Function at 0x7ff7c00bffe0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x48]
sub rsp, 0x148
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
mov rdi, rcx
xor esi, esi
mov ecx, edx
mov qword [rbp - 0x78], rsi
and ecx, 0x3000
xor r12b, r12b
mov r13, r8
mov r14d, edx
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
cmp ecx, 0x3000
jne 0x7ff7c00c005e
mov eax, 0xc00000f0
add rsp, 0x148
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
nop
cmp qword [rdi], rsi
jne 0x7ff7c00c0081
cmp qword [rdi + 8], rsi
jne 0x7ff7c00c0081
mov eax, 0xc0000030
add rsp, 0x148
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x180], rbx
mov eax, 1
mov dword [rbp + 0xc], eax
mov word [rbp + 0x10], ax
mov rax, qword [rdi + 0x20]
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x140], r15
bt r14d, 0x12
jae 0x7ff7c00c02cc
test ecx, ecx
mov r13d, esi
mov r15, 0xffffffffffffffff
sete al
and edx, 0x10000
movzx ecx, al
cmove r13d, ecx
bt r14d, 0x11
jae 0x7ff7c00c0109
lea r9d, [r15 + 5]
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x88]
mov rcx, r15
lea edx, [r15 + 0x19]
mov ebx, 0xffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
movzx r13d, r13b
cmovns ebx, dword [rbp + 0x88]
cmp dword [rdi + 0x28], ebx
cmovne r13d, esi
test dword [rdi + 0x48], 0xfffffffd
jne 0x7ff7c00c02c5
test r13b, r13b
je 0x7ff7c00c02c5
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x7ff7c00c0132
call sym.ProcessHacker.exe_PhCreateString
mov rbx, rax
jmp 0x7ff7c00c0135
mov rbx, rsi
mov r10, qword [rdi + 0x18]
mov r8d, r14d
or r8d, 2
test r10, r10
cmovne r8d, r14d
mov eax, r8d
mov ecx, r8d
and ecx, 2
shl ecx, 9
mov edx, ecx
or edx, 4
and al, 4
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, r8d
cmove edx, ecx
mov ecx, edx
or ecx, 1
and al, 0x20
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 2
and al, 0x40
cmove edx, ecx
mov r9d, edx
bts r9d, 0x13
and r8b, 0x80
cmove r9d, edx
test rbx, rbx
je 0x7ff7c00c01ad
mov rcx, qword [rbx + 8]
jmp 0x7ff7c00c01b0
mov rcx, rsi
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x68]
mov rdx, qword [rdi + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r9d
mov r9d, 1
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x7ff7c00c0217
nop
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jg 0x7ff7c00c020e
mov esi, eax
jmp 0x7ff7c00c0217
movzx esi, ax
or esi, 0xc0070000
test rbx, rbx
je 0x7ff7c00c0231
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x7ff7c00c0231
call fcn.7ff7c00c6290
test esi, esi
js 0x7ff7c00c029a
mov rcx, qword ds:[rbp + 0x90]
test rcx, rcx
je 0x7ff7c00c0254
mov eax, dword [rsp + 0x78]
mov qword [rcx], rax
mov eax, dword [rsp + 0x7c]
mov qword [rcx + 8], rax
mov rcx, qword ds:[rbp + 0x98]
test rcx, rcx
je 0x7ff7c00c026f
mov rax, qword [rsp + 0x68]
mov qword [rcx], rax
jmp 0x7ff7c00c027f
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff7c00c027f
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x7ff7c00c02ab
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
mov eax, esi
jmp 0x7ff7c00c06ec
mov rcx, qword ds:[rsp + 0x68]
test rcx, rcx
je 0x7ff7c00c02ab
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff7c00c02bb
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x7ff7c00c06ec
mov r13, qword [rbp + 0x90]
bt r14d, 0xc
jae 0x7ff7c00c0445
cmp byte [0x7ff7c01d30ef], sil
lea rcx, [rbp - 0x80]
mov rax, qword [rdi + 0x30]
mov edx, 0x1000
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
jne 0x7ff7c00c0343
xorps xmm0, xmm0
mov dword [rbp - 0x68], 0x30
lea r9, [rsp + 0x68]
mov qword [rbp - 0x60], rsi
lea r8, [rbp - 0x68]
mov dword [rbp - 0x50], esi
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x58], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x7ff7c00c034d
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7c00c06ec
mov edx, 0x1000
lea rcx, [rbp - 0x80]
lea r8, [rsp + 0x68]
call fcn.7ff7c00e3530
test eax, eax
js 0x7ff7c00c06ec
mov r15, qword [rbp - 0x80]
lea r8, [rsp + 0x60]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x7ff7c00c0392
cmp byte [0x7ff7c01d30ef], sil
je 0x7ff7c00c0392
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.7ff7c00e3650
mov ebx, eax
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax]
test ebx, ebx
js 0x7ff7c00c06ea
mov r12d, r14d
shr r12d, 0x11
and r12b, 1
bt r14d, 0x10
jae 0x7ff7c00c058e
mov rcx, qword ds:[rsp + 0x60]
lea rax, [rbp - 0x70]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x68]
lea edx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x7ff7c00c058e
mov rbx, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x88]
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x7ff7c00c0585
cmp dword [rbp + 0x88], 1
jne 0x7ff7c00c0585
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword ds:[rsp + 0x60], rbx
jmp 0x7ff7c00c05f8
bt r14d, 0xd
jae 0x7ff7c00c04ab
call fcn.7ff7c00f7a30
test rax, rax
jne 0x7ff7c00c0465
mov eax, 0xc000007a
jmp 0x7ff7c00c06ec
call fcn.7ff7c00f7a30
mov edx, dword [rdi + 0x30]
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x68]
xor ecx, ecx
mov dword [rsp + 0x20], 0x18
mov r8d, 0xe
call qword [case.0x7ff7c00c1f48.0]
test al, al
je 0x7ff7c00c0568
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
jmp 0x7ff7c00c03a8
mov ebx, dword [rdi + 0x48]
test ebx, ebx
jne 0x7ff7c00c0539
mov rcx, qword [rdi + 0x30]
mov ebx, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x7ff7c00c0539
lea rdx, [0x7ff7c0188350]
call fcn.7ff7c01255e8
test eax, eax
jne 0x7ff7c00c0539
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x7ff7c00c04fd
lea rdx, [0x7ff7c0188370]
call fcn.7ff7c01255e8
test eax, eax
je 0x7ff7c00c0534
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x7ff7c00c051a
lea rdx, [0x7ff7c0188380]
call fcn.7ff7c01255e8
test eax, eax
je 0x7ff7c00c0534
mov rcx, qword [rdi + 0x38]
movzx eax, byte ds:[rcx]
xor al, 0xe
test al, 0x1f
jne 0x7ff7c00c0539
lea rdx, [0x7ff7c01883a0]
call fcn.7ff7c01255e8
test eax, eax
jne 0x7ff7c00c0539
mov ebx, 5
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rdi + 0x30]
mov r9d, ebx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
nop dword [rax]
test eax, eax
jne 0x7ff7c00c03b3
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jle 0x7ff7c00c06ec
movzx eax, ax
or eax, 0xc0070000
jmp 0x7ff7c00c06ec
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test r12b, r12b
je 0x7ff7c00c05f8
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp - 0x68]
mov dword [rbp - 0x68], 0x30
mov edx, 0xf01ff
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x50], esi
mov qword [rbp - 0x58], rsi
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword ds:[rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff7c00c06ea
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
bt r14d, 0x11
jae 0x7ff7c00c0630
mov eax, dword ds:[rdi + 0x28]
lea r8, [rbp + 0x88]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov dword [rbp + 0x88], eax
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
js 0x7ff7c00c06df
cmp qword [rdi + 0x18], rsi
jne 0x7ff7c00c066a
call fcn.7ff7c00f7570
nop dword [rax + rax]
test rax, rax
je 0x7ff7c00c066a
call fcn.7ff7c00f7570
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x78]
xor r8d, r8d
call qword [case.0x7ff7c00c1f48.0]
nop dword [rax]
cmp qword [rbp - 0x78], rsi
je 0x7ff7c00c066a
or r14d, 2
mov rax, qword [rdi + 0x18]
mov r8, qword [rbp - 0x78]
test rax, rax
mov rcx, qword [rbp + 0x98]
mov r9, qword [rdi + 0x10]
cmovne r8, rax
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov ebx, eax
call fcn.7ff7c00f76a0
test rax, rax
je 0x7ff7c00c06df
cmp qword [rbp - 0x78], rsi
je 0x7ff7c00c06df
call fcn.7ff7c00f76a0
mov rcx, qword [rbp - 0x78]
call qword [case.0x7ff7c00c1f48.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x180]
mov r15, qword [rsp + 0x140]
add rsp, 0x148
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret