Function at 0x1400576e0
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x14010b010]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rdi, r8
mov rbx, rdx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], r8
mov edx, 0x5c
lea rsi, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceProcessHelper.cpp
mov rcx, rsi
call fcn.14008d398
test rax, rax
je 0x140057749
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d398
inc rax
jmp 0x14005774c
mov rax, rsi
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140057759
mov rcx, qword [rdi]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140057766
mov rdx, qword [rbx]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea r9, str.filePath___s__args___s
lea r8, str.CreateProcessInWinLogon
mov edx, 0x91
mov rcx, rax
call fcn.140015b90
xor r15d, r15d
mov r12d, r15d
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov r13d, eax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400577ca
mov dword [rbp + 0x40], 0x238
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14005786f
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140057809
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140057804
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057d16
mov rcx, r8
call fcn.140061310
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140057858
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x140057853
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057d1c
mov rcx, r8
call fcn.140061310
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
xor al, al
jmp 0x140057cec
lea r15, str.winlogon.exe
nop word [rax + rax]
lea rdx, [rbp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x1400578cf
add rax, 2
cmp rax, 0xd
je 0x1400578b4
movzx ecx, word [rdx + rax*2]
cmp cx, word [r15 + rax*2]
jne 0x1400578cf
jmp 0x140057890
mov dword [rbp + 0x20], r12d
lea rdx, [rbp + 0x20]
mov ecx, dword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x1400578cf
cmp dword [rbp + 0x20], r13d
je 0x1400578e2
lea rdx, [rbp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400578e6
jmp 0x140057880
mov r12d, dword [rbp + 0x48]
lea rdx, [rsp + 0x78]
mov ecx, r13d
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
mov r15d, 0x8000020
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x50], 0x68
mov eax, 5
mov word [rbp - 0x10], ax
lea rax, str.Winsta0Winlogon
mov qword [rbp - 0x40], rax
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov r8d, r12d
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
lea r8, [rsp + 0x70]
mov edx, 0x201eb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400579b5
lea edx, [rax + 0x5c]
mov rcx, rsi
call fcn.14008d398
test rax, rax
je 0x14005798d
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d398
lea r14, [rax + 1]
jmp 0x140057990
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Process_token_open_Error:__u_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xd2
mov rcx, r14
call fcn.140015b90
lea r8, [rbp + 0x28]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140057a17
lea edx, [rax + 0x5c]
mov rcx, rsi
call fcn.14008d398
test rax, rax
je 0x1400579ef
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d398
lea r14, [rax + 1]
jmp 0x1400579f2
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Lookup_Privilege_value_Error:__u_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xd7
mov rcx, r14
call fcn.140015b90
mov dword [rbp + 0x30], 1
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x34], rax
mov dword [rbp + 0x3c], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov r8, r13
mov edx, 0xc
lea r9d, [rdx - 8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x10]
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140057adf
lea edx, [rax + 0x5c]
mov rcx, rsi
call fcn.14008d398
test rax, rax
je 0x140057ab7
lea edx, [r13 + 0x5c]
mov rcx, rsi
call fcn.14008d398
lea r14, [rax + 1]
jmp 0x140057aba
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.Adjust_Privilege_value_Error:__u_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xe7
mov rcx, r14
call fcn.140015b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x140057b2e
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d398
test rax, rax
je 0x140057b10
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d398
inc rax
jmp 0x140057b13
mov rax, rsi
lea r9, str.Token_does_not_have_the_provilege_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0xec
mov rcx, rax
call fcn.140015b90
mov qword [rsp + 0x68], r13
mov r8d, 1
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x140057b5a
mov r15d, 0x8000420
mov rax, qword [rsp + 0x68]
jmp 0x140057b62
mov rax, r13
mov qword [rsp + 0x68], rax
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140057b6f
mov r8, qword [rdi]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140057b7c
mov rdx, qword [rbx]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d398
test rax, rax
je 0x140057be4
mov edx, 0x5c
mov rcx, rsi
call fcn.14008d398
lea rsi, [rax + 1]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
lea r9, str.iResultOfCreateProcessAsUser_:__d__CreateProcessAsUser_result___d_n
lea r8, str.CreateProcessInWinLogon
mov edx, 0x10c
mov rcx, rsi
call fcn.140015b90
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
setne sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140057c8d
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140057c88
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057d16
mov rcx, r8
call fcn.140061310
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140057cd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140057cd3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057d1c
mov rcx, r8
call fcn.140061310
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
movzx eax, sil
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400612f0
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140091d94
nop
call fcn.140091d94
int3