Function at 0x100047ba
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov qword [rsp + 0xa0], r9
mov rsi, r8
mov r12, rdx
mov qword [rsp + 0x90], rcx
mov r14, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x160]
test rdi, rdi
je 0x10004800
mov rdi, qword [rsp + 0x168]
mov r15, qword [rsp + 0x190]
mov cl, byte [rsp + 0x180]
test r14, r14
je 0x1000481c
mov r14, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x1a0]
mov r13, qword [rsp + 0x1a8]
call fcn.100098f5
mov ebp, eax
test r15, r15
je 0x10004840
mov r15, qword [rsp + 0x198]
mov rcx, rbx
mov rdx, r13
call fcn.1000aaf4
mov rbx, qword [rsp + 0x1b8]
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
mov rcx, r12
mov rdx, rsi
mov r8, qword [rsp + 0xa0]
mov r9, rdi
call sub.advapi32.dll_CreateProcessAsUserW
mov qword [rsp + 0xa8], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
test eax, eax
je 0x100049d3
mov qword [rsp + 0x78], 8
movups xmmword [rsp + 0x80], xmm0
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x60]
call fcn.10003f20
mov rsi, qword [rsp + 0x90]
cmp qword [rsp + 0x60], 0
je 0x1000490a
mov rax, qword [rsp + 0x70]
lea rdx, [rsp + 0xc0]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x78]
call fcn.10003e96
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
call fcn.10003f20
cmp qword [rsp + 0x60], 0
je 0x10004942
mov rax, qword [rsp + 0x70]
lea rdx, [rsp + 0xc0]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x78]
call fcn.10003e96
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.10003f20
cmp qword [rsp + 0x60], 0
je 0x1000497a
mov rax, qword [rsp + 0x70]
lea rdx, [rsp + 0xc0]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x78]
call fcn.10003e96
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x10004aae
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], 1
lea r9, str._nUnable_to_duplicate_token:
lea rcx, [rsp + 0xc0]
call fcn.1002887c
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x78]
call fcn.10003dd3
jmp 0x10004abc
call fcn.10003d0c
mov rsi, qword [rsp + 0x90]
lea rbx, [rsp + 0x98]
mov qword [rbx], rax
lea rdi, [rsp + 0x78]
mov qword [rdi], rbx
lea r14, str.Unable_to_create_process:
lea rdx, [rsp + 0xc0]
mov qword [rdx], r14
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x10], 0
lea rbp, [0x1007e810]
mov qword [rdi + 8], rbp
mov qword [rdx + 0x20], rdi
mov qword [rdx + 0x28], rax
lea rcx, [rsp + 0x60]
call fcn.10003e10
movups xmm0, xmmword [rsp + 0x60]
lea rdx, [rsp + 0xc0]
movaps xmmword [rdx], xmm0
mov rax, qword [rsp + 0x70]
mov qword [rdx + 0x10], rax
lea rcx, [rsp + 0xa8]
call fcn.10003e96
lea rdx, [rsp + 0xc0]
mov qword [rdx], r14
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x10], 0
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
mov qword [rdx + 0x20], rdi
mov qword [rdx + 0x28], rax
lea rcx, [rsp + 0x60]
call fcn.10003e10
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x98]
call fcn.10003d5a
jmp 0x10004abc
and qword [rsi], 0
lea rcx, [rsp + 0x78]
call fcn.10003dd3
lea rcx, [rsp + 0xa8]
call fcn.10003dd3
mov rax, rsi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret