Function at 0x10001dae4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get system information on windows
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6c0
and qword [rsp + 0x50], 0
and dword [rax - 0x638], 0
mov r13, rdx
xor edx, edx
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx + 0x60]
lea rcx, [rax - 0x630]
call sub.msvcrt.dll_memset
and qword [rsp + 0x68], 0
xor eax, eax
mov rcx, rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
xor r12d, r12d
xor edi, edi
xor ebp, ebp
xor r14d, r14d
call sub.KERNEL32.dll_GetProcessId
mov ebx, eax
mov dword [rsp + 0x5c], eax
test eax, eax
jne 0x10001db73
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10001df11
call sub.KERNEL32.dll_GetCurrentProcessId
xor ecx, ecx
mov edx, 0x4d0
cmp ebx, eax
mov r8d, 0x1000
sete cl
mov dword [rsp + 0x58], ecx
xor ecx, ecx
lea r9d, [rcx + 4]
call sub.KERNEL32.dll_VirtualAlloc
mov rdi, rax
test rax, rax
jne 0x10001dbab
mov ebx, 0x8007000e
jmp 0x10001df11
and qword [rsp + 0xa8], rbp
mov r15d, 1
mov dword [rsp + 0xa0], 0x18
mov dword [rsp + 0xb0], r15d
call sub.KERNEL32.dll_GetCurrentProcess
mov rbx, rax
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x50]
mov r8, rbx
mov rdx, r13
mov rcx, rax
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x20], ebp
call sub.KERNEL32.dll_DuplicateHandle
mov edx, r15d
neg eax
sbb rcx, rcx
xor r9d, r9d
xor r8d, r8d
and rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0xa0]
call sub.KERNEL32.dll_CreateEventW
xor ebx, ebx
mov r15, rax
cmp rax, rbx
je 0x10001dd9a
cmp rsi, rbx
je 0x10001dd9a
lea r8d, [rbx + 0xc]
lea rdx, [rsp + 0x90]
lea ecx, [rbx + 1]
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, ebx
jl 0x10001dd9a
cmp r13, rbx
je 0x10001dc6f
mov rcx, r13
call sub.KERNEL32.dll_GetThreadId
mov dword [rsp + 0x138], eax
jmp 0x10001dc76
mov dword [rsp + 0x138], ebx
movzx eax, word [rsp + 0x90]
mov r13, qword [rsp + 0x700]
mov dword [rsp + 0x130], 0x28
mov dword [rsp + 0x134], eax
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x13c], ebx
mov qword [rsp + 0x140], rax
cmp dword [rsp + 0x58], ebx
jne 0x10001dd78
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x590
mov rcx, r13
mov dword [rsp + 0x20], 4
call sub.KERNEL32.dll_VirtualAllocEx
mov rbp, rax
cmp rax, rbx
je 0x10001dda2
lea rcx, [rsp + 0x158]
mov rdx, rsi
mov r8d, 0x98
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x718]
lea rcx, [rsp + 0x1f0]
mov r8d, 0x4d0
call sub.msvcrt.dll_memcpy
lea r11, [rsp + 0x130]
mov rcx, rbp
sub rcx, r11
mov esi, 0x590
lea r8, [rsp + 0x130]
lea rax, [rsp + rcx + 0x158]
mov qword [rsp + 0x60], rcx
mov r9, rsi
mov qword [rsp + 0x148], rax
lea rax, [rsp + rcx + 0x1f0]
mov rdx, rbp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x60]
mov rcx, r13
mov qword [rsp + 0x20], rax
call sub.KERNEL32.dll_WriteProcessMemory
cmp eax, ebx
je 0x10001dda2
cmp qword [rsp + 0x60], rsi
jne 0x10001dda2
mov r14, rbp
jmp 0x10001dda2
mov rax, qword [rsp + 0x718]
mov qword [rsp + 0x148], rsi
lea r14, [rsp + 0x130]
mov qword [rsp + 0x150], rax
jmp 0x10001dda2
mov r13, qword [rsp + 0x700]
mov rbx, qword [rsp + 0x720]
cmp word [rbx], 0x22
je 0x10001ddf3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
cmp eax, 5
jne 0x10001ddf3
lea rsi, [rdi + 0x286]
lea r8, [0x100003e70]
mov r9d, 0x7ffe0030
mov edx, 0x125
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call fcn.10000b314
mov ebx, eax
test eax, eax
jns 0x10001ddf6
lea rdx, [0x100003e90]
jmp 0x10001de24
mov rsi, rbx
mov r9d, dword [rsp + 0x5c]
mov r8, rsi
mov edx, 0x143
mov rcx, rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.10000b314
xor esi, esi
cmp eax, esi
mov ebx, eax
jge 0x10001de33
lea rdx, [0x100003ee0]
mov r8d, eax
xor ecx, ecx
call fcn.10001da04
jmp 0x10001def8
call sub.ntdll.dll_RtlGetCurrentTransaction
xor ecx, ecx
mov r12, rax
call sub.ntdll.dll_RtlSetCurrentTransaction
lea rax, [0x100001a00]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x68]
mov r14d, 1
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0xc0], 0x68
mov dword [rsp + 0x20], r14d
call sub.KERNEL32.dll_CreateProcessW
cmp eax, esi
je 0x10001def8
cmp r15, rsi
je 0x10001def8
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], rax
and qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x80]
mov r9b, r14b
mov r8d, r14d
mov ecx, 2
call qword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0xc0
je 0x10001deba
cmp eax, 0x101
je 0x10001deba
cmp eax, r14d
jne 0x10001def2
mov ebx, 0x8000ffff
jmp 0x10001def8
neg eax
sbb eax, eax
and ebx, eax
test rbp, rbp
je 0x10001df11
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
call sub.KERNEL32.dll_VirtualFreeEx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x10001df26
call sub.KERNEL32.dll_CloseHandle
and qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x10001df35
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x10001df44
call sub.KERNEL32.dll_CloseHandle
test r12, r12
je 0x10001df59
mov rcx, r12
call sub.ntdll.dll_RtlSetCurrentTransaction
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
test rdi, rdi
je 0x10001df6e
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call sub.KERNEL32.dll_VirtualFree
mov eax, ebx
mov rbx, qword [rsp + 0x708]
add rsp, 0x6c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret