Function at 0x140004a00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rdi, rcx
test rcx, rcx
jne 0x140004a47
lea rdx, str.LaunchInstanceAsUser_hImpersonationToken__NULL
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140002070
xor al, al
jmp 0x140004c15
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
xor r8d, r8d
lea rdx, [0x140008938]
lea rcx, [rbp - 0x80]
call fcn.140005760
nop
lea rcx, [rbp - 0x80]
call fcn.140005170
test al, al
jne 0x140004a83
lea rdx, str.LaunchInstanceAsUser_GetCurrentExeFileFullPath_failed
jmp 0x140004bc1
lea rbx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rbx, qword [rbp - 0x80]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess_s]
test eax, eax
jne 0x140004bba
test rbx, rbx
je 0x140004bba
cmp word [rbx], ax
je 0x140004acb
call fcn.140006510
mov rcx, qword [rax]
mov rax, qword [rcx]
test rax, rax
je 0x140004acb
mov rcx, rbx
call rax
test eax, eax
je 0x140004adb
mov rcx, rbx
call fcn.1400022d0
test al, al
je 0x140004bba
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x60]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x140004afc
lea rdx, str.LaunchInstanceAsUser_CreateEnvironmentBlock_failed
jmp 0x140004bc1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x5c], xmm1
movups xmmword [rbp - 0x4c], xmm1
movups xmmword [rbp - 0x3c], xmm1
movups xmmword [rbp - 0x2c], xmm1
movups xmmword [rbp - 0x1c], xmm1
movups xmmword [rbp - 0xc], xmm1
mov dword [rbp + 4], eax
mov dword [rbp - 0x60], 0x68
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8000420
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test ebx, ebx
je 0x140004bb1
mov edx, 0xbb8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x140004bcf
lea rdx, str.LaunchInstanceAsUser_failed_end
jmp 0x140004bc1
lea rdx, str.LaunchInstanceAsUser_invalid_file
lea rcx, vtable.CBGSimpleLogger.0
call fcn.140002070
xor bl, bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140004c12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400066b0
movzx eax, bl
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140006690
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret