Function at 0x14002a090
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400850b0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov qword [rsp + 0x78], r9
mov rdi, rdx
mov rsi, rcx
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], rdx
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov r12d, eax
xor r14d, r14d
mov r13d, r14d
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 7
lea r8d, [r14 + 0xc]
lea rdx, [0x140079318]
lea rcx, [rbp + 0x70]
call fcn.140007930
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14002a850
nop
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
cmp rbx, r15
jne 0x14002a210
test rbx, rbx
je 0x14002a182
mov rax, qword [rsp + 0x70]
sub rax, rbx
sar rax, 2
lea rdx, [rax*4]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002a16c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a83d
mov rcx, rbx
call fcn.140031c90
mov qword [rsp + 0x60], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14002a1bc
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14002a1b7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a813
mov rcx, r8
call fcn.140031c90
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14002a205
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14002a200
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a819
mov rcx, r8
call fcn.140031c90
mov qword [rdi + 0x10], r14
xor al, al
jmp 0x14002a7de
mov r14d, dword [rbx]
lea rdx, [rbp - 0x78]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14002a22a
cmp dword [rbp - 0x78], r12d
je 0x14002a235
add rbx, 4
cmp rbx, r15
je 0x14002a238
jmp 0x14002a210
mov r13d, r14d
mov r8d, r13d
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea r8, [rbp - 0x80]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14002a365
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14002a2d5
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14002a2be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a83d
call fcn.140031c90
xor ebx, ebx
mov qword [rsp + 0x60], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
jmp 0x14002a2d7
xor ebx, ebx
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14002a311
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14002a30c
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a813
mov rcx, r8
call fcn.140031c90
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14002a35a
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x14002a355
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a819
mov rcx, r8
call fcn.140031c90
mov qword [rdi + 0x10], rbx
xor al, al
jmp 0x14002a7de
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x68], 0x18
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
lea r8, [rbp - 0x68]
mov edx, 0x2000000
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14002a3b9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
jmp 0x14002a268
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x30], 0x68
lea rax, str.winsta0default
mov qword [rbp - 0x20], rax
mov rdx, rsi
lea rcx, [rbp + 0xb0]
call fcn.140029f00
nop
mov r8, rax
lea rdx, [0x140079310]
lea rcx, [rbp + 0x90]
call fcn.140008740
nop
mov r8d, 1
lea rdx, [0x140079310]
mov rcx, rax
call fcn.14000afc0
xor r15d, r15d
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x14002a4a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a49f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a81f
call fcn.140031c90
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r15w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x14002a504
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a4ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a825
call fcn.140031c90
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r15w
cmp qword [rdi + 0x10], 0
je 0x14002a608
mov rdx, rdi
lea rcx, [rbp + 0xd0]
call fcn.140029f00
nop
mov r8, rax
lea rdx, [0x140079314]
lea rcx, [rbp + 0x70]
call fcn.140008740
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14002a55b
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14000afc0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x14002a5ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a5a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a82b
call fcn.140031c90
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r15w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x14002a608
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a831
call fcn.140031c90
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae r8, qword [rbp + 0x50]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x28], r15d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x68]
xor edx, edx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov r14d, eax
test eax, eax
je 0x14002a681
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002a68e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
setne bl
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x14002a6f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a6ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a837
call fcn.140031c90
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14002a758
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a745
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a83d
call fcn.140031c90
mov qword [rsp + 0x60], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14002a792
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14002a78d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a813
mov rcx, r8
call fcn.140031c90
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14002a7d7
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14002a7d2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002a819
mov rcx, r8
call fcn.140031c90
mov qword [rdi + 0x10], r15
movzx eax, bl
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140031c70
mov rbx, qword [rsp + 0x250]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
nop
call fcn.1400447c4
int3