Function at 0x140007a90
Capabilities:
Acquire debug privileges
Create process on windows
Query service status
Resume thread
Spoof parent pid
Start service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
xor r14d, r14d
mov r15d, 1
xor r13d, r13d
xor r12d, r12d
xor ebp, ebp
xor esi, esi
movsxd rax, ecx
dec ecx
lea rdi, [rdx + 8]
mov rbx, rdx
mov qword [rsp + 0x50], rax
movsxd rax, ecx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x50], r15
jbe 0x140007cbd
mov rax, qword [rdi]
test r12d, r12d
jne 0x140007bb5
mov dx, word [rax]
and edx, 0xfffffffd
cmp dx, 0x2d
jne 0x140007bd7
mov ax, word [rax + 2]
test ax, ax
je 0x140007bd7
cmp ax, 0x51
ja 0x140007b39
cmp ax, 0x42
jbe case.0x140007b2d.2
sub eax, 0x43
cmp ax, 0xe
ja case.0x140007b2d.2
lea rdx, [0x14000a588]
movzx eax, ax
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov esi, 1
jmp 0x140007bcb
sub eax, 0x63
jmp 0x140007b16
mov r14d, 1
jmp 0x140007bcb
test r13, r13
je 0x140007b65
mov ecx, 2
call qword [fcn.140007820]
lea rdx, str.You_can_only_specify_one_process_to_run__n
mov rcx, rax
jmp 0x140007b81
cmp qword [rsp + 0x58], r15
ja 0x140007bc5
mov ecx, 2
call qword [fcn.140007820]
lea rdx, str.No_process_name_specified__n
mov rcx, rax
call fcn.140007a60
jmp 0x140007bcb
mov rdx, qword [rbx]
lea rcx, str.Usage:__S__options___command_arguments__n_t__h_:_Show_help._n_t__m_:_Create_a_new_console_window._n_t__p_:_Run_the_process_in_parallel._n_t__q_:_Force_surrounding_the_arguments_passed_to_the_process_between_quotes._n_t__d_:_Force_disabling_the_quotes_surrounding_the_arguments_passed_to_the_process._n_t__c_:_Run_the_specified_process__cmd_if_no_present_._n
jmp 0x140007b9e
mov rdx, qword [rbx]
lea rcx, str.Usage:__S___m____p____q____d____c__process____command_arguments__n
call fcn.140008100
mov r12d, 1
jmp 0x1400080e2
mov ebp, 1
jmp 0x140007bcb
mov r13, rax
xor r12d, r12d
jmp 0x140007bcb
mov r14d, 2
jmp 0x140007bcb
mov r12d, 1
inc r15
add rdi, 8
jmp 0x140007acf
mov r12d, 3
test r13, r13
je 0x1400080d0
cmp r14d, 1
je 0x140007bfb
cmp r14d, 2
mov eax, 1
cmove r12, rax
jmp 0x140007c01
mov r12d, 3
mov r14, qword [rsp + 0x50]
mov rcx, r13
call sub.msvcrt.dll_wcslen
sub r14, r15
lea rbx, [rax + 1]
xor r15d, r15d
cmp r14, r15
je 0x140007c31
mov rcx, qword [rdi + r15*8]
inc r15
call sub.msvcrt.dll_wcslen
add rax, r12
add rbx, rax
jmp 0x140007c18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx + rbx]
mov edx, 8
lea r15, [0x14000a442]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, r13
lea r13, [0x14000a446]
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_wcscpy
lea rax, [rdi + r14*8]
lea r14, [0x14000a43c]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], rdi
je 0x140007d04
cmp r12, 1
je 0x140007ca1
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, qword [rdi]
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, r15
jmp 0x140007caf
mov rdx, r13
mov rcx, rbx
call sub.msvcrt.dll_wcscat
mov rdx, qword [rdi]
mov rcx, rbx
add rdi, 8
call sub.msvcrt.dll_wcscat
jmp 0x140007c75
test r13, r13
jne 0x140007cd3
lea r13, str.cmd.exe
mov ebp, 1
mov esi, 1
mov rcx, r13
call sub.msvcrt.dll_wcslen
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx + rbx]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, r13
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_wcscpy
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12d, 1
mov qword [rsp + 0x58], rax
call rdi
xor r8d, r8d
mov edx, 0x28
mov rcx, rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov rax, qword [rsp + 0x58]
call rax
cmp eax, 0x3f0
jne 0x140007d63
test r12d, r12d
je 0x140007d63
mov ecx, 2
xor r12d, r12d
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
jmp 0x140007d1d
lea rdi, str.SeDebugPrivilege
mov rcx, qword [rsp + 0xc0]
mov rdx, rdi
call fcn.140007990
test eax, eax
je 0x140007df3
xor eax, eax
mov ecx, 6
xor edx, edx
mov r8d, 3
lea rdi, [rsp + 0x80]
rep stosd dword [rdi], eax
mov rdi, qword [rsp + 0x50]
mov ecx, 0x1c
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x98]
mov ecx, 9
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0x14
lea rdx, str.TrustedInstaller
mov r15, rax
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov r12, rax
je 0x140007e8b
mov r14, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea r13, [rsp + 0x78]
jmp 0x140007e37
mov ecx, 2
mov r12d, 2
call qword [fcn.140007820]
mov r8, rdi
lea rdx, str.Failed_to_acquire__S__n
mov rcx, rax
call fcn.140007a60
jmp 0x1400080e2
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140007e8b
cmp dword [rsp + 0x9c], 1
jne 0x140007e57
xor edx, edx
mov qword [rsp + 0x20], r13
mov r9d, 0x24
mov r8, rdi
mov rcx, r12
call r14
cmp dword [rsp + 0x9c], 1
je 0x140007e1b
mov r14, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call r14
mov rcx, r12
call r14
mov r8d, dword [rsp + 0xb4]
xor edx, edx
mov ecx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140007eca
jmp 0x140007ea5
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call rsi
mov rcx, r12
call rsi
mov qword [rsp + 0x78], 0
mov ecx, 2
mov r12d, 3
call qword [fcn.140007820]
lea rdx, str.Could_not_open_or_start_the_Trusted_Installer_service__n
mov rcx, rax
call fcn.140007a60
jmp 0x1400080ba
cmp esi, 1
lea r9, [rsp + 0x70]
mov edx, 1
mov r14, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
sbb esi, esi
xor ecx, ecx
mov qword [rsp + 0x68], r9
xor r8d, r8d
mov word [rsp + 0x100], 1
and esi, 0x7fffff0
mov dword [rsp + 0xc0], 0x70
add esi, 0x80014
mov dword [rsp + 0xfc], 1
call r14
mov r8, qword [rsp + 0x70]
mov r12, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x60], r8
call r12
mov r8, qword [rsp + 0x60]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
mov r9, qword [rsp + 0x68]
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x128], rax
call r14
xor edx, edx
mov rcx, qword [rsp + 0x128]
mov r9, r13
mov qword [rsp + 0x30], 0
mov r8d, 0x20000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], esi
mov rdx, rbx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000808a
mov rcx, qword [rsp + 0x128]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov r8, qword [rsp + 0x128]
mov qword [rsp + 0x50], r8
call r12
mov r8, qword [rsp + 0x50]
xor edx, edx
lea r12, str.SeAssignPrimaryTokenPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rdi
mov edx, 0x28
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rdi, qword [rsp + 0x98]
mov rdx, qword [r12 + rsi*8]
mov rcx, rdi
inc rsi
call fcn.140007990
cmp rsi, 0x23
jne 0x140008032
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test ebp, ebp
jne 0x14000806a
mov rcx, qword [rsp + 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x88]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
call rsi
mov rcx, qword [rsp + 0x80]
call rsi
jmp 0x1400080ba
mov rax, qword [rsp + 0x58]
mov r12d, 4
call rax
mov ecx, 2
mov dword [rsp + 0x50], eax
call qword [fcn.140007820]
mov r8d, dword [rsp + 0x50]
lea rdx, str.Process_creation_failed._Error_code:_0x_08X_n
mov rcx, rax
call fcn.140007a60
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400080e2
mov r12d, 1
lea r13, str.cmd.exe__C
jmp 0x140007be6
mov eax, r12d
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret