Function at 0x140001160
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
mov dword [rsp + 0xc8], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0x140], 0
mov dword [rsp + 0xbc], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xd0], 0
lea rdi, [rsp + 0xd8]
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov qword [rsp + 0x98], 0
lea rdi, [rsp + 0xa0]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x148], 0
mov dword [rsp + 0xd0], 0x70
cmp qword [rsp + 0x170], 0
je 0x14000126f
cmp qword [rsp + 0x178], 0
jne 0x140001279
mov eax, 0x57
jmp 0x140001957
mov rax, qword [rsp + 0x170]
mov eax, dword [rax]
mov dword [rsp + 0x140], eax
mov rax, qword [rsp + 0x170]
mov eax, dword [rax + 4]
and eax, 4
test eax, eax
je 0x1400012bb
mov dword [rsp + 0xb8], 1
mov rax, qword [rsp + 0x170]
mov eax, dword [rax + 4]
mov dword [rsp + 0xbc], eax
jmp 0x1400012db
mov dword [rsp + 0xb8], 0
mov rax, qword [rsp + 0x170]
mov eax, dword [rax + 4]
or eax, 4
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x170]
movzx eax, word [rax + 8]
test eax, eax
je 0x1400012ff
mov rax, qword [rsp + 0x170]
add rax, 8
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x170]
movzx eax, word [rax + 0x210]
test eax, eax
je 0x140001328
mov rax, qword [rsp + 0x170]
add rax, 0x210
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x170]
movzx eax, word [rax + 0x418]
test eax, eax
je 0x14000134e
mov rax, qword [rsp + 0x170]
add rax, 0x418
mov qword [rsp + 0x70], rax
mov rdi, qword [rsp + 0x178]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
xor r8d, r8d
lea rdx, [0x14000bb60]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb0]
mov r8d, dword [rsp + 0x140]
lea rdx, str._LaunchAdminProcess__IN__pid_d__path_s__cmd_s__dir_s
lea rcx, [0x14000f9b0]
call fcn.140005a30
mov rdx, qword [rsp + 0x170]
mov r8d, dword [rdx]
xor edx, edx
mov ecx, 0x4c0
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x140001427
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
xor r8d, r8d
lea rdx, [0x14000bbf8]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov rdx, qword [rsp + 0x170]
mov r9d, dword [rdx]
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__OpenProcess_failed__err_d__pid_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
lea r8, [rsp + 0x150]
mov edx, 0xe
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14000148b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
xor r8d, r8d
lea rdx, [0x14000bc90]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__OpenProcessToken_failed__err_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x148]
mov edx, 0x13
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140001505
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
xor r8d, r8d
lea rdx, [0x14000bd20]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, [0x14000bd40]
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14000157f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
xor r8d, r8d
lea rdx, [0x14000bdb0]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__GetTokenInformation_failed__err_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
cmp eax, 1
jne 0x1400015ad
mov eax, dword [rsp + 0xbc]
or eax, 0x400
mov dword [rsp + 0xbc], eax
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x78]
call entry0
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xc8], 0
je 0x14000160b
xor r8d, r8d
lea rdx, [0x14000be40]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__IntializeStartupInfo_failed__err_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
mov eax, dword [rsp + 0xbc]
or eax, 0x80000
mov dword [rsp + 0xbc], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400016d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
xor r8d, r8d
lea rdx, [0x14000bed8]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__CreateProcessAsUser_failed__err_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
mov rcx, qword [rsp + 0x178]
mov eax, dword [rsp + 0xa8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x178]
mov eax, dword [rsp + 0xac]
mov dword [rcx + 4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14000177c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
xor r8d, r8d
lea rdx, [0x14000bf70]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__DuplicateHandle__hClientProcess__failed__err_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
mov rcx, qword [rsp + 0x68]
call fcn.140001ed0
mov edx, eax
mov rax, qword [rsp + 0x178]
mov dword [rax + 8], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x140001815
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xc8], eax
xor r8d, r8d
lea rdx, [0x14000c020]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__DuplicateHandle__hThread__failed__err_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
jmp 0x140001847
mov rcx, qword [rsp + 0x90]
call fcn.140001ed0
mov edx, eax
mov rax, qword [rsp + 0x178]
mov dword [rax + 0xc], edx
cmp dword [rsp + 0xb8], 0
jne 0x140001847
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor r8d, r8d
lea rdx, [0x14000c0c0]
lea rcx, [0x14000f9b0]
call fcn.1400058d0
mov r8d, dword [rsp + 0xc8]
lea rdx, str._LaunchAdminProcess__OUT__err_d
lea rcx, [0x14000f9b0]
call fcn.140005a30
cmp dword [rsp + 0xc8], 0
je 0x1400018a2
cmp qword [rsp + 0x98], 0
je 0x1400018a2
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp qword [rsp + 0xc0], 0
je 0x1400018bb
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp qword [rsp + 0x60], 0
je 0x1400018ce
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x150], 0
je 0x1400018e7
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x78], 0
je 0x1400018fa
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0xa0], 0
je 0x140001913
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x98], 0
je 0x14000192c
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x138], 0
je 0x140001950
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x138]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0xc8]
add rsp, 0x160
pop rdi
ret