Function at 0x14004f3d0
Capabilities:
Acquire debug privileges
Compare security identifiers
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x580], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov r15d, r9d
movzx r14d, r8b
mov ebx, edx
mov qword [rbp - 0x50], rcx
mov r13, qword [rbp + 0x490]
mov r12, qword [rbp + 0x4a0]
xor edi, edi
mov dword [rsp + 0x60], edi
movdqa xmm0, xmmword [0x1402d0510]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], dil
lea r8d, [rdi + 0x11]
lea rdx, str.WTSQueryUserToken
lea rcx, [rbp + 0x48]
call fcn.140004c40
nop
lea rdx, str.wtsapi32.dll
lea rcx, [rbp + 0x90]
call fcn.14001c840
nop
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x48]
call fcn.14004ba50
nop
lea rcx, [rbp + 0x90]
call fcn.14001d440
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x14004f4c4
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f4bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004fa4e
call fcn.140283144
movdqa xmm0, xmmword [0x1402d0510]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x14004f607
test ebx, ebx
jne 0x14004f4f1
call fcn.14002d8d0
mov ebx, eax
mov rax, qword [rbp - 0x48]
mov dword [rsp + 0x78], edi
mov rsi, rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
lea rdx, [rsp + 0x68]
mov ecx, ebx
call rax
test eax, eax
jne 0x14004f5ef
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004f528
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rdi
mov esi, edi
call fcn.140053da0
xor edx, edx
lea ecx, [rdx + 2]
call qword [rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004f607
mov dword [rbp + 0xe0], pe_nt_image_headers64
call fcn.140053da0
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x14004f5b3
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x10c]
call fcn.14029a60c
test eax, eax
jne 0x14004f599
mov dword [rsp + 0x60], esi
lea rdx, [rsp + 0x60]
mov ecx, dword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14004f599
cmp dword [rsp + 0x60], ebx
je 0x14004f5ad
call fcn.140053da0
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call qword [rax + reloc.ODBC32.dll_SQLFreeStmt]
jmp 0x14004f55f
mov esi, dword [rbp + 0xe8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x14004f607
mov r8d, esi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14004f607
lea r8, [rsp + 0x68]
mov edx, 0xf00ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004f5fe
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x14004f63f
test rsi, rsi
je 0x14004f607
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea rcx, [rbp - 0x48]
call fcn.14004bab0
movzx eax, bl
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x580]
add rsp, 0x530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp - 0x58]
lea edx, [r9 + 0xb]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14004f6b4
lea rdx, str.SeDebugPrivilege
lea rcx, [rbp + 0x68]
call fcn.14001c950
nop
mov dl, 1
lea rcx, [rbp + 0x68]
call fcn.14002eca0
nop
lea rcx, [rbp + 0x68]
call fcn.14001d440
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x14004f6bd
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x70], rax
test r14b, r14b
je 0x14004f7be
mov ecx, 0x1000
call fcn.140283754
mov rdi, rax
xor ebx, ebx
mov r14d, ebx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x1000
mov r8, rdi
lea edx, [rbx + 2]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14004f780
mov dword [rbp + 0x40], ebx
mov word [rbp + 0x44], 0x500
mov qword [rbp - 0x80], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
lea r8d, [rbx + 0x20]
mov dl, 2
lea rcx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14004f780
cmp dword [rdi], ebx
jbe 0x14004f776
nop dword [rax]
mov edx, ebx
add rdx, rdx
mov rdx, qword [rdi + rdx*8 + 8]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14004f770
inc ebx
cmp ebx, dword [rdi]
jb 0x14004f750
jmp 0x14004f776
mov r14d, 1
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rdi
call fcn.140283144
test r14d, r14d
jne 0x14004f7be
test rsi, rsi
je 0x14004f79b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14004f7ab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004f607
jmp 0x14004f601
mov qword [rbp - 0x78], 0
mov edi, 0x30
lea r8d, [rdi - 0x2f]
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x78]
call sub.USERENV.dll_CreateEnvironmentBlock
mov ecx, 0x430
test eax, eax
cmovne edi, ecx
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x30]
call fcn.140285450
mov dword [rbp - 0x30], SQLDescribeColW
mov dword [rbp + 0xc], 1
movzx eax, word [rbp + 0x498]
mov word [rbp + 0x10], ax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x210]
call fcn.140285450
lea rdx, str.Default
lea rcx, [rbp + 0x68]
call fcn.14001c950
nop
mov dword [rsp + 0x60], 1
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, r12
call fcn.140026bd0
test al, al
je 0x14004f85f
mov rcx, r12
call fcn.140028de0
test al, al
je 0x14004f85f
mov bl, 1
jmp 0x14004f861
xor bl, bl
lea rcx, [rbp + 0x68]
call fcn.14001d440
test bl, bl
je 0x14004f8e4
lea rdx, str.WinSta0_
lea rcx, [rbp + 0xb8]
call fcn.14001c950
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.14001da00
nop
lea rcx, [rbp + 0xb8]
call fcn.14001d440
lea rcx, [rbp + 0x68]
call fcn.14002aa20
lea rdx, [rbp + 0x210]
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14004f8c0
lea rax, [rbp + 0x210]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x68]
call fcn.14001d440
xor ecx, ecx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rcx
mov rcx, qword [rbp - 0x50]
call fcn.140026e10
inc eax
movsxd rdx, eax
mov eax, 2
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140283754
mov rbx, rax
mov rcx, qword [rbp - 0x50]
call fcn.14002aa20
mov rdx, rbx
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14004f930
mov rcx, r13
call fcn.14001f680
test al, al
je 0x14004f954
xor r14d, r14d
mov eax, r14d
jmp 0x14004f95f
mov rcx, r13
call fcn.14002aa20
xor r14d, r14d
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
mov rcx, rbx
call fcn.140283144
test r15d, r15d
js 0x14004f9ea
mov rcx, qword [rbp - 0x70]
jne 0x14004f9c2
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14004f9d6
imul edx, r15d, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14004f9ea
mov dword [rsp + 0x60], r14d
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14004f9f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14004fa08
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14004fa18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14004fa26
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004fa36
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14004fa44
call sub.USERENV.dll_DestroyEnvironmentBlock
test edi, edi
setne bl
jmp 0x14004f609
call fcn.140287d84
int3