Function at 0x1400098e0
Capabilities:
Create process on windows
Enumerate processes
Resume thread

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x338
mov rbx, rcx
mov rsi, rdx
mov qword [rsp + 0x328], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x328]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 6
mov r8d, 2
xor r9, r9
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x140009a3b
mov qword [rsp + 0x320], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x328]
mov edx, 1
mov r8d, 2
lea r9, [rsp + 0x320]
call qword [sym.imp.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorW]
test eax, eax
je 0x140009a42
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x320]
mov rdx, qword [rsp + 0x320]
lea r8, str.G:SY
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x1400099c9
add rcx, 2
test ax, ax
jne 0x1400099b0
jmp 0x140009a57
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x318], 0
lea rdi, [rsp + 0x58]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov rcx, rdi
lea rdx, [rsp + 0x58]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140009a6a
lea rdx, [rsp + 0x84]
lea r8, str.winlogon.exe
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x140009a96
add rcx, 2
test ax, ax
jne 0x140009a25
jmp 0x140009aa9
xor eax, eax
jmp 0x140009c32
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x140009c32
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x140009c32
xor r12, r12
jmp 0x140009abe
lea rdx, [rsp + 0x84]
lea r8, str.winlogon.exe
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x140009a96
add rcx, 2
test ax, ax
jne 0x140009a80
jmp 0x140009aa9
mov rcx, rdi
lea rdx, [rsp + 0x58]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140009a6f
jmp 0x140009a6a
mov r8d, dword [rsp + 0x60]
mov ecx, 0x1000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
mov edx, 9
lea r8, [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140009bce
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x310], 0
lea rdi, [rsp + 0x290]
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x290], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x2f8], xmm0
mov qword [rsp + 0x308], 0
lea rcx, [rsp + 0x310]
mov rdx, qword [rsp + 0x318]
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x404
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x318]
lea rdx, str.SystemResearch.exe
xor r8, r8
xor r9, r9
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140009bdb
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140009c32
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140009c32
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.USER32.dll_EndDialog]
mov eax, 1
add rsp, 0x338
pop r12
pop rdi
pop rsi
pop rbx
ret