Function at 0x1800114b5
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x180014f10
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x7b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x152
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x7d8]
lea rcx, [0x180032170]
call fcn.18001147e
nop
mov dword [rbp + 4], 0
mov dword [rbp + 0x64], 0
call fcn.180011294
mov eax, dword [rax + 0x2c0]
mov dword [rbp + 0x84], eax
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x288], 0
lea rax, str.Unknown
mov qword [rbp + 0x2f8], rax
mov edx, 0x20a
lea rcx, [rbp + 0x320]
call fcn.180011343
nop
mov r8d, 0x104
lea rdx, [rbp + 0x320]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x180014fe8
xor eax, eax
jmp 0x180015857
mov ecx, 0x2000
call fcn.180011096
mov qword [rbp + 0x2d8], rax
cmp qword [rbp + 0x2d8], 0
jne 0x18001500a
xor eax, eax
jmp 0x180015857
mov r9d, 0x104
lea r8, [rbp + 0x320]
mov edx, 0x104
mov rcx, qword [rbp + 0x2d8]
call fcn.180011235
nop
mov edx, 0x30
lea rcx, [rbp + 0x108]
call fcn.180011343
nop
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rbp + 0x108]
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x1800151db
lea rdx, str._r_nInherited_from_PID
lea rcx, [rbp + 0x320]
call fcn.1800110aa
nop
lea rcx, [rbp + 0x320]
call fcn.1800114d8
mov rdx, rax
mov rcx, qword [rbp + 0x130]
call fcn.1800112b2
nop
lea rdx, [rbp + 0x320]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
lea rdx, [0x180022f94]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
mov edx, 0x20a
lea rcx, [rbp + 0x320]
call fcn.180011343
nop
mov dword [rbp + 4], 0
mov ecx, 5
call fcn.1800112c1
mov qword [rbp + 0x1b8], rax
cmp qword [rbp + 0x1b8], 0
je 0x180015197
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x130]
cmp qword [rax + 0x50], rcx
jne 0x18001515d
mov rax, qword [rbp + 0x1d8]
movzx eax, word [rax + 0x38]
xor edx, edx
mov ecx, 2
div rcx
mov r9, rax
mov rax, qword [rbp + 0x1d8]
mov r8, qword [rax + 0x40]
mov edx, 0x104
lea rcx, [rbp + 0x320]
call fcn.180011235
nop
mov dword [rbp + 4], 1
jmp 0x18001518a
mov rax, qword [rbp + 0x1d8]
cmp dword [rax], 0
jne 0x18001516b
jmp 0x18001518a
mov rax, qword [rbp + 0x1d8]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x1d8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x1d8], rax
jmp 0x18001510b
mov rcx, qword [rbp + 0x1b8]
call fcn.1800113ed
nop
cmp dword [rbp + 4], 0
je 0x1800151b3
lea rdx, [rbp + 0x320]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
jmp 0x1800151c7
lea rdx, str.Non_existent_Process
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
lea rdx, [0x180022fd4]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
lea r8, [rbp + 0xa8]
mov edx, 8
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x180015768
mov dword [rbp + 0x64], 0
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x19
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0xc0000023
jne 0x180015404
mov eax, dword [rbp + 0x64]
mov ecx, eax
call fcn.180011096
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
je 0x180015404
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x64]
mov r8, qword [rbp + 0xc8]
mov edx, 0x19
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x1800153f7
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_RtlSubAuthorityCountSid]
movzx eax, byte [rax]
dec eax
movzx eax, al
mov edx, eax
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov eax, dword [rax]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x1800152d3
lea rax, [0x180022fd8]
mov qword [rbp + 0x2f8], rax
jmp 0x180015369
cmp dword [rbp + 0x44], 0x1000
jne 0x1800152ec
lea rax, str.LowIL
mov qword [rbp + 0x2f8], rax
jmp 0x180015369
cmp dword [rbp + 0x44], 0x2000
jb 0x18001530e
cmp dword [rbp + 0x44], 0x3000
jae 0x18001530e
lea rax, str.MediumIL
mov qword [rbp + 0x2f8], rax
jmp 0x180015369
cmp dword [rbp + 0x44], 0x3000
jb 0x180015330
cmp dword [rbp + 0x44], 0x4000
jae 0x180015330
lea rax, str.HighIL
mov qword [rbp + 0x2f8], rax
jmp 0x180015369
cmp dword [rbp + 0x44], 0x4000
jb 0x180015352
cmp dword [rbp + 0x44], 0x5000
jae 0x180015352
lea rax, str.SystemIL
mov qword [rbp + 0x2f8], rax
jmp 0x180015369
cmp dword [rbp + 0x44], 0x5000
jb 0x180015369
lea rax, str.ProtectedProcessIL
mov qword [rbp + 0x2f8], rax
lea rdx, str._r_nPID
lea rcx, [rbp + 0x320]
call fcn.1800110aa
nop
lea rcx, [rbp + 0x320]
call fcn.1800114d8
mov qword [rbp + 0x778], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbp + 0x778]
mov rdx, rcx
mov ecx, eax
call fcn.180011325
nop
lea rdx, [0x180023088]
lea rcx, [rbp + 0x320]
call fcn.18001143d
nop
lea rcx, [rbp + 0x320]
call fcn.1800114d8
mov r9d, 0x28
mov r8, qword [rbp + 0x2f8]
mov edx, 0x28
mov rcx, rax
call fcn.180011235
nop
lea rdx, [rbp + 0x320]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
mov rcx, qword [rbp + 0xc8]
call fcn.1800113ed
nop
mov dword [rbp + 0x64], 0
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0xc0000023
jne 0x1800156c9
mov eax, dword [rbp + 0x64]
mov ecx, eax
call fcn.180011096
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
je 0x1800156c9
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x64]
mov r8, qword [rbp + 0xe8]
mov edx, 1
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x1800156bc
mov dword [rbp + 0x2a8], 0xc
mov dword [rbp + 0x2ac], 2
mov byte [rbp + 0x2b0], 1
mov byte [rbp + 0x2b1], 0
mov dword [rbp + 0x1f8], 0x30
mov qword [rbp + 0x200], 0
mov dword [rbp + 0x210], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x220], 0
lea rax, [rbp + 0x2a8]
mov qword [rbp + 0x220], rax
lea r9, [rbp + 0x248]
mov r8d, 0x800
lea rdx, [rbp + 0x1f8]
xor ecx, ecx
call fcn.180011406
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x1800156bc
mov rax, qword [rbp + 0xe8]
lea rcx, [rbp + 0x288]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x268]
mov r8, rax
mov edx, 1
mov rcx, qword [rbp + 0x248]
call fcn.180011415
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x180015681
cmp dword [rbp + 0x24], 0x107
je 0x180015681
cmp qword [rbp + 0x268], 0
je 0x18001561b
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rbp + rax + 0x320], cx
mov eax, 0x18
imul rax, rax, 0
mov rcx, qword [rbp + 0x268]
mov rcx, qword [rcx + 8]
movzx eax, word [rcx + rax]
xor edx, edx
mov ecx, 2
div rcx
mov ecx, 0x18
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x268]
mov rdx, qword [rdx + 8]
mov r9, rax
mov r8, qword [rdx + rcx + 8]
mov edx, 0x104
lea rcx, [rbp + 0x320]
call fcn.180011235
nop
lea rdx, [0x180023090]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
lea rdx, [rbp + 0x320]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
lea rdx, [0x180023098]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
cmp qword [rbp + 0x288], 0
je 0x180015681
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rbp + rax + 0x320], cx
mov rax, qword [rbp + 0x288]
movzx eax, word [rax + 8]
xor edx, edx
mov ecx, 2
div rcx
mov r9, rax
mov rax, qword [rbp + 0x288]
mov r8, qword [rax + 0x10]
mov edx, 0x104
lea rcx, [rbp + 0x320]
call fcn.180011235
nop
lea rdx, [rbp + 0x320]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
cmp qword [rbp + 0x268], 0
je 0x180015698
mov rcx, qword [rbp + 0x268]
call fcn.1800110d7
nop
cmp qword [rbp + 0x288], 0
je 0x1800156af
mov rcx, qword [rbp + 0x288]
call fcn.1800110d7
nop
mov rcx, qword [rbp + 0x248]
call fcn.180011307
nop
mov rcx, qword [rbp + 0xe8]
call fcn.1800113ed
nop
mov dword [rbp + 0x64], 0
lea rdx, str._r_nSessionId
lea rcx, [rbp + 0x320]
call fcn.1800110aa
nop
lea rcx, [rbp + 0x320]
call fcn.1800114d8
mov rdx, rax
mov ecx, dword [rbp + 0x84]
call fcn.180011325
nop
lea rdx, [rbp + 0x320]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
lea rdx, str._r_nInteractive_Winstation
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
call fcn.180011299
test eax, eax
je 0x180015746
lea rdx, [0x180023100]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
jmp 0x18001575a
lea rdx, [0x18002310c]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
nop
mov edx, 0x40
lea rcx, [rbp + 0x160]
call fcn.180011343
nop
mov qword [rbp + 0x160], 0x40
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rbp + 0x160]
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jl 0x1800157fb
lea rdx, str._r_nWOW64_Enabled
lea rcx, [rbp + 0x320]
call fcn.1800110aa
nop
lea rcx, [rbp + 0x320]
call fcn.1800114d8
mov ecx, dword [rbp + 0x198]
shr ecx, 1
and ecx, 1
mov rdx, rax
call fcn.180011325
nop
lea rdx, [rbp + 0x320]
mov rcx, qword [rbp + 0x2d8]
call fcn.18001143d
nop
cmp dword [rbp + 0x7a0], 0
jne 0x180015850
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp + 0x778], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r9d, 0x40
mov rcx, qword [rbp + 0x778]
mov r8, rcx
mov rdx, qword [rbp + 0x2d8]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rbp + 0x2d8]
call fcn.1800113ed
nop
mov qword [rbp + 0x2d8], 0
mov rax, qword [rbp + 0x2d8]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x180021e40]
call fcn.1800113d4
mov rax, rdi
lea rsp, [rbp + 0x788]
pop rdi
pop rbp
ret