Function at 0x140004880
Capabilities:
Check os version
Create process on windows

Disassembly:
push rbp
push rsi
push r12
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x1400f4d50]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov esi, ecx
lea rcx, [rbp]
mov r12, rdx
mov dword [rbp], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 4], 5
jne 0x1400048d4
cmp dword [rbp + 8], 0
jne 0x1400048d4
mov rcx, r12
call fcn.1400047d0
jmp 0x140004b36
mov qword [rsp + 0x270], rbx
cmp esi, 0xffffffff
jne 0x14000492b
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140004914
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000491e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x4005
jmp 0x140004b2e
call rax
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.Wtsapi32.dll
mov qword [rsp + 0x238], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140004966
lea rdx, str.WTSQueryUserToken
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140004970
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x4005
jmp 0x140004b26
mov qword [rsp + 0x230], r13
lea rdx, [rsp + 0x60]
xor r13d, r13d
mov ecx, esi
mov qword [rsp + 0x60], r13
call rax
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x1400049a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140004b1e
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov r9d, 1
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x68], r13
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400049f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
test rcx, rcx
je 0x1400049ef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140004b1e
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x70], r13
mov ebx, gethostbyname
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
mov ecx, 0x430
cmovne ebx, ecx
xor edx, edx
lea rcx, [rbp - 0x70]
lea r8d, [rdx + 0x68]
call fcn.140096590
mov rcx, qword [rsp + 0x68]
lea rax, str.winsta0default
mov qword [rbp - 0x60], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
mov r8, r12
xor edx, edx
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x70]
mov dword [rbp - 0x70], 0x68
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140004ace
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
test rcx, rcx
je 0x140004aab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004abb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004aca
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, ebx
jmp 0x140004b1e
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004ade
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140004aed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140004afd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140004b0d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004b1c
call sub.USERENV.dll_DestroyEnvironmentBlock
xor eax, eax
mov r13, qword [rsp + 0x230]
mov rdi, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400959a0
add rsp, 0x240
pop r12
pop rsi
pop rbp
ret