Function at 0x14002c680
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x590
mov qword [r11 - 0x4e0], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0xb0], rcx
xor esi, esi
mov qword [rsp + 0x70], rsi
mov qword [r11 - 0x4f8], rsi
mov dword [rsp + 0xc0], WSAGetLastError
xor edx, edx
lea r8d, [rsi + 0x60]
lea rcx, [r11 - 0x4d0]
call fcn.1400a1560
mov qword [rsp + 0x88], rsi
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov r8, rbx
lea rdx, [0x1400ee384]
lea rcx, [rsp + 0x1b0]
call fcn.140030f50
nop
lea r8, [0x1400ee470]
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.140031110
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140031180
nop
mov r8, qword [rsp + 0x1a8]
cmp r8, 8
jb 0x14002c76d
inc r8
mov rdx, qword [rsp + 0x190]
lea rcx, [rsp + 0x190]
call fcn.140008b70
mov qword [rsp + 0x1a8], 7
mov qword [rsp + 0x1a0], rsi
mov word [rsp + 0x190], si
mov r8, qword [rsp + 0x1c8]
cmp r8, 8
jb 0x14002c7af
inc r8
mov rdx, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x1b0]
call fcn.140008b70
mov qword [rsp + 0x1c8], 7
mov qword [rsp + 0x1c0], rsi
mov word [rsp + 0x1b0], si
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x370]
call fcn.1400a1560
mov r8d, 0x104
lea rdx, [rsp + 0x370]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, 0x24
lea rax, str.winsta0default
mov qword [rsp + 0xd0], rax
mov eax, 5
mov word [rsp + 0x100], ax
mov dword [rsp + 0xfc], 1
mov qword [rsp + 0x80], rsi
call fcn.14002da60
mov rax, qword [rax + 8]
test rax, rax
jne 0x14002c84a
mov ebx, esi
jmp 0x14002c84e
call rax
mov ebx, eax
mov dword [rsp + 0x78], ebx
call fcn.14002db10
mov rax, qword [rax + 8]
test rax, rax
je 0x14002cc0e
lea rdx, [rsp + 0x80]
mov ecx, ebx
call rax
test eax, eax
je 0x14002cc0e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14002c90e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str._main__DuplicateTokenEx_failed___error_code___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf26
lea r9, str.execute_without_xp
lea r8, str...includes_sunlogininclude_basepublic_func.cpp
mov edx, 4
lea rcx, [0x1401399a0]
call fcn.14007a380
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14002c8f9
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x60], eax
lea rdx, [0x14012e2b8]
lea rcx, [rsp + 0x60]
call fcn.1400a0dbc
mov r9d, 4
lea r8, [rsp + 0x78]
lea edx, [r9 + 8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x14002c990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str._main__SetTokenInformation_failed___error_code___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf2b
lea r9, str.execute_without_xp
lea r8, str...includes_sunlogininclude_basepublic_func.cpp
mov edx, 4
lea rcx, [0x1401399a0]
call fcn.14007a380
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14002c97b
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x64], eax
lea rdx, [0x14012e2b8]
lea rcx, [rsp + 0x64]
call fcn.1400a0dbc
mov r8d, 1
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x14002c9ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str._main__CreateEnvironmentBlock_Failed__error_code___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf44
lea r9, str.execute_without_xp
lea r8, str...includes_sunlogininclude_basepublic_func.cpp
mov edx, 4
lea rcx, [0x1401399a0]
call fcn.14007a380
jmp 0x14002c9f4
mov edi, 0x424
lea rdx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x260]
call fcn.14002dc90
mov r8, rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x370]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [r8]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
sete bl
lea rax, [rsp + 0x268]
mov rcx, qword [rsp + 0x260]
cmp rcx, rax
je 0x14002ca91
call fcn.1400a24a4
test bl, bl
je 0x14002cbf5
lea rdx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rdx, qword [rsp + 0x130]
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x1d0], rax
mov r8d, 3
lea rcx, [rsp + 0x1d0]
call fcn.140020d50
nop
movaps xmm0, xmmword [rsp + 0x1d0]
movaps xmmword [rsp + 0x260], xmm0
movaps xmm1, xmmword [rsp + 0x1e0]
movaps xmmword [rsp + 0x270], xmm1
movaps xmm0, xmmword [rsp + 0x1f0]
movaps xmmword [rsp + 0x280], xmm0
movaps xmm1, xmmword [rsp + 0x200]
movaps xmmword [rsp + 0x290], xmm1
movaps xmm0, xmmword [rsp + 0x210]
movaps xmmword [rsp + 0x2a0], xmm0
movaps xmm1, xmmword [rsp + 0x220]
movaps xmmword [rsp + 0x2b0], xmm1
movaps xmm0, xmmword [rsp + 0x230]
movaps xmmword [rsp + 0x2c0], xmm0
movaps xmm1, xmmword [rsp + 0x240]
movaps xmmword [rsp + 0x2d0], xmm1
movsd xmm0, qword [rsp + 0x250]
movsd qword [rsp + 0x2e0], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x30], rax
lea rax, str._main__CreateProcessAsUser_failed__command___s__error_code___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf4b
lea r9, str.execute_without_xp
lea r8, str...includes_sunlogininclude_basepublic_func.cpp
mov edx, 4
lea rcx, [0x1401399a0]
call fcn.14007a380
nop
lea rax, [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1d0]
cmp rcx, rax
je 0x14002cbce
call fcn.1400a24a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14002cbe0
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x68], eax
lea rdx, [0x14012e2b8]
lea rcx, [rsp + 0x68]
call fcn.1400a0dbc
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14002cc09
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
jmp 0x14002ce7d
lea rax, str.AlertService_Message
mov qword [rsp + 0x30], rax
lea rax, str.WTSQueryUserToken_failed
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf21
lea r9, str.execute_without_xp
lea r8, str...includes_sunlogininclude_basepublic_func.cpp
mov edx, 4
lea rcx, [0x1401399a0]
call fcn.14007a380
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14002cc5f
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x6c], eax
lea rdx, [0x14012e2b8]
lea rcx, [rsp + 0x6c]
call fcn.1400a0dbc
nop
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x14002ce7b
mov dword [rsp + 0x30], eax
lea rax, str.Run_failed__error__lu_
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf5d
lea r9, str.execute_without_xp
lea r8, str...includes_sunlogininclude_basepublic_func.cpp
mov edx, 4
lea rcx, [0x1401399a0]
call fcn.14007a380
mov qword [rsp + 0x188], 7
xor esi, esi
mov qword [rsp + 0x180], rsi
mov word [rsp + 0x170], si
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rbx, qword [rsp + 0xb0]
mov rdx, rbx
lea rcx, [rsp + 0x170]
call fcn.140008be0
nop
lea rcx, [rsp + 0x170]
cmp qword [rsp + 0x188], 8
cmovae rcx, qword [rsp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov qword [rsp + 0x168], 7
mov qword [rsp + 0x160], rsi
mov word [rsp + 0x150], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x150]
call fcn.140008be0
nop
lea rax, [rsp + 0x170]
cmp qword [rsp + 0x188], 8
cmovae rax, qword [rsp + 0x170]
lea rdx, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae rdx, qword [rsp + 0x150]
cmp qword [rbx + 0x18], 8
jb 0x14002cd90
mov rbx, qword [rbx]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14002ce11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, str.Create_process_failed___d__
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf6f
lea r9, str.execute_without_xp
lea r8, str...includes_sunlogininclude_basepublic_func.cpp
mov edx, 4
lea rcx, [0x1401399a0]
call fcn.14007a380
nop
mov r8, qword [rsp + 0x168]
cmp r8, 8
jb 0x14002ce37
inc r8
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x150]
call fcn.140008b70
mov qword [rsp + 0x168], 7
mov qword [rsp + 0x160], rsi
mov word [rsp + 0x150], si
mov r8, qword [rsp + 0x188]
cmp r8, 8
jb 0x14002ce7d
inc r8
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x170]
call fcn.140008b70
jmp 0x14002ce7d
xor esi, esi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002ce92
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rsi
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14002cebb
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x90], rsi
mov rbx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x148]
test rbx, rbx
je 0x14002cef3
cmp r8, 8
jb 0x14002ceee
inc r8
mov rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x130]
call fcn.140008b70
mov rax, rbx
jmp 0x14002cf13
cmp r8, 8
jb 0x14002cf11
inc r8
mov rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x130]
call fcn.140008b70
xor eax, eax
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.14009d860
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret