Function at 0x140005470
Capabilities:
Check os version
Create process on windows

Disassembly:
push rsi
sub rsp, 0x240
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rsi, rcx
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x100], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x104], 5
jne 0x1400054c8
cmp dword [rsp + 0x108], 0
jne 0x1400054c8
mov rcx, rsi
call fcn.1400053c0
jmp 0x140005754
lea rcx, str.Kernel32.dll
mov qword [rsp + 0x258], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rbx, rax
je 0x140005503
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000550d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x4005
jmp 0x14000574c
mov qword [rsp + 0x260], rbp
mov qword [rsp + 0x238], rdi
call rax
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.Wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
je 0x14000555d
lea rdx, str.WTSQueryUserToken
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140005567
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x4005
jmp 0x14000573c
mov qword [rsp + 0x230], r12
lea rdx, [rsp + 0x60]
xor r12d, r12d
mov ecx, ebp
mov qword [rsp + 0x60], r12
call rax
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x14000559a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140005734
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov r9d, 1
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x68], r12
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400055ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
mov ebx, eax
je 0x1400055e6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140005734
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x70], r12
mov ebx, gethostbyname
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
mov ecx, 0x430
cmovne ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x68]
call fcn.1400cb010
mov rcx, qword [rsp + 0x68]
lea rax, str.winsta0default
mov qword [rsp + 0xa0], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov r8, rsi
xor edx, edx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x90], WSAGetLastError
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400056df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
mov ebx, eax
je 0x1400056bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400056cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400056db
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, ebx
jmp 0x140005734
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400056ef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140005702
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140005712
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140005722
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005732
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
xor eax, eax
mov r12, qword [rsp + 0x230]
mov rbp, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400caf00
add rsp, 0x240
pop rsi
ret