400393e0]
call fcn.140013390
jmp 0x1400034c3
mov r14d, r12d
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x140003507
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003501
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036e9
call fcn.14000a7c0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140003548
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003542
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036ef
call fcn.14000a7c0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x1400035cc
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000357e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036f5
call fcn.14000a7c0
jmp 0x1400035cc
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x1400035c0
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036f5
call fcn.14000a7c0
lea rcx, [rbp - 0x18]
call fcn.1400026d0
mov r14d, r12d
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140003607
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036fb
call fcn.14000a7c0
movdqa xmm0, xmmword [0x1400394c0]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x14000365a
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003654
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003701
call fcn.14000a7c0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140003692
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000368c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036c5
call fcn.14000a7c0
nop
mov eax, r14d
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.14000a7a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140013fa0
nop
call fcn.140013fa0
nop
call fcn.140013fa0
nop
call fcn.140013fa0
nop
call fcn.140013fa0
int3
call fcn.140013fa0
nop
call fcn.140013fa0
nop
call fcn.140013fa0
nop
call fcn.140013fa0
nop
call fcn.140013fa0
nop
call fcn.140013fa0
int3