Function at 0x140071823
Capabilities:
Create process on windows
Create process suspended
Enumerate processes
Impersonate user

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movdqa xmmword [rsp + 0x2d0], xmm7
movdqa xmmword [rsp + 0x2c0], xmm6
mov rdi, rcx
call sym.mimiRust::utilities::Utils::is_elevated::hc67af79b716983ae
test al, al
je 0x140071c1b
lea rsi, [rsp + 0x190]
mov rcx, rsi
call sym.mimiRust::utilities::Utils::enable_debug_privilege::h9ad5fa4fd4895aaa
cmp byte [rsi], 0
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
je 0x14007201d
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rcx
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x78], rdi
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0xc0]
call dbg.clone
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmmword [rsp + 0x160], xmm0
movdqa xmmword [rsp + 0x150], xmm0
movdqa xmmword [rsp + 0x140], xmm0
movdqa xmmword [rsp + 0x130], xmm0
movdqa xmmword [rsp + 0x120], xmm0
and qword [rsp + 0x180], 0
movdqa xmmword [rsp + 0x100], xmm0
and qword [rsp + 0x110], 0
mov ecx, 6
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
lea rsi, [rsp + 0x190]
mov r8d, 0x130
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsi], 0x130
test r14, r14
je 0x140071c53
lea rdx, [rsp + 0x190]
mov rcx, r14
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140071c53
lea r15, [rsp + 0x1bc]
lea r13, [rsp + 0x190]
lea rsi, [rsp + 0x48]
movabs rdi, 0x6e6f676f6c6e6977
movdqa xmm6, xmmword [str.wwwwwwwwwwwwwwwwnnnnnnnnnnnnnnnn]
movdqa xmm7, xmmword [0x140139190]
mov qword [rsp + 0x60], r14
mov rcx, r14
mov rdx, r13
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140071c53
mov r8d, 0x104
mov rcx, rsi
mov rdx, r15
call dbg.from_utf8_lossy
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
mov qword [rsp + 0x80], rax
mov ecx, 1
mov qword [rsp + 0x88], rcx
and qword [rsp + 0xa0], 0
mov qword [rsp + 0xf0], rsi
lea rax, [sym.__alloc::borrow::Cow_B__as_core::fmt::Debug_::fmt::h71feaaff0811f4a6]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
lea rcx, [rsp + 0xd8]
lea rdx, [rsp + 0x80]
call sym.alloc::fmt::format::ha7016107dd9b0da8
mov rcx, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x140071a1f
mov rdx, qword [rsp + 0x50]
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
mov r12, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xe8]
cmp rbp, 9
jb 0x140071a6b
cmp rbp, 0x16
ja 0x140071a87
mov rax, rbx
mov rcx, rbp
cmp rbp, 8
jb 0x140071a5f
lea rbp, [rcx - 1]
lea rdx, [rax + 1]
cmp qword [rax], rdi
mov rax, rdx
jne 0x140071a46
cmp rcx, 8
setae al
jmp 0x140071be1
mov edx, 8
lea rcx, [0x1401501ee]
mov r8, rbx
mov r9, rbp
call sym.___A__as_core::slice::cmp::SlicePartialEq_B__::equal::h316148d6f7ec3baf
jmp 0x140071be1
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
lea rax, [0x1401501ef]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 7
lea r15, [rbx + 7]
xor esi, esi
xor r13d, r13d
lea rax, [r13 + 0x47]
cmp rax, rbp
jae 0x140071b54
mov eax, esi
and al, 1
jne 0x140071b54
and qword [rsp + 0x48], 0
xor eax, eax
cmp rax, 8
je 0x140071b08
movdqu xmm0, xmmword [r15 + rax*8 - 7]
movdqu xmm1, xmmword [r15 + rax*8]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb ecx, xmm1
mov word [rsp + rax + 0x48], cx
add rax, 2
jmp 0x140071ada
xor r14d, r14d
cmp r14, 4
je 0x140071b47
mov rdx, r14
inc r14
movzx r8d, word [rsp + rdx*2 + 0x48]
test r8w, r8w
je 0x140071b0b
shl rdx, 4
add rdx, r13
mov r9d, esi
and r9b, 1
lea rcx, [rsp + 0x80]
call sym.core::str::pattern::simd_contains::__u7b__u7b_closure_u7d__u7d_::h0ef6471e0b1cbf8b
or al, sil
and al, 1
mov esi, eax
jmp 0x140071b0b
add r13, 0x40
add r15, 0x40
jmp 0x140071abb
mov r14, qword [rsp + 0x60]
lea r15, [rsp + 0x1bc]
lea rcx, [r13 + 0x17]
mov eax, esi
and al, 1
cmp rcx, rbp
jae 0x140071bb2
test al, al
jne 0x140071bb2
movdqu xmm0, xmmword [rbx + r13]
movdqu xmm1, xmmword [rbx + r13 + 7]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x140071b9b
add r13, 0x10
jmp 0x140071b61
lea rcx, [rsp + 0x80]
mov rdx, r13
xor r9d, r9d
call sym.core::str::pattern::simd_contains::__u7b__u7b_closure_u7d__u7d_::h0ef6471e0b1cbf8b
mov esi, eax
jmp 0x140071b95
movdqu xmm0, xmmword [rbx + rbp - 0x17]
movdqu xmm1, xmmword [rbx + rbp - 0x10]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x140071bf9
lea r13, [rsp + 0x190]
lea rsi, [rsp + 0x48]
mov rcx, r12
mov rdx, rbx
test al, al
jne 0x140071d0b
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
jmp 0x140071974
add rbp, 0xffffffffffffffe9
test al, al
setne sil
lea rcx, [rsp + 0x80]
mov rdx, rbp
mov r9d, eax
call sym.core::str::pattern::simd_contains::__u7b__u7b_closure_u7d__u7d_::h0ef6471e0b1cbf8b
or al, sil
jmp 0x140071bd4
lea rax, str.____Program_requires_atleast_administrative_permissions_n_
lea rcx, [rsp + 0x190]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
mov qword [rcx + 0x10], rax
pxor xmm0, xmm0
movdqu xmmword [rcx + 0x18], xmm0
call dbg._print
jmp 0x140072022
mov esi, 6
mov ecx, 6
xor edx, edx
call sym.alloc::raw_vec::RawVec_T_A_::allocate_in::h3df00f9134cd96a6
mov rdi, rax
mov rbx, rdx
mov dword [rdx], 0x6c696166
mov word [rdx + 4], 0x6465
mov rcx, rbx
mov rdx, rsi
call sym.core::num::__impl_core::str::traits::FromStr_for_u32_::from_str::h8e74bc46dfdf9cd3
test al, 1
jne 0x140071d7a
shr rax, 0x20
and qword [rsp + 0x48], 0
mov ecx, 0x400
mov edx, 1
mov r8d, eax
call sub.KERNEL32.dll_OpenProcess
test rax, rax
je 0x140071d89
lea rsi, [rsp + 0x48]
mov rcx, rax
mov edx, 0xf
mov r8, rsi
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x140071d92
mov rcx, qword [rsp + 0x48]
and qword [rsp + 0x48], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
xor r8d, r8d
mov r9d, 2
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x140071e2e
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
jmp 0x140071e7d
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
and qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
and qword [rsp + 0x58], 0
lea rdx, [rsp + 0x80]
mov qword [rdx + 0x30], 0x20
mov byte [rdx + 0x38], 3
and qword [rdx], 0
and qword [rdx + 0x10], 0
lea rcx, [rsp + 0x198]
mov qword [rdx + 0x20], rsi
lea rax, sym.core::ptr::drop_in_place_alloc::string::String_::h9da2fede3e66d17c
mov qword [rdx + 0x28], rax
call sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::h43a2b73490fdfa36
test al, al
jne 0x140072052
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
jmp 0x140071c76
shr eax, 8
mov ecx, eax
call sym.anyhow::error::__impl_core::convert::From_E__for_anyhow::Error_::from::h5322f6ea55fa096b
jmp 0x140071e74
lea rax, str.Failed_to_OpenProcess
jmp 0x140071d99
lea rax, str.Failed_to_return_remote_process_token
lea rdx, [rsp + 0x190]
mov qword [rdx], rax
mov qword [rdx + 8], 1
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
mov qword [rdx + 0x10], rax
pxor xmm0, xmm0
movdqu xmmword [rdx + 0x18], xmm0
lea rsi, [rsp + 0x80]
mov rcx, rsi
call sym.alloc::fmt::format::ha7016107dd9b0da8
mov rcx, rsi
call sym.anyhow::kind::Adhoc::new::he11cca279fda13b0
mov r14, rax
lea rax, str.Failed_to_get_access_token
lea rdx, [rsp + 0x190]
mov qword [rdx], rax
mov qword [rdx + 8], 1
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
mov qword [rdx + 0x10], rax
pxor xmm0, xmm0
movdqu xmmword [rdx + 0x18], xmm0
lea rsi, [rsp + 0x80]
mov rcx, rsi
call sym.alloc::fmt::format::ha7016107dd9b0da8
mov rcx, rsi
call sym.anyhow::kind::Adhoc::new::he11cca279fda13b0
mov rsi, rax
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
jmp 0x140071e77
lea rax, [0x140150218]
lea rdx, [rsp + 0x190]
mov qword [rdx], rax
mov qword [rdx + 8], 1
lea rax, str._home_thor_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winreg_0.10.1_src_lib.rs_b
mov qword [rdx + 0x10], rax
pxor xmm0, xmm0
movdqu xmmword [rdx + 0x18], xmm0
lea rsi, [rsp + 0x80]
mov rcx, rsi
call sym.alloc::fmt::format::ha7016107dd9b0da8
mov rcx, rsi
call sym.anyhow::kind::Adhoc::new::he11cca279fda13b0
mov rsi, rax
mov r14d, 1
mov rcx, rdi
mov rdx, rbx
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
test r14, r14
je 0x140071f21
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rcx, qword [rsp + 0xc0]
mov rdx, rdi
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
lea rsi, [rsp + 0x80]
mov qword [rsi], rax
lea rax, [rsp + 0x120]
mov qword [rax], rsi
lea rdx, str.____Failed_to_start_process_with_SYSTEM_permissions_encountered_error:
lea rcx, [rsp + 0x190]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rdx, [sym.__std::io::error::Error_as_core::fmt::Display_::fmt::h0ae59b4b5a93ace0]
mov qword [rax + 8], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call dbg._print
mov rcx, rsi
call sym.core::ptr::drop_in_place_std::io::error::Error_::h3a295ade6d1456ab
mov rdi, qword [rsp + 0x78]
jmp 0x140072013
mov rdi, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xd0]
add rax, rdi
lea rdx, [rsp + 0x190]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
and word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rbx, [rsp + 0x80]
mov rcx, rbx
call sym._ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h9982f82e97
mov r14, qword [rbx + 8]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x40], rax
lea r15, [rsp + 0x120]
mov qword [rsp + 0x38], r15
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0x10
mov rcx, rsi
mov edx, 2
mov r8, r14
xor r9d, r9d
call sub.advapi32.dll_CreateProcessWithTokenW
mov esi, eax
mov rcx, qword [rbx]
mov rdx, r14
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u16__::hbd768d24bd1530e1
test esi, esi
je 0x140071ea1
mov rcx, qword [rsp + 0xc0]
mov rdx, rdi
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x120], rdi
lea rax, str.____started_with_SYSTEM_permissions_n
lea rcx, [rsp + 0x190]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [sym.__alloc::string::String_as_core::fmt::Display_::fmt::hf227f51f5a377cca]
mov qword [rsp + 0x128], rax
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 1
call dbg._print
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
call sym.core::ptr::drop_in_place_alloc::vec::Vec_u8__::h93df36056228766e
movaps xmm6, xmmword [rsp + 0x2c0]
movaps xmm7, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [0x140171f00]
mov qword [rsp + 0x20], rax
lea rcx, str.a_Display_implementation_returned_an_error_unexpectedly
lea r9, sym._ZN4core3ptr226drop_in_place_LT_clap..builder..arg..Arg..validator_LT__LT_mimiRust..Args_u20_as_u20_clap..derive..Args_GT_..au
lea r8, [rsp + 0xd8]
mov edx, 0x37
call dbg.unwrap_failed
int3