Function at 0x1400fc910
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor eax, eax
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x60], ecx
lea rdx, [r11 - 0x426]
mov r8d, 0x400
xor ecx, ecx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [r11 - 0x4b8], rsi
mov qword [r11 - 0x4b0], rax
mov qword [r11 - 0x4a8], rax
mov qword [r11 - 0x4a0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x22
lea ecx, [rax + 1]
mov word [rsp + 0x110], r8w
mov edi, 0x20
mov word [rsp + rcx*2 + 0x110], r8w
lea ecx, [rax + 2]
mov eax, eax
add rax, rax
mov word [rsp + rcx*2 + 0x110], di
sub rax, rbx
lea rcx, [rsp + rax + 0x116]
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x1400fc9c0
xor edx, edx
lea rcx, [rsp + 0xa0]
lea r8d, [rdx + 0x68]
call fcn.1401e42d0
lea rax, str.winsta0default
mov dword [rsp + 0xa0], WSASetLastError
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
mov rcx, rax
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400fca47
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400fca40
lea r9, str.OpenProcessToken_err
lea rdx, str..Service.cpp
lea ecx, [rax + 3]
mov r8d, 0x3d6
call fcn.1400045a0
xor eax, eax
jmp 0x1400fcc62
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400fcab1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400fca83
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400fcaaa
lea r9, str.DuplicateTokenEx_err
lea rdx, str..Service.cpp
mov r8d, 0x3dd
mov ecx, 3
call fcn.1400045a0
xor eax, eax
jmp 0x1400fcc62
mov rcx, qword [rsp + 0x68]
mov r9d, 4
lea r8, [rsp + 0x60]
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x1400fcb1d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400fcadf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400fcaef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x1400fcb16
lea r9, str.SetTokenInformation_err
lea rdx, str..Service.cpp
mov r8d, 0x3e5
mov ecx, 3
call fcn.1400045a0
xor eax, eax
jmp 0x1400fcc62
mov rcx, qword [rsp + 0x68]
mov r9d, 4
lea r8, [rsp + 0x78]
lea edx, [r9 + 0x16]
mov dword [rsp + 0x78], 1
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x80]
mov r8d, 1
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ecx, 0x420
mov ebx, esi
test eax, eax
cmovne edi, ecx
nop word [rax + rax]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x110]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400fcc0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe9
jne 0x1400fcbf6
mov rcx, qword [rsp + 0x68]
mov r9d, 4
lea r8, [rsp + 0x60]
lea edx, [r9 + 8]
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x1400fcc0c
jmp 0x1400fcc01
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 5
jl 0x1400fcb70
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400fcc1c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400fcc2c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400fcc47
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x90], rsi
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400fcc5a
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1401e42a0
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret