Function at 0x1400131a0
Capabilities:
Acquire debug privileges
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x448]
sub rsp, 0x520
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400a6188]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov esi, edx
xor r15d, r15d
mov dword [rbp - 0x80], r15d
call fcn.140010cf0
mov rcx, rax
lea rdi, [0x140071118]
mov r9, rdi
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
xor edx, edx
call fcn.14002c750
mov ebx, r15d
mov qword [rbp - 0x70], rbx
call fcn.140010cf0
cmp byte [rax + 0x64], r15b
je 0x14001326f
lea ecx, [r15 + 0x28]
call fcn.140025d40
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140013268
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
call fcn.140010cf0
mov rdx, rax
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov rcx, rbx
call fcn.140027d20
mov rbx, rax
jmp 0x14001326b
mov rbx, r15
mov qword [rbp - 0x70], rbx
call fcn.140010cf0
mov rcx, rax
lea r9, str.Enter_StartApplicationLauncher
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14002c750
mov rax, 0xffffffffffffffff
mov qword [rbp - 0x38], rax
call fcn.1400129e0
test eax, eax
jne 0x1400132cb
call fcn.140010cf0
mov rcx, rax
lea r9, str.Error_:_No_Active_sessions_found.
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14002c750
mov dil, 1
jmp 0x140013d23
mov ecx, eax
call fcn.140012790
mov r14, rax
mov qword [rbp - 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x140013306
call fcn.140010cf0
mov rcx, rax
lea r9, str.GetActiveSessionToken_failed
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [r14 + 6]
call fcn.14002c750
xor dil, dil
jmp 0x140013d23
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140013347
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.ImpersonateLoggedOnUser_failed_with_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14002c750
xor dil, dil
jmp 0x140013d23
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, r14
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400133a7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.DuplicateTokenEx_failed_with_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14002c750
xor dil, dil
jmp 0x140013d23
lea r8, [rbp + 0xa0]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400133f5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Lookup_Privilege_value_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14002c750
xor dil, dil
jmp 0x140013d23
mov dword [rbp + 0xa8], 1
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xac], rax
mov dword [rbp + 0xb4], 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rbp + 0xa8]
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140013472
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Adjust_Privilege_value_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 5
call fcn.14002c750
xor dil, dil
jmp 0x140013d23
mov qword [rbp - 0x30], r15
mov r8d, 1
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x30]
call sub.USERENV.dll_CreateEnvironmentBlock
mov r12d, r15d
mov ecx, 0x400
test eax, eax
cmovne r12d, ecx
mov dword [rbp - 0x7c], r12d
mov r13, rdi
mov qword [rbp - 0x78], rdi
movdqa xmm0, xmmword [0x1400739d0]
movdqu xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], r15w
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.14000fea0
nop
mov r15d, 5
cmp esi, 1
jne 0x140013502
call fcn.140010cf0
mov rcx, rax
lea r9, str.Launching_windows_MSInfo_executable
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [rsi + 2]
call fcn.14002c750
lea rdi, str.C:WindowsSystem32msinfo32.exe
jmp 0x140013ba2
cmp esi, 2
jne 0x14001352a
call fcn.140010cf0
mov rcx, rax
lea r9, str.Launching_HP_UWP_App_is_not_implemented
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [rsi + 2]
call fcn.14002c750
jmp 0x140013ba2
cmp esi, 3
jne 0x140013b49
call fcn.140010cf0
mov rcx, rax
lea r9, str.Launching_HPHotkeyNotification
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, esi
call fcn.14002c750
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1e0]
call fcn.14004b830
mov r8d, 0x104
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400135b1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.Could_not_find_Service_file_executable_.Error:_0x_08X
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, r15d
call fcn.14002c750
xor esi, esi
xor dil, dil
jmp 0x140013cca
movdqa xmm0, xmmword [0x1400739d0]
movdqu xmmword [rbp + 0x70], xmm0
xor eax, eax
mov word [rbp + 0x60], ax
lea rax, [rbp + 0x1e0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400135d2
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x60]
call fcn.14000fea0
nop
lea rdi, [rbp + 0x60]
mov r12, qword [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 8
cmovae rdi, r12
mov r14, qword [rbp + 0x70]
test r14, r14
je 0x1400136e2
mov esi, 0x100
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0xe0]
call fcn.14004b830
lea rcx, [0x140072c30]
lea rdx, [0x140072c32]
movzx eax, word [rcx]
cmp ax, si
jae 0x140013691
movzx eax, al
mov byte [rbp + rax + 0xe0], 1
add rcx, 2
cmp rcx, rdx
jne 0x140013633
lea rcx, [r14 - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdi + rax*2]
nop dword [rax + rax]
movzx eax, word [r8]
cmp ax, si
jae 0x140013686
movzx eax, ax
cmp byte [rbp + rax + 0xe0], 0
jne 0x1400136da
cmp r8, rdi
je 0x1400136e9
sub r8, 2
jmp 0x140013670
lea rcx, [r14 - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdi + rax*2]
nop word [rax + rax]
mov ecx, 1
lea rax, [0x140072c30]
movzx edx, word [r8]
cmp word [rax], dx
je 0x1400136da
add rax, 2
sub rcx, 1
jne 0x1400136c0
cmp r8, rdi
je 0x1400136e9
sub r8, 2
jmp 0x1400136b0
sub r8, rdi
sar r8, 1
jmp 0x1400136ec
mov r9, 0xffffffffffffffff
mov r8, r9
cmp r8, 0xffffffffffffffff
je 0x14001372d
movdqa xmm0, xmmword [0x1400739d0]
movdqu xmmword [rbp - 0x50], xmm0
xor esi, esi
mov word [rbp - 0x60], si
cmp r14, r8
cmovb r8, r14
lea rdx, [rbp + 0x60]
cmp r13, 8
cmovae rdx, r12
lea rcx, [rbp - 0x60]
call fcn.14000fea0
lea rax, [rbp - 0x60]
mov edi, r15d
jmp 0x1400137ad
lea rsi, [rbp + 0x60]
cmp r13, 8
cmovae rsi, r12
cmp r14, 8
jae 0x140013752
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], 7
jmp 0x14001379c
mov rdi, r14
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
mov rdx, rdi
add rdx, 1
cmovb rdx, r9
lea rcx, [rsp + 0x60]
call fcn.14000fc40
mov qword [rsp + 0x60], rax
lea r8, [r14*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14004b3c0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r14
lea rax, [rsp + 0x60]
mov edi, 2
xor esi, esi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
test dil, 2
je 0x14001381d
and edi, 0xfffffffd
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001381d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013817
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013d81
call fcn.140025d80
nop
test dil, 1
je 0x140013867
and edi, 0xfffffffe
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140013867
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013861
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013d87
call fcn.140025d80
nop
movdqa xmm0, xmmword [0x1400739d0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
or edi, 8
mov dword [rbp - 0x80], edi
mov r12, qword [rbp + 0xc8]
lea rdx, [r12 + 1]
lea rcx, [rsp + 0x60]
call fcn.140013da0
lea r9, [rbp + 0xb8]
mov r14, qword [rbp + 0xb8]
mov r13, qword [rbp + 0xd0]
cmp r13, 8
cmovae r9, r14
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp r12, rax
ja 0x1400138fa
lea rsi, [r12 + rcx]
mov qword [rsp + 0x70], rsi
lea rdi, [rsp + 0x60]
cmp rdx, 8
cmovae rdi, qword [rsp + 0x60]
lea r8, [r12 + r12]
lea rcx, [rdi + rcx*2]
mov rdx, r9
call fcn.14004b3c0
xor r12d, r12d
mov word [rdi + rsi*2], r12w
jmp 0x140013920
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140012390
mov r13, qword [rbp + 0xd0]
mov r14, qword [rbp + 0xb8]
xor r12d, r12d
mov rcx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
mov rax, r9
sub rax, rcx
cmp rax, 1
jb 0x14001396b
lea rsi, [rcx + 1]
mov qword [rsp + 0x70], rsi
lea rdi, [rsp + 0x60]
cmp r9, 8
cmovae rdi, qword [rsp + 0x60]
lea rcx, [rdi + rcx*2]
mov r8d, 2
lea rdx, [0x140072c30]
call fcn.14004b3c0
mov word [rdi + rsi*2], r12w
jmp 0x14001398c
mov qword [rsp + 0x20], 1
lea r9, [0x140072c30]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x60]
call fcn.140012390
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0x18
jb 0x1400139dc
lea rsi, [rcx + 0x18]
mov qword [rsp + 0x70], rsi
lea rdi, [rsp + 0x60]
cmp rdx, 8
cmovae rdi, qword [rsp + 0x60]
lea rcx, [rdi + rcx*2]
mov r8d, 0x30
lea rdx, str.HPHotkeyNotification.exe
call fcn.14004b3c0
mov word [rdi + rsi*2], r12w
lea rax, [rsp + 0x60]
jmp 0x1400139fd
mov qword [rsp + 0x20], 0x18
lea r9, str.HPHotkeyNotification.exe
xor r8d, r8d
lea edx, [r8 + 0x18]
lea rcx, [rsp + 0x60]
call fcn.140012390
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rcx, [rbp + 0x80]
call fcn.14000f7d0
movups xmmword [rbp + 0x80], xmm6
movups xmmword [rbp + 0x90], xmm7
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140013a70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013a6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013d8d
call fcn.140025d80
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdi, qword [rbp + 0x80]
call fcn.140010cf0
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, str.HPHotkeyNotification_complete_path_:__s
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14002c750
nop
cmp r13, 8
jb 0x140013ae9
lea rdx, [r13*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140013ae0
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013d93
mov rcx, r14
call fcn.140025d80
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x140013b29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013b24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013d99
call fcn.140025d80
movdqa xmm0, xmmword [0x1400739d0]
movdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
mov r14, qword [rbp - 0x68]
mov r12d, dword [rbp - 0x7c]
mov r13, qword [rbp - 0x78]
jmp 0x140013ba2
cmp esi, 4
jne 0x140013ba2
call fcn.140010cf0
mov rcx, rax
lea r9, str.Launching_Windows_Power_Options
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [rsi - 1]
call fcn.14002c750
lea rdi, str.C:WindowsSystem32control.exe
lea r13, str.__name_Microsoft.PowerOptions
call fcn.140010cf0
mov rcx, rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
lea r9, str.Power_Options_complete_path_:__s_s
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
lea edx, [rsi - 1]
call fcn.14002c750
or r12d, 0x30
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x10]
call fcn.14004b830
mov dword [rbp - 0x10], 0x68
lea rax, str.winsta0default
mov qword [rbp], rax
mov word [rbp + 0x30], r15w
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
xor esi, esi
mov qword [rsp + 0x40], rsi
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r13
mov rdx, rdi
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140013c50
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140010cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.CreateProcessAsUser_failed_with_Error:__u
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, r15d
call fcn.14002c750
xor dil, dil
jmp 0x140013cca
call fcn.140010cf0
mov rcx, rax
lea r9, str.Process_launched_successfully
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14002c750
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140013c7e
call sub.USERENV.dll_DestroyEnvironmentBlock
mov rcx, qword [rbp - 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140013c8e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
cmp rcx, 0xffffffffffffffff
je 0x140013c9e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call fcn.140010cf0
mov rcx, rax
lea r9, str.Exit_StartApplicationLauncher
lea r8, str.RpcServer::AppSection::CAppActivationHandler::StartApplicationLauncher
mov edx, 3
call fcn.14002c750
mov dil, 1
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x140013d0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013d07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013d7b
call fcn.140025d80
movdqa xmm0, xmmword [0x1400739d0]
movdqu xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], si
test rbx, rbx
je 0x140013d3d
mov rcx, rbx
call fcn.1400287c0
mov edx, 0x28
mov rcx, rbx
call fcn.140025d80
movzx eax, dil
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400264a0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004e3b0
nop
call fcn.14004e3b0
nop
call fcn.14004e3b0
int3
call fcn.14004e3b0
nop
call fcn.14004e3b0
nop
call fcn.14004e3b0
int3