Function at 0x140029cd0
Capabilities:
Check if file exists
Create process on windows
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x30], r9
mov r15, qword [rbp + 0x300]
mov qword [rbp - 0x28], r15
mov r12, qword [rbp + 0x308]
mov qword [rbp - 0x20], r12
cmp qword [rdx + 0x10], 0
je 0x14002a22b
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140029d43
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14002a22b
xor ebx, ebx
mov r13d, ebx
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 8], rbx
mov qword [rbp], 7
mov word [rbp - 0x18], bx
mov qword [rsp + 0x60], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov dword [rbp + 0x74], eax
mov dword [rbp + 0x10], 0x68
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x18]
cmp rax, rdi
je 0x140029dc7
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140029dba
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x18]
call fcn.140011160
cmp qword [r14 + 0x10], 0
je 0x140029dfe
mov r8d, 1
lea rdx, [0x1401001bc]
lea rcx, [rbp - 0x18]
call fcn.140012440
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140029df1
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rbp - 0x18]
call fcn.140012440
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x140029e72
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
mov qword [rbp - 0x48], rbx
mov dword [rbp - 0x78], 0x38
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x80]
call fcn.1400a83f0
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x140029e43
mov r8, qword [rsi]
lea rdx, [0x140103020]
lea rcx, [rbp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x80]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x74], 1
mov rax, qword [rsi + 0x10]
test rax, rax
jne 0x140029ed8
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r13d, eax
test eax, eax
jne 0x14002a017
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Execute::CreateProcess_Error_d
jmp 0x14002a010
cmp qword [r15 + 0x10], 0
jne 0x140029ee8
lea rdx, [0x140103070]
jmp 0x140029ef5
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x140029ef5
mov rdx, qword [r15]
mov r8, r12
cmp qword [r12 + 0x18], 8
jb 0x140029f04
mov r8, qword [r12]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140029f11
mov rcx, qword [rsi]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x14002a003
lea rdx, [rbp - 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x140029ff4
mov r8d, 1
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x140029fcf
lea r8, [rbp - 0x18]
cmp qword [rbp], 8
cmovae r8, qword [rbp - 0x18]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov r13d, eax
test eax, eax
jne 0x140029fe3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Execute::CreateProcessAsUserW_Error_d
jmp 0x140029fdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Execute::CreateEnvironmentBlock_Error_d
mov edx, eax
call fcn.140017600
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
jmp 0x14002a017
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Execute::LoadUserProfileW_Error_d
jmp 0x14002a010
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Execute::LogonUser_Error_d
mov edx, eax
call fcn.140017600
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002a027
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002a037
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002a047
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14002a058
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14002a098
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a093
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a3ef
call fcn.1400a59a4
mov qword [rbp - 8], rbx
mov qword [rbp], 7
mov word [rbp - 0x18], bx
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14002a0e7
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a0e2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3f5
mov rcx, r8
call fcn.1400a59a4
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14002a135
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a130
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3fb
mov rcx, r8
call fcn.1400a59a4
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14002a184
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a17f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a401
mov rcx, r8
call fcn.1400a59a4
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14002a1d2
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a1cd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3e3
mov rcx, r8
call fcn.1400a59a4
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov word [r15], bx
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x14002a223
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14002a21e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3e9
mov rcx, r8
call fcn.1400a59a4
mov eax, r13d
jmp 0x14002a3a6
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14002a26a
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a265
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3f5
mov rcx, r8
call fcn.1400a59a4
xor ebx, ebx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14002a2ba
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a2b5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3fb
mov rcx, r8
call fcn.1400a59a4
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14002a309
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a304
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a401
mov rcx, r8
call fcn.1400a59a4
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 8
jb 0x14002a357
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002a352
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3e3
mov rcx, r8
call fcn.1400a59a4
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov word [r15], bx
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x14002a3a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14002a39f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a3e9
mov rcx, r8
call fcn.1400a59a4
xor eax, eax
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], 7
mov word [r12], bx
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1400a5460
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
int3