Function at 0x14013b120
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0xc0]
xorps xmm0, xmm0
mov rbx, rcx
mov qword [rbp - 0x80], r9
xor esi, esi
mov qword [rsp + 0x78], rax
mov ecx, edx
mov qword [rsp + 0x68], rsi
and ecx, 0x3000
mov dword [rbp - 0x40], 0x68
xor r14b, r14b
mov r13, r8
mov edi, edx
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
cmp ecx, 0x3000
jne 0x14013b1a5
mov eax, 0xc00000f0
jmp 0x14013b86d
cmp qword [rbx], rsi
jne 0x14013b1ba
cmp qword [rbx + 8], rsi
jne 0x14013b1ba
mov eax, 0xc0000030
jmp 0x14013b86d
mov rax, qword [rbx + 0x20]
mov r8d, 1
mov qword [rsp + 0x1a8], r12
mov dword [rbp - 4], r8d
mov word [rbp], r8w
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x160], r15
bt edi, 0x12
jae 0x14013b412
test ecx, ecx
mov r12d, esi
mov r15, 0xffffffffffffffff
sete al
bt edi, 0x10
movzx ecx, al
cmovae r12d, ecx
bt edi, 0x11
jae 0x14013b244
mov r9d, 4
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x48]
mov edx, 0x18
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, 0xffffffff
movzx r12d, r12b
test eax, eax
mov r8d, 1
cmovns ecx, dword [rbp + 0x48]
cmp dword [rbx + 0x28], ecx
cmovne r12d, esi
mov eax, dword [rbx + 0x48]
test eax, eax
je 0x14013b254
cmp eax, 2
jne 0x14013b412
test r12b, r12b
je 0x14013b412
xor eax, eax
xorps xmm0, xmm0
mov r14, rsi
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x30], xmm0
cmp dword [rbx + 0x4c], eax
jne 0x14013b276
mov dword [rbx + 0x4c], r8d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14013b288
nop
call sym.SystemInformer.exe_PhCreateString
mov r14, rax
mov edx, edi
mov ecx, esi
or edx, 2
cmp qword [rbx + 0x18], rsi
cmovne edx, edi
test dl, 0x20
je 0x14013b2a3
lfence
mov ecx, 1
test dl, 0x40
je 0x14013b2ae
lfence
or ecx, 2
test dl, 4
je 0x14013b2b9
lfence
or ecx, 4
test dl, 0x10
je 0x14013b2c4
lfence
or ecx, 0x10
test dl, 2
je 0x14013b2d0
lfence
bts ecx, 0xa
test dl, dl
jns 0x14013b2db
lfence
bts ecx, 0x13
nop dword [rax + rax]
test dl, 8
je 0x14013b2ec
lfence
bts ecx, 0x18
bt edx, 8
jae 0x14013b2f9
lfence
bts ecx, 0x1a
test r14, r14
je 0x14013b304
mov rdx, qword [r14 + 8]
jmp 0x14013b307
mov rdx, rsi
mov r9d, dword [rbx + 0x4c]
lea rax, [rbp + 0x30]
mov r8, qword [rbx + 0x40]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbx + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x14013b37c
cmp dword [0x1402bff40], 0xffffffff
jae 0x14013b36d
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
jmp 0x14013b373
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov esi, eax
nop dword [rax]
test r14, r14
je 0x14013b39a
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x14013b39a
call fcn.140141ca0
test esi, esi
js 0x14013b3ec
nop
test r13, r13
je 0x14013b3b3
mov eax, dword [rbp + 0x40]
mov qword [r13], rax
mov eax, dword [rbp + 0x44]
mov qword [r13 + 8], rax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14013b3c5
mov rax, qword [rbp + 0x30]
mov qword [rcx], rax
jmp 0x14013b3d4
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013b3d4
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14013b3fb
mov rax, qword [rbp + 0x38]
mov qword [rcx], rax
mov eax, esi
jmp 0x14013b85d
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14013b3fb
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp + 0x38]
test rcx, rcx
je 0x14013b40b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013b85d
bt edi, 0xc
jae 0x14013b4e5
cmp dword [0x1402cddb8], 3
lea rcx, [rsp + 0x70]
mov rax, qword [rbx + 0x30]
mov edx, 0x1000
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rsi
jl 0x14013b447
lea r8, ds:[rbp + 0x30]
call fcn.140176ee0
jmp 0x14013b476
xorps xmm0, xmm0
mov dword [rbp - 0x78], 0x30
lea r9, [rbp + 0x30]
mov qword [rbp - 0x70], rsi
lea r8, [rbp - 0x78]
mov dword [rbp - 0x60], esi
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x68], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
je 0x14013b4dd
test eax, eax
js 0x14013b4dd
mov r15, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
mov r12d, dword [0x1402cddb8]
mov rcx, r15
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov r14d, eax
cmp eax, 0xc0000022
jne 0x14013b4c2
cmp r12d, 5
jne 0x14013b4c2
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, r15
call fcn.140177020
mov r14d, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
