Function at 0x140011357
Capabilities:
Create process on windows
Create process suspended

Disassembly:
jmp 0x140011f00
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0x10808
call fcn.1400110af
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x406a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x10828]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x10798], rax
lea rcx, [0x1400250a6]
call fcn.1400113f2
mov dword [rbp + 0x10124], 0
mov dword [rbp + 0x10144], 0
mov dword [rbp + 0x10164], 0
xor ecx, ecx
call fcn.1400110b9
lea r8, [rbp + 0xe4]
lea rdx, [rbp + 0xc4]
mov ecx, dword [rbp + 0x107c0]
call fcn.1400110fa
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 8]
call fcn.140011311
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.140011311
call fcn.14001139d
test eax, eax
je 0x140012007
lea r8, [rbp + 0x10124]
lea rdx, [rbp + 0x110]
mov ecx, dword [rbp + 0x107c0]
call fcn.1400113e3
cmp dword [rbp + 0x10124], 1
jae 0x140011ffb
mov edx, dword [rbp + 0x107c0]
lea rcx, str.No_token_handles_found_in_process__d__cant_use_CreateProcessWithToken__._Reverting_to_CreateProcessWithLogon__..._n
call fcn.1400111c2
mov dword [rbp + 0x10144], 0
jmp 0x140012005
mov dword [rbp + 0x10144], 1
jmp 0x14001201d
lea rcx, str.Impersonation_privileges_not_available__cant_use_CreateProcessWithToken__._Reverting_to_CreateProcessWithLogon__..._n
call fcn.1400111c2
mov dword [rbp + 0x10144], 0
cmp dword [rbp + 0x10144], 0
je 0x1400120ee
mov dword [rbp + 0x10184], 0
jmp 0x140012044
mov eax, dword [rbp + 0x10184]
inc eax
mov dword [rbp + 0x10184], eax
mov eax, dword [rbp + 0x10124]
cmp dword [rbp + 0x10184], eax
jae 0x1400120b0
mov eax, dword [rbp + 0x10184]
lea rcx, [rbp + 8]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x107c8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + rax*8 + 0x110]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x1400120ae
mov dword [rbp + 0x10164], 1
jmp 0x1400120b0
jmp 0x140012036
cmp dword [rbp + 0x10164], 0
je 0x1400120d5
mov r8d, dword [rbp + 0x107c0]
mov rdx, qword [rbp + 0x107c8]
lea rcx, str.Spoofed_process__S_created_correctly_as_child_of_PID__d_using_CreateProcessWithTokenW___
call fcn.1400111c2
jmp 0x1400120e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessWithTokenW___failed_with_error_code__d__n
call fcn.1400111c2
jmp 0x140012184
lea rax, [rbp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rbp + 0x107c8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, str.MalseclogonPwd
lea rdx, str.MalseclogonDomain
lea rcx, str.MalseclogonUser
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x14001216a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessWithLogonW___failed_with_error_code__d__n
call fcn.1400111c2
jmp 0x140012184
mov r8d, dword [rbp + 0x107c0]
mov rdx, qword [rbp + 0x107c8]
lea rcx, str.Spoofed_process__S_created_correctly_as_child_of_PID__d_using_CreateProcessWithLogonW___
call fcn.1400111c2
mov edx, dword [rbp + 0xe4]
mov ecx, dword [rbp + 0xc4]
call fcn.14001113b
lea rcx, [rbp - 0x60]
lea rdx, [0x14001c3b0]
call fcn.140011366
mov rcx, qword [rbp + 0x10798]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x107a8]
pop rdi
pop rbp
ret