Function at 0x100020838
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x100036110]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rsi, rcx
lea rcx, [r11 - 0x226]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x100], bp
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call fcn.10002061c
cmp eax, ebp
mov ebx, eax
jge 0x1000208b9
mov r9d, eax
lea r8, [0x1000031f0]
mov edx, 0x655
lea rdi, [0x100003218]
jmp 0x100020ab8
xor edx, edx
lea ebx, [rdx + 2]
mov ecx, ebx
call qword [0x1000368d0]
lea rdi, [0x100003218]
cmp eax, ebp
jne 0x1000208e5
lea r8, [0x100003240]
mov edx, 0x65a
mov rcx, rdi
call fcn.1000267e8
cmp rsi, rbp
jne 0x100020923
mov rcx, qword [0x100036218]
mov r8d, ebx
xor edx, edx
call qword [0x1000368c8]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jge 0x100020ac2
lea r8, [0x100003270]
mov edx, 0x665
jmp 0x100020ace
mov ebx, 0x104
lea rcx, [rsp + 0x100]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebp
je 0x100020adf
cmp eax, ebx
jae 0x100020adf
lea rcx, [rsp + 0x100]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rbp
je 0x100020969
cmp word [rax + 2], bp
jne 0x100020969
mov word [rax], bp
mov rax, qword [0x100036218]
lea r9, [rsp + 0x100]
lea r8, [0x1000032b8]
lea rcx, [rsp + 0x100]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.1000218a0
cmp eax, ebp
mov ebx, eax
jge 0x1000209ab
lea r8, [0x1000032f8]
mov edx, 0x673
jmp 0x100020b09
xor edx, edx
lea rcx, [rsp + 0x98]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
lea rax, [0x100003328]
lea r8, [rsp + 0x100]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x400
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x90], 0x68
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, ebp
jne 0x100020a3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003348]
mov edx, 0x686
jmp 0x100020af1
mov rcx, qword [rsp + 0x68]
or ebx, 0xffffffff
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x100020a66
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003368]
mov edx, 0x68c
jmp 0x100020af1
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, ebp
jne 0x100020a92
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003390]
mov edx, 0x693
jmp 0x100020af1
mov r9d, dword [rsp + 0x60]
movzx ebx, r9w
or ebx, 0x80070000
cmp r9d, ebp
cmovle ebx, r9d
cmp ebx, ebp
jge 0x100020ac2
lea r8, [0x1000033c0]
mov edx, 0x697
mov rcx, rdi
call fcn.1000267e8
jmp 0x100020b11
lea r8, [0x1000033f0]
mov edx, 0x69a
mov r9, qword [0x100036218]
mov rcx, rdi
call fcn.1000267e8
jmp 0x100020b11
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x100003298]
mov edx, 0x66d
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
mov eax, 0x80004005
cmp ebx, ebp
cmovge ebx, eax
mov rcx, rdi
call fcn.1000267e8
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x100020b26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rbp
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x100020b3b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rbp
cmp ebx, ebp
jge 0x100020b7a
lea rdx, [rsp + 0x80]
mov ecx, ebx
mov qword [rsp + 0x80], rbp
call fcn.100021dec
mov r11, qword [rsp + 0x80]
lea r8, [0x100001b60]
mov r9d, ebx
mov edx, 0x6a1
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.1000267e8
mov eax, ebx
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.100033670
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret