Function at 0x100020d7
Capabilities:
Create process on windows
Get process heap flags
Get windows directory from kuser_shared_data
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5bc
push ebx
xor ebx, ebx
mov dword [esp + 0x30], 0x1000
cmp dword [ebp + 0xc], 1
push esi
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jne 0x1000240b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov esi, 0x100
lea eax, [esp + 0xb0]
mov ecx, esi
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x1000211d
lea edx, [esp + 0xb0]
mov ecx, 0x3066
call fcn.10001255
mov edx, str.Sessions_
lea ecx, [esp + 0x1b0]
call fcn.10001b0a
mov edx, ecx
cmp word [esp + 0x1b0], bx
je 0x1000215b
add edx, 2
cmp word [edx], bx
jne 0x10002153
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov ecx, dword [ecx + 0x1d4]
call fcn.100010ec
mov edx, str.BaseNamedObjects_
lea ecx, [esp + 0x1b0]
call fcn.10001a58
lea edx, [esp + 0xb0]
lea ecx, [esp + 0x1b0]
call fcn.10001a58
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [esp + 0x1b0]
push eax
lea eax, [esp + 0x44]
push eax
call edi
lea eax, [esp + 0x40]
mov dword [esp + 0x20], 0x18
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 0xf001f
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], ebx
push eax
mov dword [esp + 0x38], 0x40
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ntdll.dll_NtOpenSection]
test eax, eax
js 0x1000240b
push 4
push 0x100000
push 2
lea eax, [esp + 0x44]
push eax
push ebx
push 0x1000
push ebx
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push dword [esp + 0x3c]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x10002401
mov edx, dword [esp + 0x10]
test edx, edx
je 0x10002401
mov ecx, 0x20a
lea eax, [esp + 0x3b8]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x1000222f
push ecx
lea eax, [edx + 4]
push eax
lea ecx, [esp + 0x3c0]
call fcn.10001b55
add esp, 8
lea eax, [esp + 0xb0]
mov byte [eax], bl
inc eax
sub esi, 1
jne 0x10002252
mov edx, str.BaseNamedObjects_
lea ecx, [esp + 0x1b0]
call fcn.10001b0a
lea edx, [esp + 0xb0]
mov ecx, 0x3166
call fcn.10001255
lea edx, [esp + 0xb0]
lea ecx, [esp + 0x1b0]
call fcn.10001a58
lea eax, [esp + 0x1b0]
push eax
lea eax, [esp + 0x44]
push eax
call edi
lea eax, [esp + 0x40]
mov dword [esp + 0x20], 0x18
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push 2
lea eax, [esp + 0x1c]
mov dword [esp + 0x2c], ebx
push eax
mov dword [esp + 0x38], 0x40
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.ntdll.dll_NtOpenEvent]
test eax, eax
js 0x100023f5
mov ecx, 0x10007040
mov edx, 0x834
mov eax, ecx
mov byte [eax], bl
inc eax
sub edx, 1
jne 0x100022e8
call fcn.100013ad
mov dword [esp + 0x3c], eax
test eax, eax
je 0x1000230f
mov edi, 0x1000704c
mov ecx, edi
call fcn.10001b3b
mov esi, eax
add esi, esi
jmp 0x10002313
mov edi, ebx
mov esi, ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
lea eax, [esp + 0x50]
push str.windir
push eax
call ebx
test eax, eax
js 0x1000234e
push 0x7ffe0030
lea eax, [esp + 0x4c]
push eax
call ebx
xor ebx, ebx
test eax, eax
js 0x10002350
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x54]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlSetEnvironmentVariable]
jmp 0x10002350
xor ebx, ebx
mov edx, esi
mov ecx, edi
call fcn.10001630
test eax, eax
je 0x10002367
mov eax, dword [esp + 0x10]
mov dword [eax], 1
push 0x44
pop edx
mov ecx, edx
lea eax, [esp + 0x68]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10002370
push 0x32
pop eax
mov word [esp + 0x1c], ax
xor eax, eax
mov word [esp + 0x1e], ax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], edx
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x3dc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100023cf
push dword [esp + 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x58]
call esi
mov eax, dword [esp + 0x10]
or dword [eax], 2
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtSetEvent]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esp + 0x3c], 0
je 0x100023f5
mov ecx, 0x1000766a
call fcn.100014f1
push dword [esp + 0x10]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
push dword [esp + 0x18]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc