Function at 0x100244d0
Capabilities:
Create process on windows
Enumerate processes
Query environment variable

Disassembly:
mov eax, 0x2ee8
call fcn.10044fd0
sub rsp, rax
mov rax, qword [0x1005d650]
mov qword [rsp + 0x2e90], rax
mov qword [rsp + 0x2ed0], rsi
mov qword [rsp + 0x2ec8], rdi
mov qword [rsp + 0x2ec0], r12
xor esi, esi
mov byte [rsp + 0x61], r8b
mov rdi, rcx
mov byte [rsp + 0x60], dl
mov qword [rsp + 0x2eb8], r13
lea r8d, [rsi + 0x60]
lea rcx, [rsp + 0xd8]
xor edx, edx
mov qword [rsp + 0x2eb0], r14
mov qword [rsp + 0x2ea8], r15
mov r12, r9
mov dword [rsp + 0xd0], esi
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x691]
xor edx, edx
mov r8d, 0x27ff
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov r14, rsi
mov r13d, esi
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x690], al
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x88]
mov rdx, rdi
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rcx, [rsp + 0x291]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x290], sil
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x290]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea rcx, [rsp + 0x88]
mov r8, qword [r8]
xor edx, edx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
lea rdx, str.userenv.dll
mov r15, rsi
test rdx, rdx
je 0x1002464b
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1002464b
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
mov qword [rsp + 0x2ee0], rbx
mov qword [rsp + 0x2ed8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, r15
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov ebp, esi
lea ecx, [rdx + 0xa]
mov qword [rsp + 0xc0], rax
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x10024b20
lea rdx, [rsp + 0x160]
mov rcx, rax
mov dword [rsp + 0x160], 0x130
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x10024709
nop
nop
nop
nop
lea rdx, [rsp + 0x18c]
lea rcx, [0x1004b790]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10024700
lea rdx, [rsp + 0x160]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x100246d0
jmp 0x10024709
mov ebp, dword [rsp + 0x168]
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x10024b20
mov r8d, ebp
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r14, rax
jne 0x1002477a
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004b7a0]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.100277d0
lea rdx, str._comm__createProcessAsUser__s__OpenProcess_explorer__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.100278d0
jmp 0x10024ca2
lea r8, [rsp + 0x70]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100247d9
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004b7f8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.100277d0
lea rdx, str._comm__createProcessAsUser__s__OpenProcessToken_explorer__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.100278d0
jmp 0x10024ca2
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
mov r9d, 1
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp byte [rsp + 0x61], sil
je 0x1002483e
mov word [rsp + 0x110], 5
mov dword [rsp + 0x10c], 1
jmp 0x10024875
mov dword [rsp + 0xf0], 0xffffff9c
mov dword [rsp + 0xf4], 0xffffff9c
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0xfc], esi
mov word [rsp + 0x110], si
mov dword [rsp + 0x10c], 7
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
xor r8d, r8d
call qword [rsp + 0x68]
test eax, eax
je 0x10024ad8
mov r8, qword [rsp + 0x78]
mov r9d, esi
mov rax, r8
nop
nop
cmp word [rax], si
jne 0x100248ab
cmp word [rax + 2], si
je 0x100248b4
inc r9d
add rax, 2
jmp 0x100248a0
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x690]
mov qword [rsp + 0x30], rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x2800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call fcn.10027250
test al, al
je 0x10024967
mov edx, esi
mov rax, rsi
nop
cmp byte [rsp + rax + 0x690], sil
jne 0x10024904
cmp byte [rsp + rax + 0x691], sil
je 0x10024911
inc rax
inc edx
cmp rax, 0x2800
jl 0x100248f0
lea r8, str.CommonProgramFiles_x86_
lea rcx, [rsp + 0x690]
call fcn.100227c0
lea r8, str.CommonProgramW6432
lea rcx, [rsp + 0x690]
mov edx, eax
call fcn.100227c0
lea r8, [0x1004b9a0]
lea rcx, [rsp + 0x690]
mov edx, eax
call fcn.100227c0
lea r8, str.ProgramW6432
lea rcx, [rsp + 0x690]
mov edx, eax
call fcn.100227c0
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x140]
test rdx, rdx
cmove rdx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.100225d0
mov rcx, qword [rsp + 0x80]
mov r8, qword [rax + 8]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd0]
test r8, r8
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x690]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc000030
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
lea rcx, [rsp + 0x140]
mov edi, eax
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
test edi, edi
je 0x10024a78
mov rax, qword [rsp + 0xa8]
cmp rax, 0xffffffffffffffff
je 0x10024a78
test r12, r12
mov rsi, qword [rsp + 0xb8]
je 0x10024a1e
mov dword [r12], esi
mov qword [r12 + 8], rax
mov rdi, qword [rsp + 0x90]
lea rdx, [0x1004b9c8]
lea rcx, [rsp + 0x68]
test rdi, rdi
cmove rdi, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.100277d0
mov r9d, dword [rsp + 0xb8]
lea rdx, str._comm__createProcessAsUser__s__successed__pid_d
mov rcx, rax
mov r8, rdi
call fcn.100278d0
cmp byte [rsp + 0x60], r13b
je 0x10024abb
mov rcx, qword [rsp + 0xa8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10024abb
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004ba08]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.100277d0
lea rdx, str._comm__createProcessAsUser__s__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.100278d0
mov rcx, qword [rsp + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x10024ca2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10024ca2
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004ba40]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.100277d0
lea rdx, str._comm__createProcessAsUser__d__CreateEnvironmentBlock_failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.100278d0
jmp 0x10024ca2
lea rdx, [0x1004b848]
mov rbp, rsi
test rdx, rdx
je 0x10024b51
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10024b51
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
lea rdx, str.wtsapi32.dll
mov r12, rsi
test rdx, rdx
je 0x10024b82
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10024b82
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
lea rdx, [0x1004b868]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQueryUserToken
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rbx, rbx
mov rdi, rax
je 0x10024c12
call rbx
cmp eax, 0xffffffff
mov r13d, eax
jne 0x10024c12
mov rdi, qword [rsp + 0x90]
lea rdx, [0x1004b8a0]
lea rcx, [rsp + 0x68]
test rdi, rdi
cmove rdi, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.100277d0
lea rdx, str._comm__createProcessAsUser__s__failed:_No_session_attached_to_the_console__WTSGetActiveConsoleSessionId_failed_
mov rcx, rax
mov r8, rdi
call fcn.100278d0
test r12, r12
je 0x10024bfb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10024ca2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10024ca2
test rdi, rdi
je 0x10024c86
lea rdx, [rsp + 0x70]
mov ecx, r13d
call rdi
test eax, eax
jne 0x10024c86
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004b928]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.100277d0
lea rdx, str._comm__createProcessAsUser__s__WTSQueryUserToken_failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.100278d0
test r12, r12
je 0x10024c76
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10024ca2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10024ca2
test r12, r12
je 0x10024c94
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10024ca2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x2eb8]
mov r12, qword [rsp + 0x2ec0]
test rcx, rcx
mov rdi, qword [rsp + 0x2ec8]
mov rbp, qword [rsp + 0x2ed8]
mov rbx, qword [rsp + 0x2ee0]
je 0x10024cdb
call qword [rsp + 0xc0]
test r14, r14
je 0x10024ce9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x2eb0]
test rcx, rcx
je 0x10024d01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x10024d14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x10024d22
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov r15, qword [rsp + 0x2ea8]
mov eax, esi
mov rsi, qword [rsp + 0x2ed0]
mov rcx, qword [rsp + 0x2e90]
call fcn.10044fa0
add rsp, 0x2ee8
ret