Function at 0x14001dd50
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400a6188]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, r8
mov r14, rdx
call fcn.140010cf0
mov rcx, rax
lea r9, [0x140071118]
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
xor edx, edx
call fcn.14002c750
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x60], rbx
call fcn.140010cf0
cmp byte [rax + 0x64], r12b
je 0x14001de14
lea ecx, [r12 + 0x28]
call fcn.140025d40
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001de0c
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
call fcn.140010cf0
mov rdx, rax
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov rcx, rbx
call fcn.140027d20
mov rbx, rax
jmp 0x14001de0f
mov rbx, r12
mov qword [rsp + 0x60], rbx
mov qword [rbp - 0x80], r12
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x80]
mov edx, 0x28
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
jne 0x14001de6c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
lea r9, str.OpenProcessToken_failed._Error:_0x_08X
jmp 0x14001e19f
lea r8, [rbp + 0x28]
lea rdx, str.SeTcbPrivilege
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14001de9c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
lea r9, str.LookupPrivilegeValue_failed._Error:_0x_08X
jmp 0x14001e19f
mov dword [rbp + 0x30], 1
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x34], rax
mov dword [rbp + 0x3c], 2
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14001e18b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x514
jne 0x14001df17
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], 0x514
lea r9, str.AdjustTokenPrivileges_failed_with_a_warning._No_problem_in_executing_other_codes._Error:_0x_08X
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 4
call fcn.14002c750
call fcn.1400129e0
mov edi, eax
test eax, eax
jne 0x14001df38
call fcn.140010cf0
mov dword [rsp + 0x20], r12d
lea r9, str.WTSGetActiveConsoleSessionId_failed._Error:_0x_08X
jmp 0x14001e1a3
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Current_Session_ID___d
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 2
call fcn.14002c750
mov ecx, edi
call fcn.140012790
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001df8f
call fcn.140010cf0
mov rcx, rax
lea r9, str.GetActiveSessionToken_failed
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
lea edx, [rsi + 6]
call fcn.14002c750
jmp 0x14001e1b7
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, rsi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x14001dfd5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
lea r9, str.DuplicateTokenEx_failed._Error:_0x_08X
jmp 0x14001e19f
mov dword [rbp + 0x20], 1
mov r9d, 4
lea r8, [rbp + 0x20]
lea edx, [r9 + 0x16]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
test eax, eax
jne 0x14001e012
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
lea r9, str.SetTokenInformation__TokenUIAccess__failed._Error:_0x_08X
jmp 0x14001e19f
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x50]
call fcn.14004b830
mov dword [rbp - 0x50], 0x68
lea rax, str.winsta0default
mov qword [rbp - 0x40], rax
mov r8d, 1
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x14001e064
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
lea r9, str.CreateEnvironmentBlock_failed._Error:_0x_08X
jmp 0x14001e19f
xor eax, eax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
mov dword [rsp + 0x28], r12d
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x68]
mov r8, r15
mov rdx, r14
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
mov edi, eax
test eax, eax
jne 0x14001e0e8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
lea r9, str.CreateProcessAsUser_failed._Error:_0x_08X
jmp 0x14001e19f
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14001e0f7
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14001e106
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14001e116
call sub.USERENV.dll_DestroyEnvironmentBlock
mov edi, eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14001e126
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test rsi, rsi
je 0x14001e134
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14001e165
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, [rbp + 0x40]
xor edx, edx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
mov edi, eax
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Return:_0x_08X
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 1
call fcn.14002c750
jmp 0x14001e1ba
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
lea r9, str.AdjustTokenPrivileges_failed._Error:_0x_08X
mov dword [rsp + 0x20], edi
lea r8, str.RpcServer::CKeyBoardBridge::LaunchProcess
mov edx, 5
mov rcx, rax
call fcn.14002c750
mov edi, r12d
test rbx, rbx
je 0x14001e1d4
mov rcx, rbx
call fcn.1400287c0
mov edx, 0x28
mov rcx, rbx
call fcn.140025d80
mov eax, edi
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400264a0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret