Function at 0x101317c
Capabilities:
Check os version
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x630
mov rax, qword [0x01044480]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x6b8]
mov rbx, rcx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x6c0]
lea rcx, [0x01006b30]
xor edi, edi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x74], edi
call fcn.01011d38
lea rcx, [rbx + 0x10]
xor edx, edx
call fcn.0100fe90
lea rcx, [rbx + 0x18]
xor edx, edx
mov rsi, rax
mov qword [rsp + 0xa0], rax
call fcn.0100fe90
lea rcx, [0x01006b80]
mov rdx, rsi
mov r8, rax
mov qword [rsp + 0xc0], rax
call fcn.01011d38
mov r11d, 0x400
lea rcx, [rdi - 1]
lea eax, [rdi + 4]
mul r11
cmovo rax, rcx
mov rcx, rax
call fcn.01028e1c
mov r14, rax
cmp rax, rdi
jne 0x1013250
xor eax, eax
jmp 0x101368f
mov r8d, 0x1000
mov rdx, rax
mov rcx, rbx
call fcn.01012b68
lea rcx, [0x01006c20]
movsxd r12, eax
mov edx, r12d
call fcn.01011d38
cmp r12d, edi
jle 0x1013685
mov qword [rsp + 0x68], rdi
mov r13d, edi
mov rsi, rdi
mov r15d, 1
mov r8d, dword [r14 + rsi*4]
mov edx, r15d
mov ecx, 0x1fffff
mov ebp, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x80], rax
cmp rax, rdi
je 0x1013674
mov r8d, dword [r14 + rsi*4]
lea rcx, [0x01006cb0]
mov edx, r13d
call fcn.01011d38
lea r8, [rsp + 0x68]
mov edx, 0x2000f
mov rcx, rbx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x1013667
cmp qword [rsp + 0x68], rdi
je 0x1013667
lea rcx, [0x01006d60]
call fcn.01011d38
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea rcx, [0x01006de0]
call fcn.01011d38
cmp dword [rsp + 0x60], edi
jbe 0x101365c
mov ecx, dword [rsp + 0x60]
call fcn.01028e1c
mov r15, rax
cmp rax, rdi
je 0x1013656
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r8, r15
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, edi
je 0x101364e
lea rcx, [0x01006e60]
call fcn.01011d38
mov rdx, qword [r15]
mov eax, 0x104
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x410]
lea r8, [rsp + 0x200]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
cmp eax, edi
je 0x101364e
lea r8, [rsp + 0x410]
lea rdx, [rsp + 0x200]
lea rcx, [0x01006ef0]
call fcn.01011d38
mov rax, qword [rsp + 0xc0]
mov ebx, edi
cmp word [rax], di
jne 0x101342a
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x200]
call fcn.01029074
cmp eax, edi
jne 0x101345d
mov ebx, 1
jmp 0x101345d
lea rcx, [rsp + 0x410]
mov rdx, rax
call fcn.01029074
cmp eax, edi
jne 0x101345d
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x200]
call fcn.01029074
cmp eax, edi
mov eax, 1
cmove ebx, eax
lea rcx, [0x01006fb0]
mov edx, ebx
call fcn.01011d38
cmp ebx, edi
je 0x1013646
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x78]
mov r8d, 1
mov rbx, rdi
mov qword [rsp + 0x78], rdi
call sub.USERENV.dll_CreateEnvironmentBlock
lea rcx, [0x01007040]
call fcn.01011d38
mov ebp, dword [rsp + 0x74]
cmp qword [rsp + 0x78], rdi
je 0x10134c0
mov rbx, qword [rsp + 0x78]
bts ebp, 0xa
lea rcx, [0x010070d0]
mov dword [rsp + 0x74], ebp
call fcn.01011d38
lea rcx, [rsp + 0xe0]
xor edx, edx
mov r8d, 0x114
call fcn.01034300
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0xe0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, [0x01007160]
xor edx, edx
call fcn.01011d38
mov rdx, qword [rsp + 0x90]
lea rcx, [0x010071e0]
call fcn.01011d38
mov edx, dword [r14 + rsi*4]
lea rcx, [0x01007250]
mov r8d, r13d
call fcn.01011d38
cmp dword [rsp + 0xe4], 6
ja 0x1013590
jne 0x1013539
cmp dword [rsp + 0xe8], 2
jae 0x1013590
lea rcx, [0x010073c0]
call fcn.01011d38
mov rax, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1013605
lea rcx, [0x010072d0]
call fcn.01011d38
mov ecx, dword [r14 + rsi*4]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], edi
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [rsp + 0x70]
lea rcx, [0x01007350]
call fcn.01011d38
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xd0]
call fcn.0100f990
lea rcx, [rsp + 0xd8]
xor edx, edx
mov rbx, rax
call fcn.0100f990
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0xc8]
mov r9, rbx
mov r8, rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call fcn.01012d24
mov ebp, eax
cmp eax, edi
je 0x101361f
lea rcx, [0x01007470]
call fcn.01011d38
mov r13d, r12d
mov rsi, r12
jmp 0x1013637
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x1013637
lea rcx, [0x01007500]
mov edx, eax
call fcn.01011d38
mov rcx, qword [rsp + 0x78]
cmp rcx, rdi
je 0x1013646
call sub.USERENV.dll_DestroyEnvironmentBlock
mov rbx, qword [rsp + 0x80]
mov rcx, r15
call fcn.01028de4
mov r15d, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, edi
jne 0x1013683
add r13d, r15d
add rsi, r15
cmp r13d, r12d
jl 0x101328d
mov edi, ebp
mov rcx, r14
call fcn.01028de4
mov eax, edi
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.01028cb0
mov rbx, qword [rsp + 0x678]
add rsp, 0x630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret