Function at 0x140023140
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r13
push r14
lea rbp, [rax - 0x48]
sub rsp, 0x130
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
movzx r14d, r9b
mov r13, r8
mov rsi, rdx
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
mov edx, 0x5c
mov rcx, qword [rsi]
call qword [sym.imp.MSVCR100.dll_wcsrchr]
or edi, 0xffffffff
test rax, rax
jne 0x1400231a9
mov eax, edi
jmp 0x1400231af
sub rax, qword [rsi]
sar rax, 1
mov r8d, eax
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140001d30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14002321a
cmp dword [rbx + 0x10], 0
jl 0x14002320b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002320b
call fcn.140001b90
mov r12, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400231ff
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [r12 + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x14002321a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140001e80
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140023238
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov rax, qword [r13]
cmp dword [rax - 0x10], 0
je 0x140023275
mov r9, rax
mov r8, qword [rsi]
lea rdx, str.__s_____s_
lea rcx, [rsp + 0x70]
call fcn.140004440
jmp 0x1400232ce
mov rdx, qword [rsi]
lea rcx, [rdx - 0x18]
lea rsi, [rbx - 0x18]
cmp rcx, rsi
je 0x1400232d3
cmp dword [rsi + 0x10], 0
jl 0x1400232c0
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x1400232c0
call fcn.140001b90
mov rbx, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400232b5
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
add rbx, 0x18
mov qword [rsp + 0x70], rbx
jmp 0x1400232d3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140001e80
mov rbx, qword [rsp + 0x70]
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rbp - 0x70], rsi
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x68]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov rcx, qword [rsp + 0x68]
test r14b, r14b
je 0x140023357
mov dword [rbp - 0x78], esi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 8]
lea r8, [rbp - 0x70]
lea edx, [rsi + 0x13]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140023350
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9d, [rsi + 2]
xor r8d, r8d
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rdx, qword [rsp + 0x60]
jmp 0x140023390
mov rdx, qword [rsp + 0x68]
jmp 0x14002338b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
cmove rdx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdx
mov qword [rbp - 0x80], rsi
xor r8d, r8d
lea rcx, [rbp - 0x80]
call sub.USERENV.dll_CreateEnvironmentBlock
mov qword [rbp - 0x60], rsi
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
xor edx, edx
lea r8d, [rax + 0x60]
lea rcx, [rbp - 0x38]
call sub.MSVCR100.dll_memset
mov dword [rbp - 0x40], 0x68
cmp dword [rbx - 8], 1
jle 0x1400233dc
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140001930
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
test r14b, r14b
cmovne rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x4000410
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400234e9
cmp eax, dword [rbx - 0xc]
jg 0x1400234e9
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140023467
call sub.USERENV.dll_DestroyEnvironmentBlock
mov qword [rbp - 0x80], rsi
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140023498
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14002348d
cmp rcx, rax
jne 0x14002348d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rsi
jmp 0x1400234a8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rsi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400234ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], rsi
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400234c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsp + 0x78]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x1400234e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x1400234f4
mov ecx, 0x80070057
call fcn.140001000
nop
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret