Function at 0x140100b20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor eax, eax
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x60], ecx
lea rdx, [rsp + 0x112]
mov r8d, 0x400
xor ecx, ecx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x22
lea ecx, [rax + 1]
mov word [rsp + 0x110], r8w
mov edi, 0x20
mov word [rsp + rcx*2 + 0x110], r8w
lea ecx, [rax + 2]
mov eax, eax
add rax, rax
mov word [rsp + rcx*2 + 0x110], di
sub rax, rbx
lea rcx, [rsp + rax + 0x116]
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x140100bd0
xor edx, edx
lea rcx, [rsp + 0xa0]
lea r8d, [rdx + 0x68]
call fcn.1401e6750
lea rax, str.winsta0default
mov dword [rsp + 0xa0], WSASetLastError
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov rcx, rax
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140100c57
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140100c50
lea r9, str.OpenProcessToken_err
lea rdx, str..Service.cpp
lea ecx, [rax + 3]
mov r8d, 0x3d6
call fcn.1400045f0
xor eax, eax
jmp 0x140100e3c
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140100cc1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140100c93
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140100cba
lea r9, str.DuplicateTokenEx_err
lea rdx, str..Service.cpp
mov r8d, 0x3dd
mov ecx, 3
call fcn.1400045f0
xor eax, eax
jmp 0x140100e3c
mov rcx, qword [rsp + 0x70]
mov r9d, 4
lea r8, [rsp + 0x60]
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x140100d2d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140100cef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140100cff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x140100d26
lea r9, str.SetTokenInformation_err
lea rdx, str..Service.cpp
mov r8d, 0x3e5
mov ecx, 3
call fcn.1400045f0
xor eax, eax
jmp 0x140100e3c
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov r8d, 1
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ecx, 0x420
mov ebx, esi
test eax, eax
cmovne edi, ecx
nop
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x110]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140100de9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe9
jne 0x140100dd3
mov rcx, qword [rsp + 0x70]
mov r9d, 4
lea r8, [rsp + 0x60]
lea edx, [r9 + 8]
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x140100de9
jmp 0x140100dde
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 5
jl 0x140100d50
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140100df9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140100e09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140100e24
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], rsi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140100e34
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1401e6720
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret