Function at 0x140061f50
Capabilities:
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb8
cmp qword [0x140107618], 0
mov r15, r8
mov r13, rdx
mov r12, rcx
jne 0x140061f8f
mov eax, 0xfffffd9f
add rsp, 0xb8
pop r15
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], rdi
mov edi, dword [rbp + 0x77]
mov qword [rsp + 0xb0], r14
mov r14, qword [rbp + 0x7f]
mov qword [rbp - 0x41], 0
test dil, 0x40
je 0x140061fdf
mov rcx, r14
call fcn.14007ec30
test al, al
jne 0x140061fdc
mov rcx, r14
call fcn.14003aa30
test al, al
je 0x140061fdf
and edi, 0xffffffbf
mov rsi, qword [rbp + 0x57]
test dil, 0x10
je 0x140061ffd
bt edi, 8
jb 0x1400620ab
cmp rsi, 0xffffffffffffffff
je 0x1400620b1
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], r15
mov r8, r14
mov rdx, rsi
mov ecx, edi
call fcn.140062c70
mov ebx, eax
test ebx, ebx
js 0x1400622bf
cmp dword [0x140105ae4], 0x69
mov ecx, 4
mov rax, qword [rbp + 0x4f]
mov r8, r13
mov rsi, qword [rbp + 0x6f]
setl r14b
mov rbx, qword [rbp + 0x67]
xor edx, edx
cmp dword [0x140105ae4], 0x69
mov qword [rsp + 0x50], rsi
cmovl edx, ecx
mov qword [rsp + 0x48], rbx
mov rcx, qword [rbp - 0x41]
or edx, dword [rbp + 0x5f]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rcx
mov rcx, qword [r15]
mov dword [rsp + 0x30], edx
xor edx, edx
mov qword [rsp + 0x28], rax
mov rax, qword [0x140107618]
mov qword [rsp + 0x20], rcx
mov rcx, r12
shr edi, 4
and edi, 1
mov r9d, edi
call qword [case.0x140035d81.0]
test eax, eax
je 0x140062245
test r14b, r14b
jne 0x1400621ab
xor ebx, ebx
jmp 0x1400622b1
cmp rsi, 0xffffffffffffffff
jne 0x1400620bd
test edi, 0x140
je 0x14006201d
lea r8, [rbp - 0x49]
mov qword [rbp - 0x39], 0
mov rdx, r13
mov qword [rbp - 0x49], 0xffffffffffffffff
mov rcx, r12
call fcn.140063db0
mov ebx, eax
test eax, eax
js 0x1400622bf
xor edx, edx
lea rcx, [rbp - 0x31]
lea r8d, [rdx + 0x38]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x31]
mov rax, qword [0x140107650]
mov dword [rbp - 0x31], 0x38
mov qword [rbp - 0x29], r12
mov dword [rbp - 0x2d], 1
call qword [case.0x140035d81.0]
test eax, eax
je 0x140062183
mov rcx, qword [rbp - 0x49]
lea r9, [rbp - 0x39]
mov r8d, edi
mov rdx, rsi
call fcn.140062df0
mov ebx, eax
test eax, eax
js 0x14006216c
mov r9, r15
mov r8, r14
mov rdx, rsi
mov ecx, edi
call fcn.1400631a0
mov ebx, eax
test eax, eax
js 0x14006215e
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x41]
call fcn.140044e80
mov ebx, eax
mov rcx, qword [rbp - 0x39]
cmp rcx, rsi
je 0x14006216c
call fcn.140044a50
mov rdx, qword [rbp - 1]
mov rcx, qword [rbp - 0x49]
mov rax, qword [0x140107658]
call qword [case.0x140035d81.0]
jmp 0x140062192
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
mov rcx, qword [rbp - 0x49]
cmp rcx, 0xffffffffffffffff
je 0x140062015
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140062015
mov rdx, qword [rsi]
lea r9, [rbp - 0x39]
mov rcx, qword [rbx + 0x50]
mov r8d, 0x20
mov qword [rbp - 0x39], 0
call fcn.140062f60
mov rdx, qword [rsi]
lea r9, [rbp - 0x39]
mov rcx, qword [rbx + 0x58]
mov r8d, 0x28
call fcn.140062f60
mov rdx, qword [rsi]
lea r9, [rbp - 0x39]
mov rcx, qword [rbx + 0x60]
mov r8d, 0x30
call fcn.140062f60
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14006220b
xor ebx, ebx
jmp 0x1400622b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
test eax, eax
jns 0x1400622b1
mov rcx, qword [rsi]
mov edx, 0x7f
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400622b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edi, eax
call fcn.14005db40
mov ebx, eax
cmp eax, 0xffffffdd
jne 0x1400622b1
mov rax, qword [0x140105a58]
test rax, rax
je 0x1400622b1
mov ecx, 0xd0010
call qword [case.0x140035d81.0]
test rax, rax
je 0x1400622b1
mov dword [rsp + 0x40], ebx
lea rcx, str.CreateProcessWithLogonW_failed:_dwErr_u___x___rc_Rrc_n
mov dword [rsp + 0x38], edi
lea r9, str._Rfn:__M
mov dword [rsp + 0x30], edi
lea edx, [rbx + 0x33]
mov qword [rsp + 0x28], rcx
lea r8d, [rbx + 0x30]
lea rcx, str.int___cdecl_rtProcWinCreateAsUser1_unsigned_short__unsigned_short__unsigned_short__unsigned_short__struct_RTENVINTERNAL__unsigned_long_struct__STARTUPINFOW__struct__PROCESS_INFORMATION__unsigned_int_const_char__
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140041ad0
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1400622bf
call fcn.140044c70
mov r14, qword [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe8]
add rsp, 0xb8
pop r15
pop r13
pop r12
pop rbp
ret