Function at 0x140026ee0
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x140026ee0
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2b0
mov rdi, rsp
mov ecx, 0xac
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c0]
mov qword [rsp + 0x290], 0xfffffffffffffffe
mov rax, qword [0x1402840e8]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
mov rcx, qword [rsp + 0x2c0]
call fcn.14000179e
movzx eax, al
test eax, eax
je 0x140026f4c
xor al, al
jmp 0x1400274a2
lea rdx, [0x1401e1778]
lea rcx, [rsp + 0x68]
call fcn.140001faa
nop
call fcn.140004642
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140003166
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x68]
call fcn.1400073ce
cmp qword [rsp + 0x60], 0
jne 0x140026f8e
xor al, al
jmp 0x1400274a2
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
lea rdx, [0x1401e1798]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x98], rax
lea rdx, [0x1401e17b0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x90], rax
lea rdx, str.CreateProcessAsUserW
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa0], rax
lea rdx, [0x1401e17d8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0x98], 0
je 0x140027052
cmp qword [rsp + 0x90], 0
je 0x140027052
cmp qword [rsp + 0xa0], 0
je 0x140027052
cmp qword [rsp + 0xa8], 0
jne 0x140027059
xor al, al
jmp 0x1400274a2
mov edx, 8
lea rcx, [rsp + 0xb8]
call fcn.1400075a4
lea rcx, [rsp + 0xb8]
call fcn.140003b84
nop
mov qword [rsp + 0xd8], 0
mov dword [rsp + 0xf4], 0xffffffff
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xb8]
call fcn.14000567d
movzx eax, al
test eax, eax
jne 0x1400270d6
mov byte [rsp + 0x288], 0
lea rcx, [rsp + 0xb8]
call fcn.140008247
movzx eax, byte [rsp + 0x288]
jmp 0x1400274a2
cmp qword [rsp + 0xd8], 0
je 0x1400270eb
cmp dword [rsp + 0xf4], 0xffffffff
jne 0x140027132
cmp qword [rsp + 0xd8], 0
je 0x140027110
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd8], 0
mov byte [rsp + 0x289], 0
lea rcx, [rsp + 0xb8]
call fcn.140008247
movzx eax, byte [rsp + 0x289]
jmp 0x1400274a2
mov qword [rsp + 0x118], 0
lea r8, [rsp + 0x118]
movzx edx, byte [rsp + 0x2d0]
mov rcx, qword [rsp + 0xd8]
call fcn.1400025fe
movzx eax, al
test eax, eax
jne 0x14002719e
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd8], 0
mov byte [rsp + 0x28a], 0
lea rcx, [rsp + 0xb8]
call fcn.140008247
movzx eax, byte [rsp + 0x28a]
jmp 0x1400274a2
mov r9d, 4
lea r8, [rsp + 0xf4]
mov edx, 0xc
mov rcx, qword [rsp + 0x118]
call qword [rsp + 0xa8]
mov qword [rsp + 0x138], 0
lea rdx, [rsp + 0x138]
mov rcx, qword [rsp + 0x118]
call fcn.1400042f5
lea rax, [rsp + 0x160]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x1e8]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x160], 0x68
lea rax, str.WinSta0Default
mov qword [rsp + 0x170], rax
mov eax, 1
mov word [rsp + 0x1a0], ax
mov dword [rsp + 0x19c], 0x81
mov r8, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x218]
call fcn.1400287b0
nop
mov dword [rsp + 0x244], 0
mov rcx, qword [rsp + 0x118]
call qword [rsp + 0x98]
test eax, eax
je 0x140027379
lea rcx, [rsp + 0x218]
call fcn.140004fac
mov qword [rsp + 0x298], rax
mov rcx, qword [rsp + 0x2c0]
call fcn.140004fac
lea rcx, [rsp + 0x1e8]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x138]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x430
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x298]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x118]
call qword [rsp + 0xa0]
mov dword [rsp + 0x244], eax
cmp dword [rsp + 0x244], 0
je 0x140027328
mov rax, qword [rsp + 0x2d8]
mov ecx, dword [rsp + 0x1f8]
mov dword [rax], ecx
cmp qword [rsp + 0x1f0], 0
je 0x14002734d
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x1f0], 0
cmp qword [rsp + 0x1e8], 0
je 0x140027372
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x1e8], 0
call qword [rsp + 0x90]
cmp qword [rsp + 0x118], 0
je 0x14002739e
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x118], 0
cmp qword [rsp + 0xd8], 0
je 0x1400273c3
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd8], 0
cmp qword [rsp + 0x138], 0
je 0x140027454
lea rdx, [0x1401e1810]
lea rcx, [rsp + 0x250]
call fcn.140001faa
nop
call fcn.140004642
lea rdx, [rsp + 0x250]
mov rcx, rax
call fcn.140003166
mov qword [rsp + 0x248], rax
lea rcx, [rsp + 0x250]
call fcn.1400073ce
mov qword [rsp + 0x278], 0
lea rdx, str.DestroyEnvironmentBlock
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x278], rax
cmp qword [rsp + 0x278], 0
je 0x140027454
mov rcx, qword [rsp + 0x138]
call qword [rsp + 0x278]
cmp dword [rsp + 0x244], 0
je 0x140027468
mov byte [rsp + 0x2a0], 1
jmp 0x140027470
mov byte [rsp + 0x2a0], 0
movzx eax, byte [rsp + 0x2a0]
mov byte [rsp + 0x28b], al
lea rcx, [rsp + 0x218]
call fcn.1400073ce
nop
lea rcx, [rsp + 0xb8]
call fcn.140008247
movzx eax, byte [rsp + 0x28b]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1401e22c0]
call fcn.14000849f
mov rax, rdi
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.1400030d0
add rsp, 0x2b0
pop rdi
ret