Function at 0x14001ca10
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x338
mov qword [rsp + 0x320], 0xfffffffffffffffe
mov rax, qword [0x1400311e8]
xor rax, rsp
mov qword [rsp + 0x328], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xf0], rax
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2b0], 0
mov dword [rsp + 0x230], 0
mov dword [rsp + 0x88], 0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xffffffffffffffff
jne 0x14001cad4
xor eax, eax
jmp 0x14001d1fd
mov dword [rsp + 0x100], 0x130
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14001cafc
xor eax, eax
jmp 0x14001d1fd
lea rdx, [0x14002a7f0]
lea rcx, [rsp + 0x12c]
call fcn.140017c24
test eax, eax
jne 0x14001cb5e
mov dword [rsp + 0x2c8], 0
lea rdx, [rsp + 0x2c8]
mov ecx, dword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14001cb5e
cmp dword [rsp + 0x2c8], 0
je 0x14001cb5e
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x88], eax
lea rcx, str.Get_win_logon_PID
call fcn.140021de0
jmp 0x14001cb74
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14001cafc
lea rcx, [rsp + 0xc8]
call fcn.140004760
nop
lea rdx, str.winlogon.exe
lea rcx, [rsp + 0xc8]
call fcn.1400048b0
mov dword [rsp + 0x78], 1
cmp qword [rsp + 0x238], 0
je 0x14001cc70
cmp qword [rsp + 0xf0], 0
je 0x14001cc70
lea rdx, str.WTSGetActiveConsoleSessionId
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xf8], rax
lea rdx, str.WTSQueryUserToken
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x98], rax
lea rdx, str.WTSEnumerateSessionsA
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2c0], rax
lea rdx, str.WTSFreeMemory
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2c0], 0
je 0x14001cc5c
cmp qword [rsp + 0xf8], 0
je 0x14001cc5c
cmp qword [rsp + 0x98], 0
je 0x14001cc5c
cmp qword [rsp + 0x2b0], 0
jne 0x14001cc70
lea rcx, str.GetProcAddress_pointer_is_NULL
call fcn.140021d50
mov dword [rsp + 0x78], 0
cmp qword [rsp + 0x238], 0
je 0x14001d1ce
cmp dword [rsp + 0x78], 0
je 0x14001d1ce
lea rcx, str.it_run_only_XP_or_Vista_and_DCSMGR_call_process.
call fcn.140021de0
call qword [rsp + 0xf8]
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 0xffffffff
jne 0x14001ccc1
mov edx, dword [rsp + 0xa0]
lea rcx, [0x14002a8e0]
call fcn.140021d50
mov edx, dword [rsp + 0xa0]
lea rcx, str.dwSessionid___d
call fcn.140021de0
mov qword [rsp + 0x2d0], 0
lea rcx, str.pfnWTSQueryUserToken_______________1
call fcn.140021de0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.pfnWTSQueryUserToken______________0
call fcn.140021de0
mov rdx, qword [rsp + 0x98]
lea rcx, str.pfnWTSQueryUserToken_____d
call fcn.140021de0
lea rdx, [rsp + 0x80]
mov ecx, dword [rsp + 0xa0]
call qword [rsp + 0x98]
mov dword [rsp + 0x2dc], eax
lea rcx, str.pfnWTSQueryUserToken__
call fcn.140021de0
cmp dword [rsp + 0x2dc], 0
jne 0x14001cea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14002a998]
call fcn.140021d50
mov dword [rsp + 0x300], 0
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x308]
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [rsp + 0x2c0]
mov dword [rsp + 0x2dc], eax
cmp dword [rsp + 0x2dc], 0
jne 0x14001cded
lea rcx, str.WTSEnumerateSessions_failed.
call fcn.140021d50
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x314], 0
lea rcx, [rsp + 0xc8]
call fcn.140004860
mov eax, dword [rsp + 0x314]
jmp 0x14001d1fd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x310], 0
jmp 0x14001ce13
mov eax, dword [rsp + 0x310]
add eax, 1
mov dword [rsp + 0x310], eax
mov eax, dword [rsp + 0x300]
cmp dword [rsp + 0x310], eax
jae 0x14001ce96
mov ecx, dword [rsp + 0x310]
imul rcx, rcx, 0x18
lea rdx, [rsp + 0x2d0]
mov rax, qword [rsp + 0x308]
mov ecx, dword [rax + rcx]
call qword [rsp + 0x98]
mov dword [rsp + 0x2dc], eax
cmp dword [rsp + 0x2dc], 1
jne 0x14001ce7d
mov ecx, dword [rsp + 0x310]
imul rcx, rcx, 0x18
mov rax, qword [rsp + 0x308]
mov edx, dword [rax + rcx]
lea rcx, str.find_out_the_token_dwSessionid___d
call fcn.140021de0
jmp 0x14001ce91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WTSQueryUserToken_error_GetLastError___d.
call fcn.140021d50
jmp 0x14001ce02
mov rcx, qword [rsp + 0x308]
call qword [rsp + 0x2b0]
mov dword [rsp + 0x60], 0x30
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.14000a120
mov dword [rsp + 0x240], 0x68
lea rax, str.winsta0default
mov qword [rsp + 0x250], rax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.14000a120
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x90]
mov edx, 0x201eb
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001cf3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Open_process_token_error_:__d
call fcn.140021d50
jmp 0x14001cf49
lea rcx, str.open_process_SUS
call fcn.140021de0
lea r8, [rsp + 0x2e8]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x14001cf7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Lookup_provilege_value_error_:_u
call fcn.140021d50
jmp 0x14001cf86
lea rcx, str.Look_up_provileges_SUS
call fcn.140021de0
mov dword [rsp + 0x2f0], 1
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x2f4], rax
mov dword [rsp + 0x2fc], 2
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov r8d, dword [rsp + 0xa0]
mov r9d, 4
mov edx, 0xc
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rsp + 0x2f0]
xor edx, edx
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14001d046
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Adjust_Privileges_value_ERROR:__d
call fcn.140021d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14001d05f
lea rcx, str.Token_does_not_have_the_privilege
call fcn.140021d50
mov qword [rsp + 0x2e0], 0
mov r8d, 1
mov rdx, qword [rsp + 0x2b8]
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x14001d09a
mov eax, dword [rsp + 0x60]
or eax, 0x400
mov dword [rsp + 0x60], eax
jmp 0x14001d0a6
mov qword [rsp + 0x2e0], 0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x348]
mov rdx, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov dword [rsp + 0x230], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14001d135
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Create_process_as_user_error:__d
call fcn.140021cc0
cmp dword [rsp + 0x350], 0
je 0x14001d168
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x2d8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x2e0]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x318], 1
lea rcx, [rsp + 0xc8]
call fcn.140004860
mov eax, dword [rsp + 0x318]
jmp 0x14001d1fd
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0xc8]
call fcn.140004860
mov eax, dword [rsp + 0x31c]
jmp 0x14001d1fd
mov rcx, qword [rsp + 0x328]
xor rcx, rsp
call fcn.140009950
add rsp, 0x338
ret