Function at 0x140027f68
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xf0
mov r12, rcx
lea rcx, str.Kernel32
mov rbp, rdx
xor ebx, ebx
xor sil, sil
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
lea r15d, [rbx + 1]
test rax, rax
je 0x140027fc9
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx esi, sil
mov rcx, rdi
test rax, rax
cmovne esi, r15d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
and qword [rsp + 0x68], rbx
and dword [rsp + 0x80], ebx
xor edi, edi
lea r8d, [rdi + 0x60]
lea rcx, [rsp + 0x88]
xor edx, edx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
call sub.MSVCR90.dll_memset
mov r14d, 0x80070000
test sil, sil
je 0x140028208
and dword [rsp + 0x130], ebx
mov edi, 0x3000
lea rcx, str.Progman
xor edx, edx
mov dword [rsp + 0x138], edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14002803f
lea rdx, [rsp + 0x130]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x130]
lea rdx, [rsp + 0x50]
call fcn.140027db8
mov ebx, eax
test eax, eax
js 0x14002825e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x138]
mov ecx, eax
call fcn.140027db8
mov ebx, eax
test eax, eax
js 0x14002825e
cmp dword [rsp + 0x138], edi
jne 0x1400281e6
cmp dword [rsp + 0x50], 0x2000
jne 0x1400281ff
mov r8d, dword [rsp + 0x130]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400281ff
mov edi, 0xf01ff
lea r8, [rsp + 0x58]
mov rcx, rax
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400281ca
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov r9d, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14002810c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400281ac
lea rcx, str.AdvApi32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14002818c
lea rdx, str.CreateProcessWithTokenW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002818c
lea rcx, [rsp + 0x68]
mov r9, rbp
mov r8, r12
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x38], rcx
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x60]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call rax
test eax, eax
jne 0x140028191
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
jmp 0x140028191
mov ebx, 0x8000ffff
test rdi, rdi
je 0x14002819f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400281bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400281db
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400281ff
cmp dword [rsp + 0x138], 0x2000
jne 0x1400281ff
cmp dword [rsp + 0x50], edi
mov eax, 0x80070005
cmove ebx, eax
test ebx, ebx
js 0x14002825e
mov rdi, qword [rsp + 0x78]
test edi, edi
jne 0x14002825e
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov rdx, rbp
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], edi
and dword [rsp + 0x20], edi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14002825e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret