Function at 0x140009590
Capabilities:
Acquire debug privileges
Enumerate processes
Resume thread

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x318
mov rbx, rcx
mov rsi, rdx
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x140009672
mov qword [rsp + 0x310], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 8
lea r8, [rsp + 0x310]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400096bc
mov rcx, qword [rsp + 0x310]
lea rdx, [0x140019c30]
call fcn.140003e20
test eax, eax
je 0x140009691
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0x58]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x58], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov rcx, rdi
lea rdx, [rsp + 0x58]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400096c3
lea rdx, [rsp + 0x84]
lea r8, str.winlogon.exe
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x1400096ef
add rcx, 2
test ax, ax
jne 0x140009655
jmp 0x140009702
mov rcx, rbx
lea rdx, str.Required_run_as_Administrator.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400096bc
mov rcx, rbx
lea rdx, str.The__SeDebugPrivilege__is_disabled._nUse_the_Privileges_and_Access_Rights_Manager.
lea r8, [0x14001a1cc]
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400098d0
xor r12, r12
jmp 0x140009717
lea rdx, [rsp + 0x84]
lea r8, str.winlogon.exe
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x1400096ef
add rcx, 2
test ax, ax
jne 0x1400096d9
jmp 0x140009702
mov rcx, rdi
lea rdx, [rsp + 0x58]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400096c8
jmp 0x1400096c3
mov r8d, dword [rsp + 0x60]
mov ecx, pe_nt_image_headers64
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140019b66]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rdi, rdi
je 0x140009791
mov rcx, rdi
lea rdx, str.RtlDosPathNameToNtPathName_U
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400235a0], rax
mov rcx, rdi
lea rdx, str.RtlCreateProcessParametersEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400235c0], rax
mov rcx, rdi
lea rdx, str.RtlCreateUserProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023600], rax
mov rcx, rdi
lea rdx, str.RtlDestroyProcessParameters
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400235e0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x2f8], xmm0
mov qword [rsp + 0x308], 0
lea rdi, [rsp + 0x290]
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rcx, str.SystemResearch.exe
lea rdx, [rsp + 0x2f8]
xor r8, r8
xor r9, r9
call qword [0x1400235a0]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x308]
lea rdx, [rsp + 0x2f8]
xor r8, r8
xor r9, r9
call qword [0x1400235c0]
lea rax, [rsp + 0x290]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x2f8]
mov edx, 0x200
mov r8, qword [rsp + 0x308]
xor r9, r9
call qword [0x140023600]
mov rcx, qword [rsp + 0x308]
call qword [0x1400235e0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.USER32.dll_EndDialog]
mov eax, 1
add rsp, 0x318
pop r12
pop rdi
pop rsi
pop rbx
ret