Function at 0x140097b50
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4040]
mov eax, 0x4140
call fcn.1401c1440
sub rsp, rax
mov rax, qword [0x1402bff08]
xor rax, rsp
mov qword [rbp + 0x4030], rax
mov rax, qword [rbp + 0x40a0]
mov r13, rcx
mov r14, qword [rbp + 0x40a8]
mov esi, r9d
mov r12d, dword [rbp + 0x40b0]
mov rbx, r8
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
mov qword [rbp - 0x48], rcx
mov eax, r9d
mov ecx, 0x8000
mov qword [rbp - 0x70], rdx
and eax, ecx
mov dword [rsp + 0x7c], r9d
xor esi, ecx
mov qword [rbp - 0x50], r14
xor ecx, ecx
mov dword [rsp + 0x78], r12d
test eax, eax
mov qword [rsp + 0x68], rcx
mov r15d, ecx
mov qword [rsp + 0x70], rcx
cmove esi, r9d
mov dword [rsp + 0x64], ecx
xor eax, eax
lea r8d, [rcx + 0x64]
xor edx, edx
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x3c]
movups xmmword [rbp - 0x68], xmm0
call fcn.1401c31c0
mov edi, 0xffffffff
cmp esi, 5
je 0x140097c2c
test esi, esi
je 0x140097d1c
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [rsp + 0x60], eax
cmp eax, edi
je 0x1400982f0
cmp esi, 4
je 0x140097d1c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, 2
lea r8, [rsp + 0x68]
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140097c71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x213
mov r9d, edi
mov dword [rsp + 0x20], eax
lea rdx, str.X:XYO_SecurityDevelopmentMeshAgent.CustommicrostackILibProcessPipe.c
xor ecx, ecx
call fcn.14009718c
jmp 0x1400982f0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140097cb6
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x214
jmp 0x140097c57
mov eax, dword [rsp + 0x60]
lea r8, [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov r9d, 4
cmp esi, 5
cmove eax, dword [rbp - 0x78]
lea edx, [r9 + 8]
mov dword [rsp + 0x60], eax
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x140097d0a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x216
jmp 0x140097c57
cmp esi, edi
lea rax, str.Winsta0Winlogon
cmovne rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rax
test rbx, rbx
je 0x140097ded
mov rax, qword [rbx]
test rax, rax
je 0x140097ded
cmp qword [rbx + 8], r15
jne 0x140097d3f
mov r15, rax
jmp 0x140097ded
xor r12d, r12d
xor edi, edi
mov edx, 0x10000
mov rcx, rax
call fcn.1401ccb7c
inc eax
inc rdi
add r12d, eax
inc r15d
mov rax, qword [rbx + rdi*8]
test rax, rax
jne 0x140097d44
lea eax, [r15 - 1]
add eax, r12d
movsxd rcx, eax
mov dword [rbp - 0x78], eax
call fcn.1401cd1cc
mov r8, qword [rbx]
xor edi, edi
and dword [rbp - 0x80], 0
mov r15, rax
mov dword [rsp + 0x64], 1
test r8, r8
je 0x140097de8
mov r14d, dword [rbp - 0x80]
xor r12d, r12d
mov r13d, dword [rbp - 0x78]
lea rax, [0x1402535d8]
mov qword [rsp + 0x20], r8
test r14d, r14d
movsxd rcx, edi
lea r9, [0x14025cd54]
cmove r9, rax
lea r8, [0x140256378]
mov eax, r13d
add rcx, r15
sub eax, edi
movsxd rdx, eax
call fcn.140001148
inc r12
add edi, eax
inc r14d
mov r8, qword [rbx + r12*8]
test r8, r8
jne 0x140097d9b
mov r14, qword [rbp - 0x50]
mov r13, qword [rbp - 0x48]
mov r12d, dword [rsp + 0x78]
mov ecx, 0x80
call fcn.1401cd1cc
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
lea ebx, [r9 + 0x68]
mov edx, ebx
call fcn.14008e668
mov rdi, rax
cmp esi, 4
je 0x140097e26
mov r9d, r12d
mov rcx, r13
call fcn.1400977fc
mov qword [rdi + 0x38], rax
mov qword [rax + 0x40], rdi
mov qword [rdi + 0x10], r13
mov rcx, qword [r13 + 0x20]
mov qword [rdi + 0x60], rcx
mov dword [rbp - 0x40], ebx
cmp esi, 4
je 0x140097ec3
mov r9d, r12d
mov rcx, r13
call fcn.1400977fc
mov qword [rdi + 0x28], rax
mov r9d, r12d
mov rcx, r13
mov qword [rax + 0x40], rdi
call fcn.1400977fc
mov qword [rdi + 0x30], rax
mov qword [rax + 0x40], rdi
mov rcx, qword [rdi + 0x28]
add rcx, 0x88
call fcn.140097798
mov rcx, qword [rdi + 0x30]
mov ebx, 0x80
add rcx, rbx
call fcn.140097798
mov rcx, qword [rdi + 0x38]
add rcx, rbx
call fcn.140097798
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 0x88]
mov qword [rbp + 0x20], rcx
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax + 0x80]
mov qword [rbp + 0x10], rcx
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x88]
bts dword [rbp - 4], 8
mov qword [rbp + 0x18], rcx
xor r13d, r13d
test r14, r14
je 0x140098048
mov r12, r14
xor eax, eax
cmp qword [r12], rax
je 0x140097f4b
mov r8, qword [r12 + 8]
or r9d, 0xffffffff
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [rsp + 0x28], 0
lea r8, [0x14025547c]
and qword [rsp + 0x20], 0
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [r12]
or r9d, 0xffffffff
and dword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov ecx, 0xfde9
add ebx, eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add eax, ebx
add r13d, eax
add r12, 0x10
jne 0x140097ed2
lea eax, [r13*2]
movsxd rbx, eax
mov eax, 0xffffffff
cmp rbx, rax
jae 0x140097f78
mov eax, 0xffffffe7
cmp rbx, rax
jae 0x140097f78
lea rcx, [rbx + 0x18]
call fcn.1401cd1cc
xor r13d, r13d
jmp 0x140097f7e
xor r13d, r13d
mov eax, r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.14008e668
mov r12, rax
mov ebx, r13d
mov r8, qword [r14]
test r8, r8
je 0x140098045
mov eax, dword [r12 - 0x18]
or r9d, 0xffffffff
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
lea rdx, [r12 + rcx*2]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
or r9d, 0xffffffff
lea r8, [0x14025547c]
dec eax
add ebx, eax
mov eax, dword [r12 - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [r12 + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [r14 + 8]
or r9d, 0xffffffff
dec eax
add ebx, eax
mov eax, dword [r12 - 0x18]
cdq
movsxd rcx, ebx
sub eax, edx
sar eax, 1
sub eax, ebx
lea rdx, [r12 + rcx*2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add ebx, eax
add r14, 0x10
jne 0x140097f95
mov r14, r12
mov ebx, 0x1000
test esi, 0xfffffffb
jne 0x140098113
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r12, qword [rbp - 0x70]
lea rax, [rbp + 0x2030]
mov r8, r12
mov dword [rsp + 0x28], ebx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [rsp + 0x7c]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x48], rdx
mov eax, ebx
and eax, 0x8000
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x40], rdx
neg eax
mov eax, r13d
mov qword [rsp + 0x38], r13
sbb ecx, ecx
mov qword [rsp + 0x30], r14
and ecx, 0x208
lea rdx, [rbp + 0x30]
or ecx, 0x8000400
mov dword [rsp + 0x28], ecx
cmp esi, 4
lea rcx, [rbp + 0x2030]
setne al
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140098286
test esi, esi
je 0x1400981ca
jmp 0x14009811b
mov ebx, dword [rsp + 0x7c]
mov r12, qword [rbp - 0x70]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x2030]
mov dword [rsp + 0x28], 0x1000
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp - 0x68]
and ebx, 0x8000
mov qword [rsp + 0x50], rcx
lea r8, [rbp + 0x30]
lea rcx, [rbp - 0x40]
neg ebx
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x2030]
mov rcx, qword [rsp + 0x70]
sbb eax, eax
mov qword [rsp + 0x40], r13
and eax, 0x208
mov qword [rsp + 0x38], r14
or eax, 0x8000400
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140098286
test r14, r14
je 0x1400981d7
mov rcx, r14
call fcn.14008e748
cmp dword [rsp + 0x64], r13d
je 0x1400981e6
mov rcx, r15
call fcn.1401ccb68
cmp esi, 4
je 0x14009823f
mov rcx, qword [rdi + 0x30]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x30]
mov qword [rax + 0x88], r13
mov rcx, qword [rdi + 0x38]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x38]
mov qword [rax + 0x88], r13
mov rcx, qword [rdi + 0x28]
mov rcx, qword [rcx + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x28]
mov qword [rax + 0x80], r13
mov rax, qword [rbp - 0x68]
mov qword [rdi + 0x50], rax
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140098256
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x58]
mov dword [rdi + 0x18], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140098271
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140098281
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x1400982f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 4
je 0x1400982ac
mov rcx, qword [rdi + 0x38]
call fcn.140097624
mov rcx, qword [rdi + 0x30]
call fcn.140097624
mov rcx, qword [rdi + 0x28]
call fcn.140097624
cmp dword [rsp + 0x64], r13d
je 0x1400982bb
mov rcx, r15
call fcn.1401ccb68
mov rcx, rdi
call fcn.14008e748
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400982d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400982e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1400982f0
mov rcx, r14
call fcn.14008e748
xor eax, eax
mov rcx, qword [rbp + 0x4030]
xor rcx, rsp
call fcn.1401c0ed0
mov rbx, qword [rsp + 0x4180]
add rsp, 0x4140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret