Function at 0x1400573d0
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x14010a010]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rdi, r8
mov rbx, rdx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], r8
mov edx, 0x5c
lea rsi, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceProcessHelper.cpp
mov rcx, rsi
call fcn.14008d088
test rax, rax
je 0x140057439
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d088
inc rax
jmp 0x14005743c
mov rax, rsi
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140057449
mov rcx, qword [rdi]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140057456
mov rdx, qword [rbx]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea r9, str.filePath___s__args___s
lea r8, str.CreateProcessInWinLogon
mov edx, 0x91
mov rcx, rax
call fcn.140015a30
xor r15d, r15d
mov r12d, r15d
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov r13d, eax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400574ba
mov dword [rbp + 0x40], 0x238
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14005755f
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400574f9
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x1400574f4
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057a06
mov rcx, r8
call fcn.140061000
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140057548
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x140057543
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057a0c
mov rcx, r8
call fcn.140061000
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
xor al, al
jmp 0x1400579dc
lea r15, str.winlogon.exe
nop word [rax + rax]
lea rdx, [rbp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x1400575bf
add rax, 2
cmp rax, 0xd
je 0x1400575a4
movzx ecx, word [rdx + rax*2]
cmp cx, word [r15 + rax*2]
jne 0x1400575bf
jmp 0x140057580
mov dword [rbp + 0x20], r12d
lea rdx, [rbp + 0x20]
mov ecx, dword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1400575bf
cmp dword [rbp + 0x20], r13d
je 0x1400575d2
lea rdx, [rbp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400575d6
jmp 0x140057570
mov r12d, dword [rbp + 0x48]
lea rdx, [rsp + 0x78]
mov ecx, r13d
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
mov r15d, 0x8000020
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x50], 0x68
mov eax, 5
mov word [rbp - 0x10], ax
lea rax, str.Winsta0Winlogon
mov qword [rbp - 0x40], rax
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov r8d, r12d
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
lea r8, [rsp + 0x70]
mov edx, 0x201eb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400576a5
lea edx, [rax + 0x5c]
mov rcx, rsi
call fcn.14008d088
test rax, rax
je 0x14005767d
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d088
lea r14, [rax + 1]
jmp 0x140057680
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Process_token_open_Error:__u_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xd2
mov rcx, r14
call fcn.140015a30
lea r8, [rbp + 0x28]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140057707
lea edx, [rax + 0x5c]
mov rcx, rsi
call fcn.14008d088
test rax, rax
je 0x1400576df
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d088
lea r14, [rax + 1]
jmp 0x1400576e2
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Lookup_Privilege_value_Error:__u_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xd7
mov rcx, r14
call fcn.140015a30
mov dword [rbp + 0x30], 1
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x34], rax
mov dword [rbp + 0x3c], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov r8, r13
mov edx, 0xc
lea r9d, [rdx - 8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x10]
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400577cf
lea edx, [rax + 0x5c]
mov rcx, rsi
call fcn.14008d088
test rax, rax
je 0x1400577a7
lea edx, [r13 + 0x5c]
mov rcx, rsi
call fcn.14008d088
lea r14, [rax + 1]
jmp 0x1400577aa
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Adjust_Privilege_value_Error:__u_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xe7
mov rcx, r14
call fcn.140015a30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14005781e
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d088
test rax, rax
je 0x140057800
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d088
inc rax
jmp 0x140057803
mov rax, rsi
lea r9, str.Token_does_not_have_the_provilege_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xec
mov rcx, rax
call fcn.140015a30
mov qword [rsp + 0x68], r13
mov r8d, 1
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14005784a
mov r15d, 0x8000420
mov rax, qword [rsp + 0x68]
jmp 0x140057852
mov rax, r13
mov qword [rsp + 0x68], rax
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14005785f
mov r8, qword [rdi]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14005786c
mov rdx, qword [rbx]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d088
test rax, rax
je 0x1400578d4
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d088
lea rsi, [rax + 1]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
lea r9, str.iResultOfCreateProcessAsUser_:__d__CreateProcessAsUser_result___d_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0x10c
mov rcx, rsi
call fcn.140015a30
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
setne sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14005797d
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140057978
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057a06
mov rcx, r8
call fcn.140061000
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400579c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400579c3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057a0c
mov rcx, r8
call fcn.140061000
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
movzx eax, sil
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140060fe0
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140091a84
nop
call fcn.140091a84
int3