Function at 0x140010ec0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140018010]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
lea rdx, [rcx + 0x24]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movzx eax, word [rbp - 0x70]
test ax, ax
jne 0x140010f26
mov rcx, qword [0x140018820]
lea rdx, [rbp - 0x70]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, word [rbp - 0x70]
lea rbx, [rbp - 0x70]
test ax, ax
jne 0x140010f4b
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [rbp + 0x1a0]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
xor edi, edi
mov dword [rsp + 0x20], 0x70
lea rsi, str.runas
mov qword [rsp + 0x28], rdi
lea r14, [0x140015700]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x24], 0x540
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea r15, [0x140015708]
test eax, eax
jne 0x140010fbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140011068
jmp 0x140010fd6
mov rcx, qword [rbp - 0x78]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbp - 0x70]
cmp word [rbp - 0x70], di
jne 0x140010ffc
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [rbp + 0x1a0]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x24], 0x540
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14001104f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140011068
mov rcx, qword [rbp - 0x78]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x5c
lea rcx, [rbp - 0x70]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov edx, 0x2f
lea rcx, [rbp - 0x70]
mov rbx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
cmp rbx, rax
cmova rax, rbx
lea rcx, [rax + 2]
test rax, rax
jne 0x14001109d
lea rcx, [rbp - 0x70]
lea rdx, str.ZuluServ.exe
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rbx, [rbp - 0x70]
cmp word [rbp - 0x70], di
jne 0x1400110d0
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [rbp + 0x1a0]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x24], 0x540
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14001112a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140011143
jmp 0x1400111d5
mov rcx, qword [rbp - 0x78]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbp - 0x70]
cmp word [rbp - 0x70], di
jne 0x140011169
mov r8d, 0x104
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rbx, [rbp + 0x1a0]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x24], 0x540
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400111bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400111d5
mov rcx, qword [rbp - 0x78]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140013630
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret