Function at 0x18085cb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x181d600c]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [esp + 0x10], eax
movzx ecx, byte [0x181dc05a]
push esi
neg ecx
mov dword [esp + 0x10], ebx
push edi
sbb ecx, ecx
push 1
pop esi
and ecx, 0x181dbf50
je 0x18085d18
push 7
pop eax
push esi
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
call fcn.18008b5d
push dword [ebx]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x24]
push str._RunAsCurrentUserHighIL___s_
push eax
call fcn.18007230
add esp, 0xc
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], 0
call fcn.1800d75b
test eax, eax
jns 0x18085d32
lfence
jmp 0x18085f27
mov bl, byte [esp + 0x13]
test bl, bl
jne 0x18085d44
mov eax, 0x80004005
jmp 0x18085f27
and dword [esp + 0x80], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x80]
push ecx
push 0x8b
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, eax
test edi, edi
js 0x18085f0e
mov ecx, dword [esp + 0x80]
push 3
pop edx
call fcn.18085bc6
mov edi, eax
test edi, edi
js 0x18085f0e
test bl, bl
mov ebx, dword [esp + 0x80]
sete byte [esp + 0x13]
cmp ebx, 0xffffffff
jne 0x18085da6
mov edi, 0x80070057
jmp 0x18085f0e
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.1800a0da
add eax, 0x10
mov dword [esp + 0x30], 0x44
push 0x40
mov dword [esp + 0x80], eax
lea eax, [esp + 0x38]
push 0
push eax
call fcn.181370e0
and dword [esp + 0x28], 0
lea edi, [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x20], 0x20
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x18085e0e
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], 0x420
jmp 0x18085e14
xor edi, edi
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x7c]
mov edx, 0x104
mov ecx, dword [eax - 8]
sub esi, dword [eax - 4]
sub ecx, edx
cmp byte [esp + 0x13], 0
je 0x18085e70
or esi, ecx
jge 0x18085e41
push edx
lea ecx, [esp + 0x80]
call fcn.1800773c
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x20]
xor ebx, ebx
push ecx
lea ecx, [esp + 0x34]
push ecx
push ebx
push edi
push dword [esp + 0x24]
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [esp + 0x80]
mov esi, eax
call fcn.18009ed8
jmp 0x18085eb5
or esi, ecx
jge 0x18085e85
push edx
lea ecx, [esp + 0x80]
call fcn.1800773c
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x34]
push ecx
xor ecx, ecx
push ecx
push edi
push dword [esp + 0x24]
push ecx
push ecx
push ecx
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push 0xffffffffffffffff
lea ecx, [esp + 0x80]
mov esi, eax
call fcn.18009ed8
xor ebx, ebx
test esi, esi
jne 0x18085ed5
call fcn.1801bab5
push ebx
mov edi, eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [esp + 0x7c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
jmp 0x18085f0e
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x18085ef3
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18085ef9
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
push ebx
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov ecx, dword [esp + 0x7c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov edi, ebx
cmp dword [esp + 0x80], 0
je 0x18085f25
push dword [esp + 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.18122438
mov esp, ebp
pop ebp
ret