test r14d, r14d
jns 0x14013b537
lfence
mov eax, r14d
jmp 0x14013b85d
lfence
jmp 0x14013b85d
bt edi, 0xd
jae 0x14013b5c7
mov edx, dword ds:[rbx + 0x30]
lea r9, [rbp + 0x30]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x40], rax
mov r8d, 0xe
lea rax, [rbp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
movups xmmword [rbp + 0x30], xmm0
call qword [sym.imp.WINSTA.dll_WinStationQueryInformationW]
test al, al
je 0x14013b688
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov r14d, edi
shr r14d, 0x11
and r14b, 1
bt edi, 0x10
jae 0x14013b6c6
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x50]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x30]
mov edx, 0x13
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x14013b6c6
mov r15, qword [rbp + 0x30]
lea rax, [rsp + 0x70]
mov rcx, r15
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x48]
mov edx, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax]
test eax, eax
js 0x14013b6bc
cmp dword [rbp + 0x48], 1
jne 0x14013b6bc
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], r15
jmp 0x14013b731
mov r15d, dword [rbx + 0x48]
test r15d, r15d
jne 0x14013b65a
mov rcx, qword [rbx + 0x30]
mov r15d, 2
movzx eax, byte [rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013b65a
lea rdx, str.NT_AUTHORITY
call fcn.1401ea424
test eax, eax
jne 0x14013b65a
mov rcx, qword [rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xf3
test al, 0x1f
jne 0x14013b614
lea rdx, str.SYSTEM
call fcn.1401ea424
test eax, eax
je 0x14013b654
mov rcx, qword ds:[rbx + 0x38]
movzx eax, byte [rcx]
xor al, 0xc
test al, 0x1f
jne 0x14013b638
lea rdx, str.LOCAL_SERVICE
call fcn.1401ea424
test eax, eax
je 0x14013b654
mov rcx, qword [rbx + 0x38]
movzx eax, byte ds:[rcx]
xor al, 0xe
test al, 0x1f
jne 0x14013b65a
lea rdx, str.NETWORK_SERVICE
call fcn.1401ea424
test eax, eax
jne 0x14013b65a
mov r15d, 5
mov r8, qword [rbx + 0x40]
lea rax, [rsp + 0x60]
mov rdx, qword [rbx + 0x30]
mov r9d, r15d
mov rcx, qword [rbx + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
nop dword [rax]
test eax, eax
jne 0x14013b542
cmp dword [0x1402bff40], 0xffffffff
jae 0x14013b6aa
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
jmp 0x14013b85d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
jmp 0x14013b85d
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtClose]
test r14b, r14b
je 0x14013b731
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp - 0x78]
mov dword [rbp - 0x78], 0x30
mov edx, 0xf01ff
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x60], esi
mov qword [rbp - 0x68], rsi
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x60]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
jns 0x14013b728
lfence
mov eax, esi
jmp 0x14013b85d
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x60], rax
bt edi, 0x11
jae 0x14013b75d
mov eax, dword [rbx + 0x28]
lea r8, [rbp + 0x48]
mov rcx, qword [rsp + 0x60]
mov r9d, 4
mov edx, 0xc
mov dword [rbp + 0x48], eax
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
js 0x14013b78c
bt edi, 0x13
jae 0x14013b7a5
mov rcx, qword ds:[rsp + 0x60]
lea r8, [rbp + 0x48]
mov r9d, 4
mov dword [rbp + 0x48], 1
mov edx, 0x1a
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov esi, eax
test eax, eax
jns 0x14013b7a5
lfence
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x14013b85d
cmp qword [rbx + 0x18], 0
jne 0x14013b7d9
call fcn.1401724c0
test rax, rax
je 0x14013b7d9
call fcn.1401724c0
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call qword [case.0x14013d64a.0]
cmp qword [rsp + 0x68], 0
je 0x14013b7d9
or edi, 2
mov rax, qword [rbx + 0x18]
mov rcx, qword [rsp + 0x78]
test rax, rax
mov r8, qword [rsp + 0x68]
mov r9, qword [rbx + 0x10]
cmovne r8, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call sym.SystemInformer.exe_PhCreateProcessWin32Ex
mov ebx, eax
call fcn.140172680
test rax, rax
je 0x14013b850
cmp qword [rsp + 0x68], 0
je 0x14013b850
nop dword [rax]
call fcn.140172680
mov rcx, qword [rsp + 0x68]
call qword [case.0x14013d64a.0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov r12, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x160]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.1401e4160
add rsp, 0x168
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret