Function at 0x140002b78
Capabilities:
Create process on windows
Impersonate user

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
xor eax, eax
mov rdi, r8
mov r15, rcx
mov rsi, rdx
lea rcx, [r11 - 0x68]
lea r8d, [rax + 0x38]
xor edx, edx
mov rbx, r9
mov byte [rsp + 0x128], al
mov qword [rsp + 0x60], rax
mov r12, rax
mov r13, rax
mov rbp, rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x90], rax
mov r14, rax
mov qword [r11 - 0x90], rax
call fcn.1400761e0
movsx r9d, byte [rsp + 0x140]
lea edx, [r14 + 1]
mov rcx, r14
test byte [rsp + 0x140], dl
movzx eax, cl
mov r8, rbx
cmovne eax, edx
and r9d, 2
mov rdx, rdi
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x60]
or r9d, 4
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
shr r9d, 1
mov dword [rsp + 0xb0], gethostname
mov qword [rsp + 0xb8], rsi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
xor ebx, ebx
cmp eax, ebx
je 0x140002e9f
lea rcx, str.winsta0
xor edx, edx
mov r8d, 0x60000
call qword [sym.imp.USER32.dll_OpenWindowStationW]
mov r12, rax
cmp rax, rbx
je 0x140002e9f
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x140002e9f
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov rcx, r12
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
cmp eax, ebx
je 0x140002e9f
lea rcx, str.default
mov r9d, 0x60081
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_OpenDesktopW]
mov r13, rax
cmp rax, rbx
je 0x140002e9f
cmp rax, rdi
je 0x140002e9f
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
mov rcx, r15
call fcn.1400031d4
mov rbp, qword [rsp + 0x70]
cmp al, bl
je 0x140002e9f
lea r9, [rsp + 0x98]
mov r8, rbp
mov rdx, r12
mov rcx, r15
mov byte [rsp + 0x98], bl
mov byte [rsp + 0x99], reloc.WSOCK32.dll_inet_ntoa
mov dword [rsp + 0x9c], 0xf0000000
mov byte [rsp + 0xa4], bl
mov byte [rsp + 0xa5], 4
mov dword [rsp + 0xa8], 0xf037f
mov dword [rsp + 0x20], 2
call fcn.140003464
cmp al, bl
je 0x140002e9f
lea r9, [rsp + 0x70]
mov r8, rbp
mov rdx, r13
mov rcx, r15
mov byte [rsp + 0x70], bl
mov byte [rsp + 0x71], bl
mov dword [rsp + 0x74], 0xf01ff
mov dword [rsp + 0x20], 1
call fcn.14000377c
cmp al, bl
je 0x140002e9f
mov rdi, qword [rsp + 0x168]
mov r14, qword [rsp + 0x150]
lea rcx, str.winsta0default
mov esi, dword [rdi + 0x3c]
mov qword [rdi + 0x10], rcx
and esi, 0x100
cmp r14, rbx
je 0x140002dd1
mov rcx, r14
call fcn.140075704
mov rcx, 0xffffffffffffffff
lea rbx, [rax + 1]
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140075b98
mov rdx, r14
mov r8, rbx
mov rcx, rax
mov r14, rax
call fcn.1400762cc
xor ebx, ebx
jmp 0x140002dd4
mov r14, rbx
cmp byte [rsp + 0x68], bl
je 0x140002df5
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0xb0]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
cmp eax, ebx
je 0x140002e9f
test byte [rsp + 0x140], 4
jne 0x140002e1c
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x88]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
cmp eax, ebx
je 0x140002e9f
mov rax, qword [rsp + 0x160]
mov ecx, dword [rsp + 0x158]
mov rbx, qword [rsp + 0x170]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x88]
bts ecx, 0xa
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x60]
mov r8, r14
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
xor ecx, ecx
cmp eax, ecx
je 0x140002e9d
cmp byte [rsp + 0x68], cl
je 0x140002e99
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xe0]
mov rdx, rbx
mov rcx, r15
call fcn.140003328
mov bl, 1
jmp 0x140002ebe
xor ebx, ebx
mov rdx, qword [rsp + 0xe0]
cmp rdx, rbx
je 0x140002eb7
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov bl, byte [rsp + 0x128]
xor ecx, ecx
cmp rbp, rcx
je 0x140002ed9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.USER32.dll_CloseWindowStation]
mov rcx, r13
call qword [sym.imp.USER32.dll_CloseDesktop]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.140075884
mov rcx, qword [rsp + 0x88]
call sub.USERENV.dll_DestroyEnvironmentBlock
lea r11, [rsp + 0xf0]
mov al, bl
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret