Function at 0x1010dbc
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r13, r9
mov r14, r8
mov r12d, edx
mov ebx, 1
mov rax, qword [0x01043880]
mov qword [r11 - 0x110], rax
xor r15d, r15d
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov dword [r11 - 0x118], r15d
mov qword [rsp + 0x68], r15
mov dword [r11 - 0x120], r15d
mov dword [r11 - 0x11c], r15d
lea rcx, [0x010044b0]
call fcn.0100fdd0
xor edx, edx
lea r8d, [rbx + 0x37]
lea rcx, [rsp + 0xc0]
call fcn.010328a0
lea rcx, [rsp + 0x80]
call fcn.010123bc
mov ebp, eax
cmp eax, r15d
je 0x1010efe
lea rcx, [0x010044f0]
call fcn.0100fdd0
lea rcx, [rsp + 0x80]
call fcn.0101262c
mov ebx, eax
mov esi, dword [rsp + 0x88]
cmp eax, r15d
je 0x1010edd
lea rcx, [0x01004580]
call fcn.0100fdd0
cmp esi, r15d
je 0x1010eca
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8d, [r15 + 5]
mov edx, r12d
lea rcx, [rsp + 0x80]
call fcn.01012794
mov ebx, eax
jmp 0x1010ed8
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
cmp ebx, r15d
jne 0x1010f05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01004620]
call fcn.0100fdd0
mov rdi, qword [rsp + 0x80]
jmp 0x1011121
mov esi, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
lea rcx, [0x010046b0]
call fcn.0100fdd0
mov rdi, qword [rsp + 0x80]
cmp ebp, r15d
je 0x1010f96
lea rcx, [0x01004710]
call fcn.0100fdd0
lea rcx, [0x01004790]
call fcn.0100fdd0
cmp esi, r15d
je 0x1010f7c
lea rdx, [0x01006420]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x1010f63
lea rdx, [rsp + 0x78]
mov ecx, r12d
call rax
mov ebx, eax
jmp 0x1010f96
lea rcx, [0x01006440]
call fcn.0100fdd0
mov ecx, 0x2001000b
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1010f93
lea rcx, [0x010064c0]
call fcn.0100fdd0
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
cmp ebx, r15d
jne 0x1010fb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01004820]
call fcn.0100fdd0
jmp 0x1011121
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r12d, 1
mov dword [rsp + 0x20], r12d
mov r9d, r12d
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, eax
cmp eax, r15d
jne 0x1010fff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x010048a0]
call fcn.0100fdd0
jmp 0x1011121
mov r8d, r12d
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call sub.USERENV.dll_CreateEnvironmentBlock
mov ebx, eax
cmp eax, r15d
jne 0x1011031
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01004920]
call fcn.0100fdd0
jmp 0x1011121
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov r9, qword [r13]
mov r8, qword [r14]
lea rdx, [0x010049a8]
lea rcx, [rsp + 0x98]
call fcn.0100e6e8
mov rdx, qword [r13]
lea rcx, [0x010049c0]
call fcn.0100fdd0
lea rcx, [0x01004a20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, r12d
movsxd rdx, eax
lea r8, [0x01004a20]
mov rcx, qword [rsp + 0x110]
call fcn.0100cd68
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, qword [r13]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
cmp eax, r15d
jne 0x1011100
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x01004a40]
call fcn.0100fdd0
mov ebx, r15d
jmp 0x1011121
mov r8, qword [r13]
mov rdx, qword [r14]
lea rcx, [0x01004ad0]
call fcn.0100fdd0
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x68]
cmp rdx, r15
je 0x1011154
cmp ebp, r15d
je 0x101116a
cmp esi, r15d
je 0x1011144
lea rcx, [rsp + 0x80]
call fcn.01012808
jmp 0x101114f
mov ecx, 0x2001000a
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x68], r15
cmp ebp, r15d
je 0x101116a
cmp rdi, r15
je 0x101116a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, r15
mov rdx, qword [rsp + 0xf0]
cmp rdx, r15
je 0x1011182
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x70]
cmp rcx, r15
je 0x1011196
call sub.USERENV.dll_DestroyEnvironmentBlock
mov qword [rsp + 0x70], r15
mov rcx, qword [rsp + 0x78]
cmp rcx, r15
je 0x10111ab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x60]
cmp rcx, r15
je 0x10111c0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r15
cmp rdi, r15
je 0x10111cf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x98]
call fcn.0100d9e0
nop
mov rcx, r14
call fcn.0100d9e0
nop
mov rcx, r13
call fcn.0100d9e0
mov eax, ebx
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret