Function at 0x14000b630
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rbx, rcx
mov rdx, rcx
lea rcx, str.__s
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x23
lea rdx, str.RunAppWithAdmin
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
xor edi, edi
mov qword [rbp - 0x49], rdi
mov qword [rbp + 0x77], rdi
call fcn.14000b340
test rax, rax
jne 0x14000b68c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
lea r8, [rbp - 0x49]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x14000b84c
mov rcx, qword [rbp - 0x49]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
je 0x14000b830
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_WTSGetActiveConsoleSessionId]
mov rcx, qword [rbp + 0x77]
lea r8, [rbp + 0x6f]
mov r9d, 4
mov dword [rbp + 0x6f], eax
lea edx, [r9 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
test eax, eax
jne 0x14000b71b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.SetTokenInformation_error
call fcn.140018760
mov r8d, 0x35
jmp 0x14000b866
xor edx, edx
lea rcx, [rbp - 0x29]
lea r8d, [rdx + 0x68]
call fcn.140026290
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp + 0x7f]
xor eax, eax
mov dword [rbp - 0x29], 0x68
mov qword [rbp - 0x41], rax
xor r8d, r8d
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea rax, str.WinSta0Default
mov qword [rbp - 0x19], rax
mov word [rbp + 0x17], di
mov dword [rbp + 0x13], 1
mov qword [rbp + 0x7f], rdi
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x14000b78c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateEnvironmentBlock_error
call fcn.140018760
mov r8d, 0x47
jmp 0x14000b866
mov rcx, qword [rbp + 0x77]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x50], rax
lea rdx, str.regsvr32.exe
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov r8, rbx
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
test eax, eax
jne 0x14000b7f4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessAsUser_error
call fcn.140018760
mov r8d, 0x4e
jmp 0x14000b866
lea rcx, str.CreateProcessAsUser_success
call fcn.140018760
lea r9, [0x1400af290]
mov r8d, 0x54
lea rdx, str.RunAppWithAdmin
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14000b880
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x14000b880
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.DuplicateTokenEx_error
call fcn.140018760
mov r8d, 0x5e
jmp 0x14000b866
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.cannot_get_administror
call fcn.140018760
mov r8d, 0x65
lea r9, [0x1400af290]
lea rdx, str.RunAppWithAdmin
lea rcx, str.__hs_____d_:_____s
call fcn.140018f50
mov rcx, qword [rbp + 0x77]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000b894
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000b8a8
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
ret