Function at 0x1000b4f4
Capabilities:
Create process on windows
Set environment variable
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov ebp, dword [esp + 0x80]
mov esi, 0x44
lea edi, [esp + 0x10]
push esi
push edi
call sub.NTDLL.dll_RtlZeroMemory
mov eax, esp
push 0x10
push eax
call sub.NTDLL.dll_RtlZeroMemory
mov dword [edi], esi
cmp dword [esp + 0x6c], 0
jne 0x1000b52d
mov dword [esp + 0x3c], 1
test ebp, ebp
je 0x1000b535
mov dword [esp + 0x18], ebp
cmp dword [0x1002cd84], 0
je 0x1000b598
xor eax, eax
cmp dword [esp + 0x6c], 0
setne al
shl eax, 0x1b
xor esi, esi
mov ecx, esp
push ecx
push edi
push dword [esp + 0x84]
push esi
push eax
push esi
push esi
push esi
push dword [esp + 0x88]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
cmp dword [0x1002cd84], esi
jne 0x1000b634
cmp dword [0x1002d218], 0xa
jl 0x1000b5ff
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000b625
jmp 0x1000b5ff
push str.RunAsInvoker
push str.__compat_layer
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [0x1002d218], 0xa
jl 0x1000b53e
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000b53e
mov ebp, str.RunAsInvoker
mov esi, str.__compat_layer
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebp
push esi
call ebx
push ebp
push esi
call ebx
cmp dword [0x1002d218], 0xa
jl 0x1000b53e
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000b5d5
jmp 0x1000b53e
push 0
push str.__compat_layer
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [0x1002d218], 0xa
jl 0x1000b634
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000b634
push 0
push str.__compat_layer
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1000b5ff
test edi, edi
je 0x1000b7ac
mov esi, dword [esp + 0x70]
cmp esi, 0xffffffff
je 0x1000b653
test esi, esi
je 0x1000b713
imul esi, esi, 0x3e8
push esi
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x1002d218], 0xa
jl 0x1000b6a6
mov ecx, dword [0x1002d21c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x1000b6a6
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push dword [esp + 4]
call edi
push esi
push dword [esp + 4]
call edi
cmp dword [0x1002d218], 0xa
jl 0x1000b6a6
mov ecx, dword [0x1002d21c]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x1000b67e
test eax, eax
je 0x1000b700
cmp dword [esp + 0x78], 0
je 0x1000b713
mov esi, dword [esp]
push 0
push esi
call sub.NTDLL.dll_NtTerminateProcess
cmp dword [0x1002d218], 0xa
jl 0x1000b713
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000b713
xor edi, edi
push edi
push esi
call sub.NTDLL.dll_NtTerminateProcess
push edi
push esi
call sub.NTDLL.dll_NtTerminateProcess
cmp dword [0x1002d218], 0xa
jl 0x1000b713
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000b6d7
jmp 0x1000b713
mov eax, dword [esp + 0x74]
test eax, eax
je 0x1000b713
push eax
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002d218], 0xa
jl 0x1000b761
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000b761
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 4]
call esi
push dword [esp + 4]
call esi
cmp dword [0x1002d218], 0xa
jl 0x1000b761
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000b73c
mov edi, dword [esp]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
cmp dword [0x1002d218], 0xa
jl 0x1000b7ac
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000b7ac
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
push edi
call ebx
cmp dword [0x1002d218], 0xa
jl 0x1000b7ac
mov eax, dword [0x1002d21c]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x1000b78d
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret