Function at 0x140115d10
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1f0], rbx
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x48], r9
movzx edi, r8b
mov qword [rbp - 0x58], rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0
je 0x1401162d6
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rsp + 0x78], xmm1
xor r14d, r14d
mov word [rsp + 0x68], r14w
lea r8d, [r14 + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400d7f60
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400d8010
mov rbx, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140115df2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140115ded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140116308
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
test rbx, rbx
je 0x1401162d6
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rbp - 0x50], rax
lea rdx, str.RevertToSelf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.SetTokenInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x1401162d6
test r12, r12
je 0x1401162d6
test r13, r13
je 0x1401162d6
test rax, rax
je 0x1401162d6
xor r15d, r15d
mov qword [rbp + 0x68], r15
lea rcx, [rbp + 0x68]
call fcn.1400f04a0
nop
mov qword [rsp + 0x60], r15
mov dword [rbp + 0x60], 0xffffffff
lea r8, [rbp + 0x60]
lea rdx, [rsp + 0x60]
call fcn.1400f1c10
test al, al
je 0x1401162c6
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x1401162c6
cmp dword [rbp + 0x60], 0xffffffff
je 0x1401162bd
mov qword [rsp + 0x60], r15
test dil, dil
je 0x140115ee9
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1401164c0
test al, al
jne 0x140115efe
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140116370
test al, al
je 0x1401162bd
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1401162bd
mov r9d, 4
lea r8, [rbp + 0x60]
lea edx, [r9 + 8]
mov rcx, rdi
call r14
mov qword [rbp - 0x38], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rsp + 0x78], xmm1
mov word [rsp + 0x68], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rsp + 0x68]
call fcn.140006b90
nop
call fcn.1400d7f60
mov rcx, rax
lea rdx, [rsp + 0x68]
call fcn.1400d8010
mov r15, rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140115faf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140115faa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011630e
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rsp + 0x78], xmm0
xor eax, eax
mov word [rsp + 0x68], ax
test r15, r15
je 0x14011609d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], ax
lea r8d, [rax + 0xc]
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f60
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8010
mov r14, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14011604f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011604a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140116314
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm0
xor eax, eax
mov word [rbp - 0x78], ax
test r14, r14
je 0x14011609d
lea rdx, str.SetTokenInformation
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011609d
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011609d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x38]
call rax
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x10]
call fcn.140189b60
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 0x68
lea rax, str.WinSta0Default
mov qword [rbp], rax
mov eax, 1
mov word [rbp + 0x30], ax
mov dword [rbp + 0x2c], 0x81
mov r8, qword [rbp - 0x58]
mov rdx, rsi
lea rcx, [rbp + 0x70]
call fcn.140115660
nop
xor r15d, r15d
mov r14d, r15d
mov rcx, rdi
call qword [rbp - 0x50]
test eax, eax
je 0x140116193
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r8, qword [rbp + 0x70]
cmp qword [rsi + 0x18], 8
jb 0x14011611c
mov rsi, qword [rsi]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rsi
mov rcx, rdi
call r13
mov r14d, eax
test eax, eax
je 0x14011616a
mov ecx, dword [rbp - 0x20]
mov rax, qword [rbp - 0x48]
mov dword [rax], ecx
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14011617d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x28], r15
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140116190
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x30], r15
call r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbp - 0x38], r15
je 0x140116261
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
movdqa xmm1, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm1
mov word [rbp - 0x78], r15w
mov r8d, 0xb
lea rdx, str.Userenv.dll
lea rcx, [rbp - 0x78]
call fcn.140006b90
nop
call fcn.1400d7f60
mov rcx, rax
lea rdx, [rbp - 0x78]
call fcn.1400d8010
mov rbx, rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140116234
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011622f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011631a
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140116261
mov rcx, qword [rbp - 0x38]
call rax
test r14d, r14d
setne bl
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1401162a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401162a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140116302
call fcn.140183134
movdqa xmm0, xmmword [0x140249460]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], r15w
jmp 0x1401162c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea rcx, [rbp + 0x68]
call fcn.1400f0520
movzx eax, bl
jmp 0x1401162d8
xor al, al
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1401836e0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140195f1c
nop
call fcn.140195f1c
nop
call fcn.140195f1c
int3
call fcn.140195f1c
nop
call fcn.140195f1c
int3