Function at 0x1400c3ec0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
xor esi, esi
mov dword [rbp + 0x90], 0x68
mov r12, r8
mov qword [rsp + 0x70], rsi
mov r14d, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x98]
lea r8d, [rsi + 0x60]
mov r13, r9
call fcn.14010ed90
xor r15b, r15b
lea r9d, [rsi + 0x18]
test byte [0x14018dc00], 1
jne 0x1400c402c
lock bts qword [0x14018dc00], 0x1f
jae 0x1400c3f58
test byte [0x14018dc00], 1
jne 0x1400c402c
xor edx, edx
lea rcx, [0x14018dc00]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x1400c4026
lea rcx, str.winsta.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x140168d68]
mov dword [rbp - 0x20], 0x1c001b
mov qword [rbp - 0x18], rcx
lea r9, [rbp - 0x48]
mov rcx, rax
lea rdx, [rbp - 0x20]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp - 0x48]
test eax, eax
cmovs rcx, rsi
mov qword [0x140193808], rcx
lea rcx, str.userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea r9, [rbp - 0x40]
mov dword [rbp - 0x10], 0x170016
mov rbx, rax
lea rdx, [rbp - 0x10]
lea rax, str.CreateEnvironmentBlock
mov rcx, rbx
xor r8d, r8d
mov qword [rbp - 8], rax
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp - 0x40]
lea r9, [rbp - 0x38]
test eax, eax
mov dword [rbp], 0x180017
lea rax, str.DestroyEnvironmentBlock
cmovs rcx, rsi
mov qword [rbp + 8], rax
mov qword [0x1401937f0], rcx
lea rdx, [rbp]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rcx, qword [rbp - 0x38]
test eax, eax
cmovs rcx, rsi
mov qword [0x140193810], rcx
lea rcx, [0x14018dc00]
call sym.ProcessHacker.exe_PhfSetEvent
mov r9d, 0x18
mov ecx, r14d
and ecx, 0x3000
cmp ecx, 0x3000
jne 0x1400c4047
mov eax, 0xc00000f0
jmp 0x1400c4648
cmp qword [rdi], rsi
jne 0x1400c405c
cmp qword [rdi + 8], rsi
jne 0x1400c405c
mov eax, 0xc0000030
jmp 0x1400c4648
mov rax, qword [rdi + 0x20]
mov qword [rbp + 0xa0], rax
bt r14d, 0x12
jae 0x1400c426d
test ecx, ecx
mov edx, r14d
mov r8d, esi
sete al
and edx, 0x10000
movzx ecx, al
cmove r8d, ecx
bt r14d, 0x11
jae 0x1400c40af
mov rax, qword gs:[0x30]
movzx r8d, r8b
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x2c0]
cmp dword [rdi + 0x28], eax
cmovne r8d, esi
test dword [rdi + 0x48], 0xfffffffd
jne 0x1400c426d
test r8b, r8b
je 0x1400c426d
mov r12, qword [rdi + 8]
or r13, 0xffffffffffffffff
test r12, r12
je 0x1400c411a
mov rbx, r13
inc rbx
cmp word [r12 + rbx*2], si
jne 0x1400c40d5
mov rdx, qword [0x140196800]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
test r12, r12
je 0x1400c411d
mov rcx, qword [rax + 8]
mov r8, rbx
mov rdx, r12
call fcn.14010e700
jmp 0x1400c411d
mov r15, rsi
mov r9, qword [rdi + 0x18]
mov r8d, r14d
or r8d, 2
test r9, r9
cmovne r8d, r14d
mov eax, r8d
mov ecx, r8d
and ecx, 2
shl ecx, 9
mov edx, ecx
or edx, 4
and al, 4
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
cmove edx, ecx
mov ecx, edx
bts ecx, 0x13
and r8b, 0x20
cmove ecx, edx
test r15, r15
je 0x1400c4178
mov rdx, qword [r15 + 8]
jmp 0x1400c417b
mov rdx, rsi
mov r8, qword [rdi + 0x40]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x38], r9
mov r9d, 1
mov dword [rsp + 0x30], ecx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rdi + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x1400c41e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400c41d9
mov esi, eax
jmp 0x1400c41e2
movzx esi, ax
or esi, 0xc0070000
test r15, r15
je 0x1400c41fc
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], r13d
cmp r13d, 1
jne 0x1400c41fc
call fcn.1400c8bc0
test esi, esi
js 0x1400c4266
mov rcx, qword [rbp + 0x150]
test rcx, rcx
je 0x1400c4219
mov eax, dword [rbp - 0x60]
mov qword [rcx], rax
mov eax, dword [rbp - 0x5c]
mov qword [rcx + 8], rax
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x1400c422e
mov rax, qword [rbp - 0x70]
mov qword [rcx], rax
jmp 0x1400c423d
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400c423d
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400c4257
mov rax, qword [rbp - 0x68]
mov qword [rcx], rax
mov eax, esi
jmp 0x1400c4648
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400c4266
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x1400c4648
bt r14d, 0xc
jae 0x1400c43db
cmp byte [0x1401937ba], sil
mov rax, qword [rdi + 0x30]
mov ebx, dword [sym.ProcessHacker.exe_ProcessQueryAccess]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rsi
je 0x1400c429e
mov eax, ebx
and eax, 0x121410
cmp eax, ebx
je 0x1400c42e1
xorps xmm0, xmm0
mov dword [rbp + 0x10], 0x30
lea r9, [rbp - 0x80]
mov qword [rbp + 0x18], rsi
lea r8, [rbp + 0x10]
mov dword [rbp + 0x28], esi
mov edx, ebx
mov qword [rbp + 0x20], rsi
lea rcx, [rsp + 0x68]
movdqu xmmword [rbp + 0x30], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400c42f1
cmp byte [0x1401937ba], sil
je 0x1400c4648
lea r8, [rbp - 0x80]
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1400dcab0
test eax, eax
js 0x1400c4648
mov r15, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x1400c4337
cmp byte [0x1401937ba], sil
je 0x1400c4337
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.1400dcbd0
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400c4646
mov r15d, r14d
shr r15d, 0x11
and r15b, 1
bt r14d, 0x10
jae 0x1400c4508
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x54]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
lea edx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x1400c4508
mov rbx, qword [rbp - 0x30]
lea rax, [rbp - 0x50]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x148]
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x1400c44ff
cmp dword [rbp + 0x148], 1
jne 0x1400c44ff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], rbx
jmp 0x1400c456d
bt r14d, 0xd
jae 0x1400c4430
mov rax, qword [0x140193808]
test rax, rax
jne 0x1400c43f8
mov eax, 0xc000007a
jmp 0x1400c4648
mov edx, dword [rdi + 0x30]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov r8d, 0xe
mov dword [rsp + 0x20], r9d
xor ecx, ecx
lea r9, [rbp + 0x70]
call rax
test al, al
je 0x1400c44e4
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x60], rax
jmp 0x1400c434a
mov ebx, dword [rdi + 0x48]
test ebx, ebx
jne 0x1400c44b9
mov rcx, qword [rdi + 0x30]
mov ebx, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x1400c44b9
lea rdx, str.NT_AUTHORITY
call fcn.14010f5a0
test eax, eax
jne 0x1400c44b9
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x1400c447e
lea rdx, str.SYSTEM
call fcn.14010f5a0
test eax, eax
je 0x1400c44b4
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x1400c449b
lea rdx, str.LOCAL_SERVICE
call fcn.14010f5a0
test eax, eax
je 0x1400c44b4
mov rcx, qword [rdi + 0x38]
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x1400c44b9
lea rdx, str.NETWORK_SERVICE
call fcn.14010f5a0
test eax, eax
jne 0x1400c44b9
mov ebx, 5
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rdi + 0x30]
mov r9d, ebx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x1400c4355
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400c4648
movzx eax, ax
or eax, 0xc0070000
jmp 0x1400c4648
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test r15b, r15b
je 0x1400c456d
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0x40]
mov dword [rbp + 0x40], 0x30
mov edx, 0xf01ff
mov qword [rbp + 0x48], rsi
mov dword [rbp + 0x58], esi
mov qword [rbp + 0x50], rsi
movdqu xmmword [rbp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x1400c4646
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x60], rax
bt r14d, 0x11
jae 0x1400c459f
mov eax, dword [rdi + 0x28]
lea r8, [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x78], eax
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
js 0x1400c463b
cmp qword [rdi + 0x18], rsi
jne 0x1400c45d0
mov rax, qword [0x1401937f0]
test rax, rax
je 0x1400c45d0
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
xor r8d, r8d
call rax
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x1400c45d5
or r14d, 2
jmp 0x1400c45d5
mov r8, qword [rsp + 0x70]
mov rax, qword [rdi + 0x18]
mov r9, qword [rdi + 0x10]
test rax, rax
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
cmovne r8, rax
mov rax, qword [rbp + 0x160]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x90]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov rcx, qword [rsp + 0x70]
mov ebx, eax
test rcx, rcx
je 0x1400c463b
mov rdx, qword [0x140193810]
test rdx, rdx
je 0x1400c463b
call rdx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x240]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret