Function at 0x10022b70
Capabilities:
Create process on windows
Enumerate processes
Query environment variable

Disassembly:
mov eax, 0x2ee8
call fcn.100421a0
sub rsp, rax
mov rax, qword [0x10058650]
mov qword [rsp + 0x2e90], rax
mov qword [rsp + 0x2ed0], rsi
mov qword [rsp + 0x2ec8], rdi
mov qword [rsp + 0x2ec0], r12
xor esi, esi
mov byte [rsp + 0x61], r8b
mov rdi, rcx
mov byte [rsp + 0x60], dl
mov qword [rsp + 0x2eb8], r13
lea r8d, [rsi + 0x60]
lea rcx, [rsp + 0xd8]
xor edx, edx
mov qword [rsp + 0x2eb0], r14
mov qword [rsp + 0x2ea8], r15
mov r12, r9
mov dword [rsp + 0xd0], esi
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x691]
xor edx, edx
mov r8d, 0x27ff
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov r14, rsi
mov r13d, esi
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x690], al
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x88]
mov rdx, rdi
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rcx, [rsp + 0x291]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x290], sil
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x290]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea rcx, [rsp + 0x88]
mov r8, qword [r8]
xor edx, edx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
lea rdx, str.userenv.dll
mov r15, rsi
test rdx, rdx
je 0x10022ceb
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10022ceb
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
mov qword [rsp + 0x2ee0], rbx
mov qword [rsp + 0x2ed8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, r15
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov ebp, esi
lea ecx, [rdx + 0xa]
mov qword [rsp + 0xc0], rax
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x100231c0
lea rdx, [rsp + 0x160]
mov rcx, rax
mov dword [rsp + 0x160], 0x130
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x10022da9
nop
nop
nop
nop
lea rdx, [rsp + 0x18c]
lea rcx, [0x10048460]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10022da0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x10022d70
jmp 0x10022da9
mov ebp, dword [rsp + 0x168]
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x100231c0
mov r8d, ebp
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r14, rax
jne 0x10022e1a
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x10048470]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10027af0
lea rdx, str._comm__createProcessAsUser__s__OpenProcess_explorer__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10027bf0
jmp 0x10023342
lea r8, [rsp + 0x70]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10022e79
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x100484c8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10027af0
lea rdx, str._comm__createProcessAsUser__s__OpenProcessToken_explorer__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10027bf0
jmp 0x10023342
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
mov r9d, 1
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp byte [rsp + 0x61], sil
je 0x10022ede
mov word [rsp + 0x110], 5
mov dword [rsp + 0x10c], 1
jmp 0x10022f15
mov dword [rsp + 0xf0], 0xffffff9c
mov dword [rsp + 0xf4], 0xffffff9c
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0xfc], esi
mov word [rsp + 0x110], si
mov dword [rsp + 0x10c], 7
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
xor r8d, r8d
call qword [rsp + 0x68]
test eax, eax
je 0x10023178
mov r8, qword [rsp + 0x78]
mov r9d, esi
mov rax, r8
nop
nop
cmp word [rax], si
jne 0x10022f4b
cmp word [rax + 2], si
je 0x10022f54
inc r9d
add rax, 2
jmp 0x10022f40
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x690]
mov qword [rsp + 0x30], rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x2800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call fcn.10027570
test al, al
je 0x10023007
mov edx, esi
mov rax, rsi
nop
cmp byte [rsp + rax + 0x690], sil
jne 0x10022fa4
cmp byte [rsp + rax + 0x691], sil
je 0x10022fb1
inc rax
inc edx
cmp rax, 0x2800
jl 0x10022f90
lea r8, str.CommonProgramFiles_x86_
lea rcx, [rsp + 0x690]
call fcn.10020e00
lea r8, str.CommonProgramW6432
lea rcx, [rsp + 0x690]
mov edx, eax
call fcn.10020e00
lea r8, [0x10048670]
lea rcx, [rsp + 0x690]
mov edx, eax
call fcn.10020e00
lea r8, str.ProgramW6432
lea rcx, [rsp + 0x690]
mov edx, eax
call fcn.10020e00
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x140]
test rdx, rdx
cmove rdx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10020c10
mov rcx, qword [rsp + 0x80]
mov r8, qword [rax + 8]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd0]
test r8, r8
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x690]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc000030
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
lea rcx, [rsp + 0x140]
mov edi, eax
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
test edi, edi
je 0x10023118
mov rax, qword [rsp + 0xa8]
cmp rax, 0xffffffffffffffff
je 0x10023118
test r12, r12
mov rsi, qword [rsp + 0xb8]
je 0x100230be
mov dword [r12], esi
mov qword [r12 + 8], rax
mov rdi, qword [rsp + 0x90]
lea rdx, [0x10048698]
lea rcx, [rsp + 0x68]
test rdi, rdi
cmove rdi, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10027af0
mov r9d, dword [rsp + 0xb8]
lea rdx, str._comm__createProcessAsUser__s__successed__pid_d
mov rcx, rax
mov r8, rdi
call fcn.10027bf0
cmp byte [rsp + 0x60], r13b
je 0x1002315b
mov rcx, qword [rsp + 0xa8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1002315b
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x100486d8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10027af0
lea rdx, str._comm__createProcessAsUser__s__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10027bf0
mov rcx, qword [rsp + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x10023342
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10023342
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x10048710]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10027af0
lea rdx, str._comm__createProcessAsUser__d__CreateEnvironmentBlock_failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10027bf0
jmp 0x10023342
lea rdx, str.Kernel32.dll
mov rbp, rsi
test rdx, rdx
je 0x100231f1
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x100231f1
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
lea rdx, str.wtsapi32.dll
mov r12, rsi
test rdx, rdx
je 0x10023222
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10023222
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQueryUserToken
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rbx, rbx
mov rdi, rax
je 0x100232b2
call rbx
cmp eax, 0xffffffff
mov r13d, eax
jne 0x100232b2
mov rdi, qword [rsp + 0x90]
lea rdx, [0x10048570]
lea rcx, [rsp + 0x68]
test rdi, rdi
cmove rdi, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10027af0
lea rdx, str._comm__createProcessAsUser__s__failed:_No_session_attached_to_the_console__WTSGetActiveConsoleSessionId_failed_
mov rcx, rax
mov r8, rdi
call fcn.10027bf0
test r12, r12
je 0x1002329b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10023342
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10023342
test rdi, rdi
je 0x10023326
lea rdx, [rsp + 0x70]
mov ecx, r13d
call rdi
test eax, eax
jne 0x10023326
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x100485f8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10027af0
lea rdx, str._comm__createProcessAsUser__s__WTSQueryUserToken_failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10027bf0
test r12, r12
je 0x10023316
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10023342
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10023342
test r12, r12
je 0x10023334
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10023342
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x2eb8]
mov r12, qword [rsp + 0x2ec0]
test rcx, rcx
mov rdi, qword [rsp + 0x2ec8]
mov rbp, qword [rsp + 0x2ed8]
mov rbx, qword [rsp + 0x2ee0]
je 0x1002337b
call qword [rsp + 0xc0]
test r14, r14
je 0x10023389
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x2eb0]
test rcx, rcx
je 0x100233a1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x100233b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x100233c2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov r15, qword [rsp + 0x2ea8]
mov eax, esi
mov rsi, qword [rsp + 0x2ed0]
mov rcx, qword [rsp + 0x2e90]
call fcn.10042170
add rsp, 0x2ee8
ret