Function at 0x1400250f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, r8
mov rbx, rdx
mov r13, rcx
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x1400255a2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [0x1400f5fd8]
mov rsi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x14002516a
movzx edx, dx
lea rcx, [rsp + 0x70]
call fcn.14000d4c0
jmp 0x140025188
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140025170
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.14000fd40
nop
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x1400255ad
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, [0x1400f5fe0]
cmp rdx, 0x10000
jae 0x1400251c7
movzx edx, dx
lea rcx, [rsp + 0x68]
call fcn.14000d4c0
jmp 0x1400251e8
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400251d0
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.14000fd40
nop
mov r8, rbx
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.14001c5a0
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001c5a0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14001c5a0
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002523a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140025258
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140025277
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140025295
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r14d, r14d
mov word [rsp + 0x60], r14w
mov rax, qword [rbp - 0x80]
mov ecx, dword [rax - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rbp + 0x98]
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.14001c400
nop
mov rcx, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400252d0
mov qword [rsp + 0x78], r14
xor r8d, r8d
mov rdx, r13
lea rcx, [rsp + 0x78]
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x140025304
xor r12b, r12b
jmp 0x140025513
mov r12b, 1
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x20]
call fcn.1400aeef0
mov dword [rbp - 0x20], 0x68
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov dword [rbp + 0x1c], 1
mov eax, 5
mov word [rbp + 0x20], ax
lea rax, str.Winsta0Default
mov qword [rbp - 0x10], rax
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.1400adf44
mov r15, qword [rbx]
test rax, rax
jne 0x14002535f
mov eax, esi
jmp 0x140025365
sub rax, r15
sar rax, 1
test eax, eax
cmovns r14d, eax
cmp r14d, dword [r15 - 0x10]
jl 0x1400253f6
lea rbx, [r15 - 0x18]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x1400253a8
cmp rax, qword [rbx]
jne 0x1400253a8
lock inc dword [rbx + 0x10]
mov rdi, qword [rbp - 0x48]
add rbx, 0x18
mov qword [rbp - 0x68], rbx
xor r14d, r14d
jmp 0x14002548b
lea r14, [rbx + 8]
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [r14]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x1400255b8
mov eax, dword [r14]
mov dword [rbx + 8], eax
mov eax, dword [r14]
inc eax
movsxd rdx, eax
add rdx, rdx
lea rcx, [rbx + 0x18]
mov r9, rdx
mov r8, r15
call fcn.140018b60
add rbx, 0x18
mov qword [rbp - 0x68], rbx
xor r14d, r14d
jmp 0x14002548b
mov rcx, qword [r15 - 0x18]
test rcx, rcx
je 0x14002540d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14002541e
call fcn.14000ce10
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
mov r15, qword [rbx]
test rcx, rcx
je 0x1400255be
test r15, r15
jne 0x140025438
test r14d, r14d
jne 0x1400255c9
mov rax, qword [rcx]
mov r8d, 2
mov edx, r14d
call qword [rax]
test rax, rax
je 0x1400255d4
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
test r14d, r14d
js 0x140025597
cmp r14d, dword [rbx - 0xc]
jg 0x140025597
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
lea rdx, [rax + rax]
xor r14d, r14d
mov word [rdx + rbx], r14w
mov r9, rdx
mov r8, r15
mov rcx, rbx
call fcn.140018b60
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400254d8
xor r12b, r12b
jmp 0x1400254ec
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call sub.USERENV.dll_DestroyEnvironmentBlock
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002550f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rbp - 0x48]
test rdi, rdi
je 0x140025550
mov rax, qword [rbp - 0x38]
sub rax, rdi
sar rax, 1
lea rdx, [rax + rax]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140025547
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025591
mov rcx, rdi
call fcn.1400a7308
nop
mov rax, qword [rbp - 0x80]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14002556c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, r12b
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400b7964
nop
mov ecx, 0x80070057
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
mov ecx, 0x80004005
call fcn.14000c310
nop
call fcn.140010030
int3
mov ecx, 0x80004005
call fcn.14000c310
int3
mov ecx, 0x80070057
call fcn.14000c310
int3
call fcn.140010030
int3