Function at 0x14013d420
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0xc0]
xorps xmm0, xmm0
mov rbx, rcx
mov qword [rbp - 0x80], r9
xor esi, esi
mov qword [rsp + 0x78], rax
mov ecx, edx
mov qword [rsp + 0x68], rsi
and ecx, 0x3000
mov dword [rbp - 0x40], 0x68
xor r14b, r14b
mov r13, r8
mov edi, edx
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
cmp ecx, 0x3000
jne 0x14013d4a5
mov eax, 0xc00000f0
jmp 0x14013db6d
cmp qword [rbx], rsi
jne 0x14013d4ba
cmp qword [rbx + 8], rsi
jne 0x14013d4ba
mov eax, 0xc0000030
jmp 0x14013db6d
mov rax, qword [rbx + 0x20]
mov r8d, 1
mov qword [rsp + 0x1a8], r12
mov dword [rbp - 4], r8d
mov word [rbp], r8w
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x160], r15
bt edi, 0x12
jae 0x14013d712
test ecx, ecx
mov r12d, esi
mov r15, 0xffffffffffffffff
sete al
bt edi, 0x10
movzx ecx, al
cmovae r12d, ecx
bt edi, 0x11
jae 0x14013d544
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x48]
mov edx, 0x18
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, 0xffffffff
movzx r12d, r12b
test eax, eax
mov r8d, 1
cmovns ecx, dword [rbp + 0x48]
cmp dword [rbx + 0x28], ecx
cmovne r12d, esi
mov eax, dword [rbx + 0x48]
test eax, eax
je 0x14013d554
cmp eax, 2
jne 0x14013d712
test r12b, r12b
je 0x14013d712
xor eax, eax
xorps xmm0, xmm0
mov r14, rsi
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x30], xmm0
cmp dword [rbx + 0x4c], eax
jne 0x14013d576
mov dword [rbx + 0x4c], r8d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14013d588
nop
call sym.SystemInformer.exe_Ordinal_1329
mov r14, rax
mov edx, edi
mov ecx, esi
or edx, 2
cmp qword [rbx + 0x18], rsi
cmovne edx, edi
test dl, 0x20
je 0x14013d5a3
lfence
mov ecx, 1
test dl, 0x40
je 0x14013d5ae
lfence
or ecx, 2
test dl, 4
je 0x14013d5b9
lfence
or ecx, 4
test dl, 0x10
je 0x14013d5c4
lfence
or ecx, 0x10
test dl, 2
je 0x14013d5d0
lfence
bts ecx, 0xa
test dl, dl
jns 0x14013d5db
lfence
bts ecx, 0x13
nop dword [rax + rax]
test dl, 8
je 0x14013d5ec
lfence
bts ecx, 0x18
bt edx, 8
jae 0x14013d5f9
lfence
bts ecx, 0x1a
test r14, r14
je 0x14013d604
mov rdx, qword [r14 + 8]
jmp 0x14013d607
mov rdx, rsi
mov r9d, dword [rbx + 0x4c]
lea rax, [rbp + 0x30]
mov r8, qword [rbx + 0x40]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbx + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x14013d67c
cmp dword [0x1402bbf68], 0xffffffff
jae 0x14013d66d
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14013d673
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
mov esi, eax
nop dword [rax]
test r14, r14
je 0x14013d69a
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x14013d69a
call fcn.140143da0
test esi, esi
js 0x14013d6ec
nop
test r13, r13
je 0x14013d6b3
mov eax, dword [rbp + 0x40]
mov qword [r13], rax
mov eax, dword [rbp + 0x44]
mov qword [r13 + 8], rax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14013d6c5
mov rax, qword [rbp + 0x30]
mov qword [rcx], rax
jmp 0x14013d6d4
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013d6d4
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14013d6fb
mov rax, qword [rbp + 0x38]
mov qword [rcx], rax
mov eax, esi
jmp 0x14013db5d
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013d6fb
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp + 0x38]
test rcx, rcx
je 0x14013d70b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013db5d
bt edi, 0xc
jae 0x14013d7e5
cmp dword [0x1402c8fac], 3
lea rcx, [rsp + 0x70]
mov rax, qword [rbx + 0x30]
mov edx, 0x1000
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rsi
jl 0x14013d747
lea r8, ds:[rbp + 0x30]
call fcn.140178dc0
jmp 0x14013d776
xorps xmm0, xmm0
mov dword [rbp - 0x78], 0x30
lea r9, [rbp + 0x30]
mov qword [rbp - 0x70], rsi
lea r8, [rbp - 0x78]
mov dword [rbp - 0x60], esi
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
je 0x14013d7dd
test eax, eax
js 0x14013d7dd
mov r15, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
mov r12d, dword [0x1402c8fac]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov r14d, eax
cmp eax, 0xc0000022
jne 0x14013d7c2
cmp r12d, 5
jne 0x14013d7c2
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.140178f00
mov r14d, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
jns 0x14013d837
lfence
mov eax, r14d
jmp 0x14013db5d
lfence
jmp 0x14013db5d
bt edi, 0xd
jae 0x14013d8c7
mov edx, dword ds:[rbx + 0x30]
lea r9, [rbp + 0x30]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x40], rax
mov r8d, 0xe
lea rax, [rbp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
movups xmmword [rbp + 0x30], xmm0
call qword [sym.imp.WINSTA.dll_WinStationQueryInformationW]
test al, al
je 0x14013d988
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov r14d, edi
shr r14d, 0x11
and r14b, 1
bt edi, 0x10
jae 0x14013d9c6
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x50]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x30]
mov edx, 0x13
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x14013d9c6
mov r15, qword [rbp + 0x30]
lea rax, [rsp + 0x70]
mov rcx, r15
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x48]
mov edx, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax]
test eax, eax
js 0x14013d9bc
cmp dword [rbp + 0x48], 1
jne 0x14013d9bc
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], r15
jmp 0x14013da31
mov r15d, dword [rbx + 0x48]
test r15d, r15d
jne 0x14013d95a
mov rcx, qword [rbx + 0x30]
mov r15d, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013d95a
lea rdx, str.NT_AUTHORITY
call fcn.1401ec15c
test eax, eax
jne 0x14013d95a
mov rcx, qword [rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x14013d914
lea rdx, str.SYSTEM
call fcn.1401ec15c
test eax, eax
je 0x14013d954
mov rcx, qword ds:[rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x14013d938
lea rdx, str.LOCAL_SERVICE
call fcn.1401ec15c
test eax, eax
je 0x14013d954
mov rcx, qword [rbx + 0x38]
movzx eax, byte ds:[rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013d95a
lea rdx, str.NETWORK_SERVICE
call fcn.1401ec15c
test eax, eax
jne 0x14013d95a
mov r15d, 5
mov r8, qword [rbx + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rbx + 0x30]
mov r9d, r15d
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
nop dword [rax]
test eax, eax
jne 0x14013d842
cmp dword [0x1402bbf68], 0xffffffff
jae 0x14013d9aa
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
jmp 0x14013db5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_Ordinal_1343
jmp 0x14013db5d
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtClose]
test r14b, r14b
je 0x14013da31
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp - 0x78]
mov dword [rbp - 0x78], 0x30
mov edx, 0xf01ff
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x60], esi
mov qword [rbp - 0x68], rsi
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x60]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x14013da28
lfence
mov eax, esi
jmp 0x14013db5d
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x60], rax
bt edi, 0x11
jae 0x14013da5d
mov eax, dword [rbx + 0x28]
lea r8, [rbp + 0x48]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov edx, 0xc
mov dword [rbp + 0x48], eax
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
js 0x14013da8c
bt edi, 0x13
jae 0x14013daa5
mov rcx, qword ds:[rsp + 0x60]
lea r8, [rbp + 0x48]
mov r9d, 4
mov dword [rbp + 0x48], 1
mov edx, 0x1a
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
jns 0x14013daa5
lfence
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013db5d
cmp qword [rbx + 0x18], 0
jne 0x14013dad9
call fcn.1401744e0
test rax, rax
je 0x14013dad9
call fcn.1401744e0
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call qword [case.0x14013f76a.0]
cmp qword [rsp + 0x68], 0
je 0x14013dad9
or edi, 2
mov rax, qword [rbx + 0x18]
mov rcx, qword [rsp + 0x78]
test rax, rax
mov r8, qword [rsp + 0x68]
mov r9, qword [rbx + 0x10]
cmovne r8, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call sym.SystemInformer.exe_Ordinal_1606
mov ebx, eax
call fcn.140174640
test rax, rax
je 0x14013db50
cmp qword [rsp + 0x68], 0
je 0x14013db50
nop dword [rax]
call fcn.140174640
mov rcx, qword [rsp + 0x68]
call qword [case.0x14013f76a.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov r12, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x160]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x168
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret