Function at 0x100012b00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x530
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov edi, dword [0x10001d950]
lea rcx, [rsp + 0x310]
mov edx, 0x104
call fcn.100012778
test eax, eax
jne 0x100012b86
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x100012e38
test byte [rcx + 0x1c], 8
je 0x100012e38
cmp byte [rcx + 0x19], 2
jb 0x100012e38
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xe]
lea r8, [0x100016ca0]
mov r9d, edi
call fcn.100001e70
jmp 0x100012e38
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x100012df8
and qword [rsp + 0x68], 0
mov r9d, 8
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x68]
lea edx, [r9 - 1]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x100012daa
lea r8, [rsp + 0x60]
mov edx, 0x2000000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100012d7f
mov ebx, 0x68
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8, rbx
call sub.msvcrt.dll_memset
xor r11d, r11d
lea r9, [rsp + 0x310]
lea r8, str._s__d__p__d
lea rcx, [rsp + 0x100]
mov edx, 0x104
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x78], r11
mov qword [rsp + 0x80], r11
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x20], edi
call fcn.100002858
cmp qword [rsp + 0x68], 0
lea rbx, [0x10001d1e0]
je 0x100012ca0
mov rcx, qword [0x10001d1e0]
cmp rcx, rbx
je 0x100012c87
test byte [rcx + 0x1c], 8
je 0x100012c87
cmp byte [rcx + 0x19], 2
jb 0x100012c87
mov rcx, qword [rcx + 0x10]
lea r8, [0x100016ca0]
mov edx, 0xf
mov r9d, edi
call fcn.100001e70
lea r8, str.__pv
lea rcx, [rsp + 0x100]
mov edx, 0x104
call fcn.1000016b4
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x100]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x48], rax
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x100012d34
mov rcx, qword [0x10001d1e0]
cmp rcx, rbx
je 0x100012d1c
test byte [rcx + 0x1c], 8
je 0x100012d1c
cmp byte [rcx + 0x19], 4
jb 0x100012d1c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100016ca0]
mov edx, 0x10
call fcn.10000121c
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100012d72
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x10001d1e0]
cmp rcx, rbx
je 0x100012d72
test byte [rcx + 0x1c], 8
je 0x100012d72
cmp byte [rcx + 0x19], 2
jb 0x100012d72
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x100]
lea r8, [0x100016ca0]
mov edx, 0x11
mov dword [rsp + 0x20], eax
call fcn.1000126c4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100012ded
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x100012ded
test byte [rcx + 0x1c], 8
je 0x100012ded
cmp byte [rcx + 0x19], 2
jb 0x100012ded
mov edx, 0x12
jmp 0x100012dd6
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x100012ded
test byte [rcx + 0x1c], 8
je 0x100012ded
cmp byte [rcx + 0x19], 2
jb 0x100012ded
mov edx, 0x13
mov rcx, qword [rcx + 0x10]
lea r8, [0x100016ca0]
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.10000a8d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100012e38
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x10001d1e0]
lea rbx, [0x10001d1e0]
cmp rcx, rbx
je 0x100012e38
test byte [rcx + 0x1c], 8
je 0x100012e38
cmp byte [rcx + 0x19], 2
jb 0x100012e38
mov rcx, qword [rcx + 0x10]
lea r8, [0x100016ca0]
mov edx, 0x14
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.10000a8d0
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.100001000
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret