Function at 0x14002de70
Capabilities:
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb8
cmp qword [0x1400a8e00], 0
mov r15, r8
mov r13, rdx
mov r12, rcx
jne 0x14002deaf
mov eax, 0xfffffd9f
add rsp, 0xb8
pop r15
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], rdi
mov edi, dword [rbp + 0x77]
mov qword [rsp + 0xb0], r14
mov r14, qword [rbp + 0x7f]
mov qword [rbp - 0x41], 0
test dil, 0x40
je 0x14002deff
mov rcx, r14
call fcn.140027460
test al, al
jne 0x14002defc
mov rcx, r14
call fcn.140025dc0
test al, al
je 0x14002deff
and edi, 0xffffffbf
mov rsi, qword [rbp + 0x57]
test dil, 0x10
je 0x14002df1d
bt edi, 8
jb 0x14002dfcb
cmp rsi, 0xffffffffffffffff
je 0x14002dfd1
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], r15
mov r8, r14
mov rdx, rsi
mov ecx, edi
call fcn.14002eb90
mov ebx, eax
test ebx, ebx
js 0x14002e1df
cmp dword [0x1400a970c], 0x69
mov ecx, 4
mov rax, qword [rbp + 0x4f]
mov r8, r13
mov rsi, qword [rbp + 0x6f]
setl r14b
mov rbx, qword [rbp + 0x67]
xor edx, edx
cmp dword [0x1400a970c], 0x69
mov qword [rsp + 0x50], rsi
cmovl edx, ecx
mov qword [rsp + 0x48], rbx
mov rcx, qword [rbp - 0x41]
or edx, dword [rbp + 0x5f]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rcx
mov rcx, qword [r15]
mov dword [rsp + 0x30], edx
xor edx, edx
mov qword [rsp + 0x28], rax
mov rax, qword [0x1400a8e00]
mov qword [rsp + 0x20], rcx
mov rcx, r12
shr edi, 4
and edi, 1
mov r9d, edi
call qword [case.0x14004be35.0]
test eax, eax
je 0x14002e165
test r14b, r14b
jne 0x14002e0cb
xor ebx, ebx
jmp 0x14002e1d1
cmp rsi, 0xffffffffffffffff
jne 0x14002dfdd
test edi, 0x140
je 0x14002df3d
lea r8, [rbp - 0x49]
mov qword [rbp - 0x39], 0
mov rdx, r13
mov qword [rbp - 0x49], 0xffffffffffffffff
mov rcx, r12
call fcn.14002fd40
mov ebx, eax
test eax, eax
js 0x14002e1df
xor edx, edx
lea rcx, [rbp - 0x31]
lea r8d, [rdx + 0x38]
call sym.NetMonitor.exe_nocrt_memset
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x31]
mov rax, qword [0x1400a8e38]
mov dword [rbp - 0x31], 0x38
mov qword [rbp - 0x29], r12
mov dword [rbp - 0x2d], 1
call qword [case.0x14004be35.0]
test eax, eax
je 0x14002e0a3
mov rcx, qword [rbp - 0x49]
lea r9, [rbp - 0x39]
mov r8d, edi
mov rdx, rsi
call fcn.14002ed10
mov ebx, eax
test eax, eax
js 0x14002e08c
mov r9, r15
mov r8, r14
mov rdx, rsi
mov ecx, edi
call fcn.14002f0c0
mov ebx, eax
test eax, eax
js 0x14002e07e
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x41]
call fcn.14002a430
mov ebx, eax
mov rcx, qword [rbp - 0x39]
cmp rcx, rsi
je 0x14002e08c
call fcn.140029f00
mov rdx, qword [rbp - 1]
mov rcx, qword [rbp - 0x49]
mov rax, qword [0x1400a8e40]
call qword [case.0x14004be35.0]
jmp 0x14002e0b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
mov rcx, qword [rbp - 0x49]
cmp rcx, 0xffffffffffffffff
je 0x14002df35
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002df35
mov rdx, qword [rsi]
lea r9, [rbp - 0x39]
mov rcx, qword [rbx + 0x50]
mov r8d, 0x20
mov qword [rbp - 0x39], 0
call fcn.14002ee80
mov rdx, qword [rsi]
lea r9, [rbp - 0x39]
mov rcx, qword [rbx + 0x58]
mov r8d, 0x28
call fcn.14002ee80
mov rdx, qword [rsi]
lea r9, [rbp - 0x39]
mov rcx, qword [rbx + 0x60]
mov r8d, 0x30
call fcn.14002ee80
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14002e12b
xor ebx, ebx
jmp 0x14002e1d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001ee80
mov ebx, eax
test eax, eax
jns 0x14002e1d1
mov rcx, qword [rsi]
mov edx, 0x7f
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002e1d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edi, eax
call fcn.14001ee80
mov ebx, eax
cmp eax, 0xffffffdd
jne 0x14002e1d1
mov rax, qword [0x1400a4d90]
test rax, rax
je 0x14002e1d1
mov ecx, 0xd0010
call qword [case.0x14004be35.0]
test rax, rax
je 0x14002e1d1
mov dword [rsp + 0x40], ebx
lea rcx, str.CreateProcessWithLogonW_failed:_dwErr_u___x___rc_Rrc_n
mov dword [rsp + 0x38], edi
lea r9, str._Rfn:__M
mov dword [rsp + 0x30], edi
lea edx, [rbx + 0x33]
mov qword [rsp + 0x28], rcx
lea r8d, [rbx + 0x30]
lea rcx, str.int___cdecl_rtProcWinCreateAsUser1_unsigned_short__unsigned_short__unsigned_short__unsigned_short__struct_RTENVINTERNAL__unsigned_long_struct__STARTUPINFOW__struct__PROCESS_INFORMATION__unsigned_int_const_char__
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14001ec40
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14002e1df
call fcn.14002a120
mov r14, qword [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe8]
add rsp, 0xb8
pop r15
pop r13
pop r12
pop rbp
ret