Function at 0x1400b4880
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x148], 0xfffffffffffffffe
mov ecx, 1
xor edx, edx
call fcn.1401a5d60
mov r12, qword [str.xB__]
mov rax, qword [r12]
cmp rax, 3
jb 0x1400b4939
lea rax, str.Attempting_to_launch_terminal_as_SYSTEM...
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
lea rcx, [0x14025f958]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], 4
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], 4
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x10]
lea r8, [rbp + 0x110]
mov edx, 3
xor r9d, r9d
call fcn.140146f90
lea rax, str.C:WindowsSystem32cmd.exeActive_session_ID:
mov qword [rbp + 0x80], rax
lea rax, [0x14025f98b]
mov qword [rbp + 0x88], rax
mov word [rbp + 0x90], 0
mov dword [rbp + 0x98], 1
lea rcx, [rbp - 8]
lea rdi, [rbp + 0x80]
mov rdx, rdi
call fcn.1400ca090
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x70], 0
mov dword [rbp + 0x10], 0x68
lea rax, [0x14025f71d]
mov qword [rbp + 0x110], rax
lea rax, [0x14025f72c]
mov qword [rbp + 0x118], rax
mov word [rbp + 0x120], 0
mov dword [rbp + 0x128], 1
lea rbx, [rbp + 0xe8]
lea rsi, [rbp + 0x110]
mov rcx, rbx
mov rdx, rsi
call fcn.1400ca090
mov rdx, qword [rbp + 0xe8]
mov r14, qword [rbp + 0xf0]
test rdx, rdx
je 0x1400b4a11
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.1400cc1a0
mov qword [rbp + 0x20], r14
mov dword [rbp + 0x4c], 1
mov word [rbp + 0x50], 5
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
call qword [sym.imp.kernel32.dll_WTSGetActiveConsoleSessionId]
mov dword [rbp + 0xa4], eax
mov rcx, qword [r12]
cmp eax, 0xffffffff
je 0x1400b4e36
cmp rcx, 3
jb 0x1400b4b06
lea rax, [rbp + 0xa4]
mov qword [rbp + 0xd8], rax
lea rax, [0x1401d6560]
mov qword [rbp + 0xe0], rax
lea rax, [0x14025f9a0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x14025f9b0]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 3
xor r9d, r9d
call fcn.140146f90
call fcn.140001f00
mov qword [rbp + 0xc0], rax
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r8, [rbp + 0xc0]
mov rcx, rax
mov edx, 0xb
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x1400b4f07
call fcn.140001f00
mov qword [rbp + 0xb8], rax
mov rcx, qword [rbp + 0xc0]
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov edx, 0x18b
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.advapi32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400b5007
mov eax, dword [rbp + 0xa4]
mov dword [rbp + 0xa0], eax
mov rcx, qword [rbp + 0xb8]
lea r8, [rbp + 0xa0]
mov edx, 0xc
mov r9d, 4
call qword [sym.imp.advapi32.dll_SetTokenInformation]
test eax, eax
je 0x1400b5367
mov dword [rbp + 0xb0], 0
mov rax, qword [r12]
cmp rax, 3
jb 0x1400b4c58
lea rax, str.Creating_process_in_users_session...
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x120], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x147], 1
lea rcx, [0x14025fa58]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 3
xor r9d, r9d
call fcn.140146f90
mov rcx, qword [rbp + 0xb8]
mov r14, qword [rbp]
mov byte [rbp + 0x147], 1
lea rax, [rbp - 0x20]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, r14
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1400b54d0
mov rax, qword [r12]
cmp rax, 3
jb 0x1400b4d56
lea rax, str.Successfully_launched_terminal_as_SYSTEM.
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x120], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x147], 1
lea rcx, [0x14025fab0]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 3
xor r9d, r9d
call fcn.140146f90
mov rcx, qword [rbp + 0xc0]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b4da3
mov byte [rbp + 0x147], 1
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b4da3
test rax, rax
je 0x1400b4da3
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov rcx, qword [rbp + 0xb8]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b4df0
mov byte [rbp + 0x147], 1
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b4df0
test rax, rax
je 0x1400b4df0
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov r15d, dword [rbp - 0x10]
cmp dword [rbp + 0xb0], 0
je 0x1400b4e13
cmp qword [rbp + 0xa8], 0
je 0x1400b4e13
lea rcx, [rbp + 0xa8]
call fcn.14019d270
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x1400b5232
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.1400cc1a0
jmp 0x1400b5232
test rcx, rcx
je 0x1400b4efd
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14019d1b0]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_get_active_session_ID._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x14025fc00]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.140146f90
call fcn.14019dad0
jmp 0x1400b513a
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b4b35
test rax, rax
je 0x1400b4f32
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov rax, qword [r12]
test rax, rax
je 0x1400b4ffd
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14019d1b0]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_open_SYSTEM_token._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x14025fbb0]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.140146f90
call fcn.14019dad0
jmp 0x1400b513a
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b4b78
test rax, rax
je 0x1400b5032
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov rax, qword [r12]
test rax, rax
je 0x1400b50fd
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14019d1b0]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_duplicate_SYSTEM_token._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x14025fb60]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.140146f90
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b5135
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b5135
test rax, rax
je 0x1400b5135
lea rcx, [rbp + 0x110]
call fcn.14019d270
call fcn.14019dad0
mov r15, rax
mov r14d, edx
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x1400b515b
mov rcx, qword [rbp]
add rdx, rdx
mov r8d, 2
call fcn.1400cc1a0
test r14d, r14d
je 0x1400b5232
mov qword [rbp + 0x80], r15
mov dword [rbp + 0x88], r14d
mov rax, qword [r12]
test rax, rax
je 0x1400b5218
mov qword [rbp + 0xe8], rdi
lea rax, [0x14019dc10]
mov qword [rbp + 0xf0], rax
lea rax, str.Failed_to_launch_terminal._Error:
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 1
lea rcx, [0x14025f090]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], 4
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], 4
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x10]
lea r8, [rbp + 0x110]
mov edx, 1
xor r9d, r9d
call fcn.140146f90
mov r15, qword [rbp + 0x80]
test r15, r15
je 0x1400b5355
lea rcx, [rbp + 0x80]
call fcn.14019d270
jmp 0x1400b5355
mov dword [rbp + 0x80], r15d
mov rax, qword [r12]
cmp rax, 3
jb 0x1400b52d9
mov qword [rbp + 0xe8], rdi
lea rax, [0x1401d6560]
mov qword [rbp + 0xf0], rax
lea rax, str.Successfully_launched_terminal_as_SYSTEM_with_PID:
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 1
lea rcx, [0x14025efb8]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], 4
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], 4
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x10]
lea r8, [rbp + 0x110]
mov edx, 3
xor r9d, r9d
call fcn.140146f90
mov rax, qword [0x1402f4020]
cmp rax, 3
jne 0x1400b56c1
mov rdi, qword [0x1402f4028]
lea rsi, [rdi + 0x10]
mov cl, 1
xor eax, eax
lock cmpxchg byte [rdi + 0x10], cl
jne 0x1400b56f6
mov rbx, qword [str.PC__]
mov rax, qword [rbx]
shl rax, 1
test rax, rax
jne 0x1400b5703
movzx eax, byte [rdi + 0x11]
test al, al
jne 0x1400b5765
lea r14, [rdi + 0x11]
mov eax, dword [rbp + 0x80]
mov dword [rdi + 0x14], 1
mov dword [rdi + 0x18], eax
mov rax, qword [rbx]
shl rax, 1
test rax, rax
jne 0x1400b5742
xor eax, eax
xchg byte [rsi], al
cmp al, 2
je 0x1400b5758
add rsp, 0x1d0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.14019dad0
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xb0], edx
test edx, edx
je 0x1400b4bb5
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0xd0], edx
mov rax, qword [r12]
test rax, rax
je 0x1400b544d
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14019dc10]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_set_session_ID_on_the_token._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [0x14025fa08]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.140146f90
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b5485
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b5485
test rax, rax
je 0x1400b5485
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b54bd
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b54bd
test rax, rax
je 0x1400b54bd
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov r15, qword [rbp + 0xc8]
mov r14d, dword [rbp + 0xd0]
jmp 0x1400b5140
mov byte [rbp + 0x147], 1
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b4cb3
test rax, rax
je 0x1400b5509
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov rax, qword [r12]
test rax, rax
je 0x1400b55e9
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc8], eax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14019d1b0]
mov qword [rbp + 0xe0], rax
lea rax, str.Failed_to_create_terminal_process._Error:
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
mov byte [rbp + 0x147], 1
lea rcx, [0x14025fb08]
call fcn.140147080
lea rcx, str.ICBM
mov qword [rbp + 0xe8], rcx
mov qword [rbp + 0xf0], 4
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], 4
mov qword [rbp + 0x108], rax
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
lea r8, [rbp + 0xe8]
mov edx, 1
xor r9d, r9d
call fcn.140146f90
mov rcx, qword [rbp + 0xc0]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b5636
mov byte [rbp + 0x147], 1
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b5636
test rax, rax
je 0x1400b5636
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov rcx, qword [rbp + 0xb8]
mov byte [rbp + 0x147], 1
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400b5683
mov byte [rbp + 0x147], 1
call fcn.14019dad0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], edx
test edx, edx
je 0x1400b5683
test rax, rax
je 0x1400b5683
mov byte [rbp + 0x147], 1
lea rcx, [rbp + 0x110]
call fcn.14019d270
mov byte [rbp + 0x147], 1
call fcn.14019dad0
mov r15, rax
mov r14d, edx
cmp dword [rbp + 0xb0], 0
je 0x1400b5140
cmp qword [rbp + 0xa8], 0
je 0x1400b5140
lea rcx, [rbp + 0xa8]
call fcn.14019d270
jmp 0x1400b5140
lea rcx, [0x1402f4020]
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x10], rsi
lea rax, str._rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_std_src_synclazy_lock.rs
mov qword [rsp + 0x20], rax
lea r9, [0x1401f3430]
lea r8, [rbp + 0x10]
xor edx, edx
call fcn.1401defe0
jmp 0x1400b52ea
mov rcx, rsi
call fcn.1401def10
jmp 0x1400b5304
call fcn.1401dee40
movzx ecx, byte [rdi + 0x11]
test cl, cl
jne 0x1400b5798
mov ecx, dword [rbp + 0x80]
mov dword [rdi + 0x14], 1
mov dword [rdi + 0x18], ecx
test al, al
je 0x1400b5349
add rdi, 0x11
mov r14, rdi
mov rax, qword [rbx]
shl rax, 1
test rax, rax
je 0x1400b5349
call fcn.1401dee40
test al, al
jne 0x1400b5349
mov byte [r14], 1
jmp 0x1400b5349
mov rcx, rsi
call fcn.1401defd0
jmp 0x1400b5355
xor eax, eax
mov qword [rbp + 0x10], rsi
mov byte [rbp + 0x18], al
lea rax, [0x14025f040]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401f3660]
lea r9, fcn.140013a90
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.1401e0290
ud2
xor al, 1
jmp 0x1400b5767