Function at 0x1018db6
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get system information on windows
Get windows directory from kuser_shared_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x101d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
push 0x40
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x3ec]
push ebx
push eax
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x3f0], ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x394], ebx
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0xc
push dword [ebp - 0x35c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x360], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x364], ebx
call sub.KERNEL32.dll_GetProcessId
mov dword [ebp - 0x378], eax
cmp eax, ebx
jne 0x1018e6f
call sub.KERNEL32.dll_GetLastError
cmp eax, ebx
jg 0x1018e63
mov edi, eax
jmp 0x10191b2
and eax, 0xffff
or eax, 0x80070000
jmp 0x1018e5c
call sub.KERNEL32.dll_GetCurrentProcessId
xor ecx, ecx
cmp dword [ebp - 0x378], eax
push 4
sete cl
mov edi, 0x1000
push edi
push 0x4c0
push ebx
mov dword [ebp - 0x384], ecx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0x350], eax
cmp eax, ebx
jne 0x1018eac
mov edi, 0x8007000e
jmp 0x10191b2
xor eax, eax
inc eax
push 2
push eax
mov dword [ebp - 0x398], eax
push ebx
lea eax, [ebp - 0x358]
push eax
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0x3a0], 0xc
call sub.KERNEL32.dll_GetCurrentProcess
push eax
push dword [ebp - 0x368]
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
jne 0x1018ef1
mov dword [ebp - 0x358], ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x3a0]
push eax
call sub.KERNEL32.dll_CreateEventW
mov dword [ebp - 0x370], eax
cmp eax, ebx
je 0x1019061
cmp esi, ebx
je 0x1019061
push ebx
push 0xc
lea eax, [ebp - 0x3ac]
push eax
push 1
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1019061
cmp dword [ebp - 0x368], ebx
je 0x1018f4c
push dword [ebp - 0x368]
call sub.KERNEL32.dll_GetThreadId
mov dword [ebp - 0x344], eax
jmp 0x1018f52
mov dword [ebp - 0x344], ebx
movzx eax, word [ebp - 0x3ac]
mov dword [ebp - 0x348], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x34c], 0x28
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], ebx
cmp dword [ebp - 0x384], ebx
jne 0x1019037
push 4
push edi
push 0x348
push ebx
push dword [ebp - 0x35c]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [ebp - 0x354], eax
cmp eax, ebx
je 0x1019061
push 0x14
pop ecx
lea edi, [ebp - 0x324]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x36c]
mov ecx, 0xb3
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x34c]
sub eax, ecx
lea ecx, [ebp + eax - 0x324]
mov dword [ebp - 0x374], eax
lea eax, [ebp + eax - 0x2d4]
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x374]
push eax
mov esi, 0x348
push esi
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x354]
mov dword [ebp - 0x334], ecx
push dword [ebp - 0x35c]
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1019061
cmp dword [ebp - 0x374], esi
jne 0x1019061
mov eax, dword [ebp - 0x354]
jmp 0x101905b
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x334], esi
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x328], ebx
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x364], eax
mov edi, dword [ebp - 0x37c]
cmp word [edi], 0x22
je 0x10190ac
push edi
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
cmp eax, 5
jne 0x10190ac
mov esi, dword [ebp - 0x350]
push edi
push 0x7ffe0030
push 0x1003754
add esi, 0x276
push 0x125
push esi
call fcn.0100937b
mov edi, eax
add esp, 0x14
cmp edi, ebx
jge 0x10190ae
push edi
push 0x1003710
jmp 0x10190e0
mov esi, edi
push dword [ebp - 0x364]
push dword [ebp - 0x370]
push dword [ebp - 0x378]
push esi
push 0x13b
push dword [ebp - 0x350]
call fcn.0100937b
mov edi, eax
add esp, 0x18
cmp edi, ebx
jge 0x10190ee
push edi
push 0x10036c8
push ebx
call fcn.01018d26
add esp, 0xc
jmp 0x1019193
call sub.ntdll.dll_RtlGetCurrentTransaction
push ebx
mov dword [ebp - 0x360], eax
call sub.ntdll.dll_RtlSetCurrentTransaction
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x3f0]
push eax
mov eax, dword [ebp + 0x1c]
push ebx
push ebx
neg eax
sbb eax, eax
and eax, 0x40000
push eax
xor esi, esi
inc esi
push esi
push ebx
push ebx
push dword [ebp - 0x350]
mov dword [ebp - 0x3f0], 0x44
push ebx
mov dword [ebp - 0x3e8], 0x100156c
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x1019193
mov eax, dword [ebp - 0x370]
cmp eax, ebx
je 0x1019193
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x37c], eax
push ebx
push esi
push esi
lea eax, [ebp - 0x380]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0xc0
je 0x1019162
cmp eax, 0x101
je 0x1019162
cmp eax, esi
jne 0x101918d
mov edi, 0x8000ffff
jmp 0x1019193
cmp eax, ebx
jne 0x1019193
xor edi, edi
cmp dword [ebp - 0x354], ebx
je 0x10191b2
push 0x8000
push ebx
push dword [ebp - 0x354]
push dword [ebp - 0x35c]
call sub.KERNEL32.dll_VirtualFreeEx
cmp dword [ebp - 0x358], ebx
je 0x10191cb
push dword [ebp - 0x358]
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 0x358], ebx
cmp dword [ebp - 0x394], ebx
je 0x10191de
push dword [ebp - 0x394]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x390], ebx
je 0x10191f1
push dword [ebp - 0x390]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x360], ebx
je 0x101920f
push dword [ebp - 0x360]
call sub.ntdll.dll_RtlSetCurrentTransaction
push dword [ebp - 0x360]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x350], ebx
je 0x1019228
push 0x8000
push ebx
push dword [ebp - 0x350]
call sub.KERNEL32.dll_VirtualFree
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010042af
leave
ret 0x18