Function at 0x10021490
Capabilities:
Create process on windows
Enumerate processes
Query environment variable

Disassembly:
mov eax, 0x2ec8
call fcn.1003b070
sub rsp, rax
mov rax, qword [0x10050650]
mov qword [rsp + 0x2e70], rax
mov qword [rsp + 0x2eb0], rsi
mov qword [rsp + 0x2ea8], rdi
mov qword [rsp + 0x2ea0], r12
xor esi, esi
mov byte [rsp + 0x61], r8b
mov rdi, rcx
mov byte [rsp + 0x60], dl
mov qword [rsp + 0x2e98], r13
lea r8d, [rsi + 0x60]
lea rcx, [rsp + 0xd8]
xor edx, edx
mov qword [rsp + 0x2e90], r14
mov qword [rsp + 0x2e88], r15
mov r12, r9
mov dword [rsp + 0xd0], esi
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x671]
xor edx, edx
mov r8d, 0x27ff
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov r14, rsi
mov r13d, esi
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x670], al
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x88]
mov rdx, rdi
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x270], sil
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x270]
test rcx, rcx
mov r8d, 0x400
cmove rcx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea rcx, [rsp + 0x88]
mov r8, qword [r8]
xor edx, edx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
lea rdx, str.userenv.dll
mov r15, rsi
test rdx, rdx
je 0x1002160b
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1002160b
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
lea rdx, str.CreateEnvironmentBlock
mov rcx, r15
mov qword [rsp + 0x2ec0], rbx
mov qword [rsp + 0x2eb8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, r15
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov ebp, esi
lea ecx, [rdx + 0xa]
mov qword [rsp + 0xc0], rax
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x10021ab4
lea rdx, [rsp + 0x140]
mov rcx, rax
mov dword [rsp + 0x140], 0x130
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x100216c9
nop
nop
nop
nop
lea rdx, [rsp + 0x16c]
lea rcx, [0x10041148]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100216c0
lea rdx, [rsp + 0x140]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x10021690
jmp 0x100216c9
mov ebp, dword [rsp + 0x148]
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x10021ab4
mov r8d, ebp
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r14, rax
jne 0x1002173a
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.1001f320
lea rdx, [0x10041158]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10024b50
lea rdx, str._comm__createProcessAsUser__s__OpenProcess_explorer__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10024c50
jmp 0x10021c36
lea r8, [rsp + 0x70]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10021799
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.1001f320
lea rdx, [0x100411a8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10024b50
lea rdx, str._comm__createProcessAsUser__s__OpenProcessToken_explorer__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10024c50
jmp 0x10021c36
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
mov r9d, 1
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x2000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0xd0], WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp byte [rsp + 0x61], sil
je 0x100217fe
mov word [rsp + 0x110], 5
mov dword [rsp + 0x10c], 1
jmp 0x10021835
mov dword [rsp + 0xf0], 0xffffff9c
mov dword [rsp + 0xf4], 0xffffff9c
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0xfc], esi
mov word [rsp + 0x110], si
mov dword [rsp + 0x10c], 7
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
xor r8d, r8d
call qword [rsp + 0x68]
test eax, eax
je 0x10021a6c
mov r8, qword [rsp + 0x78]
mov r9d, esi
mov rax, r8
nop
nop
cmp word [rax], si
jne 0x1002186b
cmp word [rax + 2], si
je 0x10021874
inc r9d
add rax, 2
jmp 0x10021860
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x670]
mov qword [rsp + 0x30], rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x2800
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call fcn.100245d0
test al, al
je 0x10021927
mov edx, esi
mov rax, rsi
nop
cmp byte [rsp + rax + 0x670], sil
jne 0x100218c4
cmp byte [rsp + rax + 0x671], sil
je 0x100218d1
inc rax
inc edx
cmp rax, 0x2800
jl 0x100218b0
lea r8, str.CommonProgramFiles_x86_
lea rcx, [rsp + 0x670]
call fcn.1001f870
lea r8, str.CommonProgramW6432
lea rcx, [rsp + 0x670]
mov edx, eax
call fcn.1001f870
lea r8, str.ProgramFiles_x86_
lea rcx, [rsp + 0x670]
mov edx, eax
call fcn.1001f870
lea r8, str.ProgramW6432
lea rcx, [rsp + 0x670]
mov edx, eax
call fcn.1001f870
mov r8, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd0]
test r8, r8
cmove r8, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x670]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc000030
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x10021a0c
mov rax, qword [rsp + 0xa8]
cmp rax, 0xffffffffffffffff
je 0x10021a0c
test r12, r12
mov rsi, qword [rsp + 0xb8]
je 0x100219b2
mov dword [r12], esi
mov qword [r12 + 8], rax
mov rdi, qword [rsp + 0x90]
lea rdx, [0x10041378]
lea rcx, [rsp + 0x68]
test rdi, rdi
cmove rdi, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10024b50
mov r9d, dword [rsp + 0xb8]
lea rdx, str._comm__createProcessAsUser__s__successed__pid_d
mov rcx, rax
mov r8, rdi
call fcn.10024c50
cmp byte [rsp + 0x60], r13b
je 0x10021a4f
mov rcx, qword [rsp + 0xa8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x10021a4f
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.1001f320
lea rdx, [0x100413b8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10024b50
lea rdx, str._comm__createProcessAsUser__s__failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10024c50
mov rcx, qword [rsp + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x10021c36
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10021c36
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.1001f320
lea rdx, [0x100413f0]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10024b50
lea rdx, str._comm__createProcessAsUser__d__CreateEnvironmentBlock_failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10024c50
jmp 0x10021c36
lea rdx, str.Kernel32.dll
mov rbp, rsi
test rdx, rdx
je 0x10021ae5
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10021ae5
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
lea rdx, str.wtsapi32.dll
mov r12, rsi
test rdx, rdx
je 0x10021b16
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x10021b16
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQueryUserToken
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rbx, rbx
mov rdi, rax
je 0x10021ba6
call rbx
cmp eax, 0xffffffff
mov r13d, eax
jne 0x10021ba6
mov rdi, qword [rsp + 0x90]
lea rdx, [0x10041250]
lea rcx, [rsp + 0x68]
test rdi, rdi
cmove rdi, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10024b50
lea rdx, str._comm__createProcessAsUser__s__failed:_No_session_attached_to_the_console__WTSGetActiveConsoleSessionId_failed_
mov rcx, rax
mov r8, rdi
call fcn.10024c50
test r12, r12
je 0x10021b8f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10021c36
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10021c36
test rdi, rdi
je 0x10021c1a
lea rdx, [rsp + 0x70]
mov ecx, r13d
call rdi
test eax, eax
jne 0x10021c1a
mov rbx, qword [rsp + 0x90]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
xor ecx, ecx
call fcn.1001f320
lea rdx, [0x100412d8]
lea rcx, [rsp + 0x68]
mov rdi, rax
call fcn.10024b50
lea rdx, str._comm__createProcessAsUser__s__WTSQueryUserToken_failed:__s
mov r9, rdi
mov r8, rbx
mov rcx, rax
call fcn.10024c50
test r12, r12
je 0x10021c0a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10021c36
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10021c36
test r12, r12
je 0x10021c28
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x10021c36
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x2e98]
mov r12, qword [rsp + 0x2ea0]
test rcx, rcx
mov rdi, qword [rsp + 0x2ea8]
mov rbp, qword [rsp + 0x2eb8]
mov rbx, qword [rsp + 0x2ec0]
je 0x10021c6f
call qword [rsp + 0xc0]
test r14, r14
je 0x10021c7d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x2e90]
test rcx, rcx
je 0x10021c95
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x10021ca8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x10021cb6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x88]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov r15, qword [rsp + 0x2e88]
mov eax, esi
mov rsi, qword [rsp + 0x2eb0]
mov rcx, qword [rsp + 0x2e70]
call fcn.1003b040
add rsp, 0x2ec8
ret