Function at 0x1011214
Capabilities:
Check os version
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x630
mov rax, qword [0x01042480]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x6b8]
mov rbx, rcx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x6c0]
lea rcx, [0x01004b70]
xor edi, edi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x74], edi
call fcn.0100fdd0
lea rcx, [rbx + 0x10]
xor edx, edx
call fcn.0100df30
lea rcx, [rbx + 0x18]
xor edx, edx
mov rsi, rax
mov qword [rsp + 0xa0], rax
call fcn.0100df30
lea rcx, [0x01004bc0]
mov rdx, rsi
mov r8, rax
mov qword [rsp + 0xc0], rax
call fcn.0100fdd0
mov r11d, 0x400
lea rcx, [rdi - 1]
lea eax, [rdi + 4]
mul r11
cmovo rax, rcx
mov rcx, rax
call fcn.010270b8
mov r14, rax
cmp rax, rdi
jne 0x10112e8
xor eax, eax
jmp 0x1011727
mov r8d, 0x1000
mov rdx, rax
mov rcx, rbx
call fcn.01010c00
lea rcx, [0x01004c60]
movsxd r12, eax
mov edx, r12d
call fcn.0100fdd0
cmp r12d, edi
jle 0x101171d
mov qword [rsp + 0x68], rdi
mov r13d, edi
mov rsi, rdi
mov r15d, 1
mov r8d, dword [r14 + rsi*4]
mov edx, r15d
mov ecx, 0x1fffff
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x80], rax
cmp rax, rdi
je 0x101170c
mov r8d, dword [r14 + rsi*4]
lea rcx, [0x01004cf0]
mov edx, r13d
call fcn.0100fdd0
lea r8, [rsp + 0x68]
mov edx, 0x2000f
mov rcx, rbx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x10116ff
cmp qword [rsp + 0x68], rdi
je 0x10116ff
lea rcx, [0x01004da0]
call fcn.0100fdd0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea rcx, [0x01004e20]
call fcn.0100fdd0
cmp dword [rsp + 0x60], edi
jbe 0x10116f4
mov ecx, dword [rsp + 0x60]
call fcn.010270b8
mov r15, rax
cmp rax, rdi
je 0x10116ee
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r8, r15
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, edi
je 0x10116e6
lea rcx, [0x01004ea0]
call fcn.0100fdd0
mov rdx, qword [r15]
mov eax, 0x104
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x410]
lea r8, [rsp + 0x200]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
cmp eax, edi
je 0x10116e6
lea r8, [rsp + 0x410]
lea rdx, [rsp + 0x200]
lea rcx, [0x01004f30]
call fcn.0100fdd0
mov rax, qword [rsp + 0xc0]
mov ebx, edi
cmp word [rax], di
jne 0x10114c2
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x200]
call fcn.01027310
cmp eax, edi
jne 0x10114f5
mov ebx, 1
jmp 0x10114f5
lea rcx, [rsp + 0x410]
mov rdx, rax
call fcn.01027310
cmp eax, edi
jne 0x10114f5
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x200]
call fcn.01027310
cmp eax, edi
mov eax, 1
cmove ebx, eax
lea rcx, [0x01004ff0]
mov edx, ebx
call fcn.0100fdd0
cmp ebx, edi
je 0x10116de
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov r8d, 1
mov rbx, rdi
mov qword [rsp + 0x78], rdi
call sub.USERENV.dll_CreateEnvironmentBlock
lea rcx, [0x01005080]
call fcn.0100fdd0
mov ebp, dword [rsp + 0x74]
cmp qword [rsp + 0x78], rdi
je 0x1011558
mov rbx, qword [rsp + 0x78]
bts ebp, 0xa
lea rcx, [0x01005110]
mov dword [rsp + 0x74], ebp
call fcn.0100fdd0
lea rcx, [rsp + 0xe0]
xor edx, edx
mov r8d, 0x114
call fcn.010328a0
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0xe0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, [0x010051a0]
xor edx, edx
call fcn.0100fdd0
mov rdx, qword [rsp + 0x90]
lea rcx, [0x01005220]
call fcn.0100fdd0
mov edx, dword [r14 + rsi*4]
lea rcx, [0x01005290]
mov r8d, r13d
call fcn.0100fdd0
cmp dword [rsp + 0xe4], 6
ja 0x1011628
jne 0x10115d1
cmp dword [rsp + 0xe8], 2
jae 0x1011628
lea rcx, [0x01005400]
call fcn.0100fdd0
mov rax, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x101169d
lea rcx, [0x01005310]
call fcn.0100fdd0
mov ecx, dword [r14 + rsi*4]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], edi
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [rsp + 0x70]
lea rcx, [0x01005390]
call fcn.0100fdd0
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xd0]
call fcn.0100da30
lea rcx, [rsp + 0xd8]
xor edx, edx
mov rbx, rax
call fcn.0100da30
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0xc8]
mov r9, rbx
mov r8, rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call fcn.01010dbc
mov ebp, eax
cmp eax, edi
je 0x10116b7
lea rcx, [0x010054b0]
call fcn.0100fdd0
mov r13d, r12d
mov rsi, r12
jmp 0x10116cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x10116cf
lea rcx, [0x01005540]
mov edx, eax
call fcn.0100fdd0
mov rcx, qword [rsp + 0x78]
cmp rcx, rdi
je 0x10116de
call sub.USERENV.dll_DestroyEnvironmentBlock
mov rbx, qword [rsp + 0x80]
mov rcx, r15
call fcn.01027054
mov r15d, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, edi
jne 0x101171b
add r13d, r15d
add rsi, r15
cmp r13d, r12d
jl 0x1011325
mov edi, ebp
mov rcx, r14
call fcn.01027054
mov eax, edi
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.01026f20
mov rbx, qword [rsp + 0x678]
add rsp, 0x630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret