Function at 0x1012d24
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r13, r9
mov r14, r8
mov r12d, edx
mov ebx, 1
mov rax, qword [0x01045880]
mov qword [r11 - 0x110], rax
xor r15d, r15d
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov dword [r11 - 0x118], r15d
mov qword [rsp + 0x68], r15
mov dword [r11 - 0x120], r15d
mov dword [r11 - 0x11c], r15d
lea rcx, [0x01006470]
call fcn.01011d38
xor edx, edx
lea r8d, [rbx + 0x37]
lea rcx, [rsp + 0xc0]
call fcn.01034300
lea rcx, [rsp + 0x80]
call fcn.01014324
mov ebp, eax
cmp eax, r15d
je 0x1012e66
lea rcx, [0x010064b0]
call fcn.01011d38
lea rcx, [rsp + 0x80]
call fcn.01014594
mov ebx, eax
mov esi, dword [rsp + 0x88]
cmp eax, r15d
je 0x1012e45
lea rcx, [0x01006540]
call fcn.01011d38
cmp esi, r15d
je 0x1012e32
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8d, [r15 + 5]
mov edx, r12d
lea rcx, [rsp + 0x80]
call fcn.010146fc
mov ebx, eax
jmp 0x1012e40
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
cmp ebx, r15d
jne 0x1012e6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x010065e0]
call fcn.01011d38
mov rdi, qword [rsp + 0x80]
jmp 0x1013089
mov esi, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
lea rcx, [0x01006670]
call fcn.01011d38
mov rdi, qword [rsp + 0x80]
cmp ebp, r15d
je 0x1012efe
lea rcx, [0x010066d0]
call fcn.01011d38
lea rcx, [0x01006750]
call fcn.01011d38
cmp esi, r15d
je 0x1012ee4
lea rdx, [0x010083e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x1012ecb
lea rdx, [rsp + 0x78]
mov ecx, r12d
call rax
mov ebx, eax
jmp 0x1012efe
lea rcx, [0x01008400]
call fcn.01011d38
mov ecx, 0x2001000b
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1012efb
lea rcx, [0x01008480]
call fcn.01011d38
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
cmp ebx, r15d
jne 0x1012f1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x010067e0]
call fcn.01011d38
jmp 0x1013089
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r12d, 1
mov dword [rsp + 0x20], r12d
mov r9d, r12d
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, eax
cmp eax, r15d
jne 0x1012f67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01006860]
call fcn.01011d38
jmp 0x1013089
mov r8d, r12d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call sub.USERENV.dll_CreateEnvironmentBlock
mov ebx, eax
cmp eax, r15d
jne 0x1012f99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x010068e0]
call fcn.01011d38
jmp 0x1013089
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov r9, qword [r13]
mov r8, qword [r14]
lea rdx, [0x01006968]
lea rcx, [rsp + 0x98]
call fcn.01010648
mov rdx, qword [r13]
lea rcx, [0x01006980]
call fcn.01011d38
lea rcx, [0x010069e0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, r12d
movsxd rdx, eax
lea r8, [0x010069e0]
mov rcx, qword [rsp + 0x110]
call fcn.0100ec98
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, qword [r13]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
cmp eax, r15d
jne 0x1013068
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01006a00]
call fcn.01011d38
mov ebx, r15d
jmp 0x1013089
mov r8, qword [r13]
mov rdx, qword [r14]
lea rcx, [0x01006a90]
call fcn.01011d38
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x68]
cmp rdx, r15
je 0x10130bc
cmp ebp, r15d
je 0x10130d2
cmp esi, r15d
je 0x10130ac
lea rcx, [rsp + 0x80]
call fcn.01014770
jmp 0x10130b7
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x68], r15
cmp ebp, r15d
je 0x10130d2
cmp rdi, r15
je 0x10130d2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, r15
mov rdx, qword [rsp + 0xf0]
cmp rdx, r15
je 0x10130ea
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x70]
cmp rcx, r15
je 0x10130fe
call sub.USERENV.dll_DestroyEnvironmentBlock
mov qword [rsp + 0x70], r15
mov rcx, qword [rsp + 0x78]
cmp rcx, r15
je 0x1013113
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x1013128
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r15
cmp rdi, r15
je 0x1013137
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x98]
call fcn.0100f940
nop
mov rcx, r14
call fcn.0100f940
nop
mov rcx, r13
call fcn.0100f940
mov eax, ebx
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret