Function at 0x140004cb0
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14005b0d0]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x60], r15d
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.14000f020
nop
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004d09
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14000b750
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140004d7d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005188
call fcn.14001de30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x60]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140004daa
lea rcx, str.Privilege_escalation_failed_
call fcn.140001190
jmp 0x140005125
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0xf4], xmm1
movups xmmword [rbp + 0x104], xmm1
movups xmmword [rbp + 0x114], xmm1
movups xmmword [rbp + 0x124], xmm1
movups xmmword [rbp + 0x134], xmm1
movups xmmword [rbp + 0x144], xmm1
mov qword [rbp + 0x154], rax
mov dword [rbp + 0x15c], eax
mov dword [rbp + 0xf0], 0x70
lea r8, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae r8, qword [rbp - 0x58]
cmp qword [rdi + 0x18], 0x10
jb 0x140004e13
mov rdi, qword [rdi]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x80004
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rdi
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x140005125
mov r14, rsi
cmp qword [rsi + 0x18], 8
jb 0x140004e69
mov r14, qword [rsi]
mov rdi, qword [rsi + 0x10]
call fcn.14001c5d4
mov esi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov dword [rsp + 0x60], 0x11
test rdi, rdi
je 0x140004f0c
cmp rdi, 0x7fffffff
ja 0x14000518e
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.14001c644
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x140005194
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x68]
call fcn.14000cc00
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r9, qword [rsp + 0x68]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, esi
call fcn.14001c644
shr rax, 0x20
test eax, eax
jne 0x14000519a
mov rdi, qword [rbp - 0x78]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x20]
call fcn.140020380
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1b]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x20]
call fcn.14001bac0
nop
cmp qword [rbp + 0x70], 0
jne 0x140004fd4
lea rdx, str.Error_while_reading_DLL_file_
call fcn.14000f8b0
mov rcx, rax
call fcn.14000f7b0
nop
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x24], edx
lea rcx, [rbp - 0x10]
call fcn.140008510
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x24], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x90]
call fcn.14001d4b8
nop
jmp 0x1400050bf
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.14001bb60
mov rcx, qword [rbp - 0x38]
add rcx, qword [rbp - 0x30]
call fcn.14001e0f8
mov rbx, rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14001bc90
mov r8, qword [rbp - 0x30]
add r8, qword [rbp - 0x38]
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14001be70
lea rcx, [rbp - 0x20]
call fcn.14001ba60
mov r8, qword [rbp - 0x30]
add r8, qword [rbp - 0x38]
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call fcn.14001aaa0
mov rcx, rbx
call fcn.14001de30
nop
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x24], edx
lea rcx, [rbp - 0x10]
call fcn.140008510
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x24], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x90]
call fcn.14001d4b8
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400050fb
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051a2
call fcn.14001de30
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14000515c
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005157
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005182
call fcn.14001de30
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14001de10
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14002bfc4
nop
call fcn.14002bfc4
nop
call fcn.140001820
int3
call fcn.140001b80
int3
mov ecx, eax
call fcn.140001b80
nop
call fcn.14002bfc4
int3