Function at 0x1013d24
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r13, r9
mov r14, r8
mov r12d, edx
mov ebx, 1
mov rax, qword [0x01046880]
mov qword [r11 - 0x110], rax
xor r15d, r15d
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov dword [r11 - 0x118], r15d
mov qword [rsp + 0x68], r15
mov dword [r11 - 0x120], r15d
mov dword [r11 - 0x11c], r15d
lea rcx, [0x01007470]
call fcn.01012d38
xor edx, edx
lea r8d, [rbx + 0x37]
lea rcx, [rsp + 0xc0]
call fcn.01035300
lea rcx, [rsp + 0x80]
call fcn.01015324
mov ebp, eax
cmp eax, r15d
je 0x1013e66
lea rcx, [0x010074b0]
call fcn.01012d38
lea rcx, [rsp + 0x80]
call fcn.01015594
mov ebx, eax
mov esi, dword [rsp + 0x88]
cmp eax, r15d
je 0x1013e45
lea rcx, [0x01007540]
call fcn.01012d38
cmp esi, r15d
je 0x1013e32
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8d, [r15 + 5]
mov edx, r12d
lea rcx, [rsp + 0x80]
call fcn.010156fc
mov ebx, eax
jmp 0x1013e40
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
cmp ebx, r15d
jne 0x1013e6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x010075e0]
call fcn.01012d38
mov rdi, qword [rsp + 0x80]
jmp 0x1014089
mov esi, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
lea rcx, [0x01007670]
call fcn.01012d38
mov rdi, qword [rsp + 0x80]
cmp ebp, r15d
je 0x1013efe
lea rcx, [0x010076d0]
call fcn.01012d38
lea rcx, [0x01007750]
call fcn.01012d38
cmp esi, r15d
je 0x1013ee4
lea rdx, [0x010093e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x1013ecb
lea rdx, [rsp + 0x78]
mov ecx, r12d
call rax
mov ebx, eax
jmp 0x1013efe
lea rcx, [0x01009400]
call fcn.01012d38
mov ecx, 0x2001000b
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1013efb
lea rcx, [0x01009480]
call fcn.01012d38
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
cmp ebx, r15d
jne 0x1013f1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x010077e0]
call fcn.01012d38
jmp 0x1014089
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r12d, 1
mov dword [rsp + 0x20], r12d
mov r9d, r12d
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, eax
cmp eax, r15d
jne 0x1013f67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01007860]
call fcn.01012d38
jmp 0x1014089
mov r8d, r12d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call sub.USERENV.dll_CreateEnvironmentBlock
mov ebx, eax
cmp eax, r15d
jne 0x1013f99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x010078e0]
call fcn.01012d38
jmp 0x1014089
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov r9, qword [r13]
mov r8, qword [r14]
lea rdx, [0x01007968]
lea rcx, [rsp + 0x98]
call fcn.01011648
mov rdx, qword [r13]
lea rcx, [0x01007980]
call fcn.01012d38
lea rcx, [0x010079e0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, r12d
movsxd rdx, eax
lea r8, [0x010079e0]
mov rcx, qword [rsp + 0x110]
call fcn.0100fc98
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, qword [r13]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
cmp eax, r15d
jne 0x1014068
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01007a00]
call fcn.01012d38
mov ebx, r15d
jmp 0x1014089
mov r8, qword [r13]
mov rdx, qword [r14]
lea rcx, [0x01007a90]
call fcn.01012d38
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x68]
cmp rdx, r15
je 0x10140bc
cmp ebp, r15d
je 0x10140d2
cmp esi, r15d
je 0x10140ac
lea rcx, [rsp + 0x80]
call fcn.01015770
jmp 0x10140b7
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x68], r15
cmp ebp, r15d
je 0x10140d2
cmp rdi, r15
je 0x10140d2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, r15
mov rdx, qword [rsp + 0xf0]
cmp rdx, r15
je 0x10140ea
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x70]
cmp rcx, r15
je 0x10140fe
call sub.USERENV.dll_DestroyEnvironmentBlock
mov qword [rsp + 0x70], r15
mov rcx, qword [rsp + 0x78]
cmp rcx, r15
je 0x1014113
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x1014128
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r15
cmp rdi, r15
je 0x1014137
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x98]
call fcn.01010940
nop
mov rcx, r14
call fcn.01010940
nop
mov rcx, r13
call fcn.01010940
mov eax, ebx
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret