Function at 0x14004a640
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x870]
sub rsp, 0x970
mov rax, qword [0x1400cfdf0]
xor rax, rsp
mov qword [rbp + 0x860], rax
cmp qword [rcx + 0x78], 0
mov rdi, rcx
mov r14d, 0x80004005
je 0x14004a94c
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor r15d, r15d
mov ebx, eax
mov dword [rsp + 0x68], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp ebx, dword [rsp + 0x68]
jne 0x14004a94c
mov rsi, qword [rdi + 0x78]
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x70], r15d
test rsi, rsi
je 0x14004a97b
mov rax, qword [rsi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rax, [rsp + 0x68]
mov edx, 0x90
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r8d, [r15 + 4]
mov rcx, rsi
call rbx
mov r14d, eax
test eax, eax
jns 0x14004a711
lea r8, [0x140098708]
mov rdx, rsi
mov ecx, eax
call fcn.14004ebf0
test r14d, r14d
js 0x14004a94c
test dword [rsp + 0x68], 0x800
je 0x14004a74b
mov rsi, qword [rdi + 0x78]
test rsi, rsi
je 0x14004a986
mov rax, qword [rsi]
mov rbx, qword [rax + 0x358]
mov rcx, rbx
call qword [fcn.14000dba0]
xor edx, edx
mov rcx, rsi
call rbx
test byte [rsp + 0x68], 4
je 0x14004a779
mov rsi, qword [rdi + 0x78]
test rsi, rsi
je 0x14004a991
mov rax, qword [rsi]
mov rbx, qword [rax + 0x4a8]
mov rcx, rbx
call qword [fcn.14000dba0]
xor edx, edx
mov rcx, rsi
call rbx
test dword [rsp + 0x68], 0x80000
je 0x14004a82c
mov rsi, qword [rdi + 0x78]
test rsi, rsi
je 0x14004a99c
mov rax, qword [rsi]
mov dword [rsp + 0x6c], r15d
mov rbx, qword [rax + 0x2a8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsp + 0x6c]
mov rcx, rsi
call rbx
test eax, eax
jns 0x14004a7cb
lea r8, [0x140098708]
mov rdx, rsi
mov ecx, eax
call fcn.14004ebf0
cmp dword [rsp + 0x6c], 1
mov eax, 0x8004
mov ecx, 0x8000
cmove eax, ecx
mov rcx, rdi
mov dword [rdi + 0x74], eax
call fcn.140044e30
lea rdx, str.Intel_R__Graphics_Control_Panel
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14004a811
movsxd r8, dword [rdi + 0x74]
xor r9d, r9d
mov edx, 0x807d
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x14004a82c
mov r8d, dword [rdi + 0x74]
add rcx, 0x10
mov edx, 0x80000
call fcn.140045920
test dword [rsp + 0x68], 0x20000
je 0x14004a86c
mov rsi, qword [rdi + 0x78]
test rsi, rsi
je 0x14004a86c
mov rax, qword [rsi]
mov rbx, qword [rax + 0x428]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rsi
call rbx
test eax, eax
jns 0x14004a86c
lea r8, [0x140098708]
mov rdx, rsi
mov ecx, eax
call fcn.14004ebf0
test dword [rsp + 0x68], 0x400000
je 0x14004a934
xor eax, eax
lea rcx, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x68]
call fcn.140054000
xor edx, edx
mov dword [rbp - 0x80], 0x68
mov r8d, 0x864
lea rcx, [rbp - 0x10]
call fcn.140054000
lea r8, [0x1400d7b40]
mov edx, 0x432
lea rcx, [rbp - 0x10]
call fcn.14005d138
lea r8, str.IntelWiDiUMS64.exe_38CD7AA6_0119_4D26_9717_B80FFFDB147E
mov edx, 0x432
lea rcx, [rbp - 0x10]
call fcn.14005d0b8
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x4000020
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14004a94c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004a94c
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x14004a94c
mov r8d, dword [rdi + 0x74]
add rcx, 0x10
xor edx, edx
call fcn.140045920
mov eax, r14d
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.14004e4a0
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004003
call fcn.14004ebc0
int3
mov ecx, 0x80004003
call fcn.14004ebc0
int3
mov ecx, 0x80004003
call fcn.14004ebc0
int3
mov ecx, 0x80004003
call fcn.14004ebc0
int3