Function at 0x1400606d9
Capabilities:
Terminate process

Disassembly:
jmp 0x1400f4f50
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xf38
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2a2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xf58]
mov rax, qword [0x140170048]
xor rax, rbp
mov qword [rbp + 0xef0], rax
lea rcx, [0x14018a116]
call fcn.140061a34
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__________________________________________________________
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.________________________________________________________
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.______________________________________________________
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._________________________________________________
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.________________________________________________
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.____________________________________________Hack0ura__Prepouce
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005e5f0
lea rdx, [0x14005e1fe]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x3b8
lea rcx, [rbp + 0x10]
call fcn.140060eef
lea rax, [rbp + 0x9e8]
mov qword [rbp + 0xa28], rax
lea rax, [rbp + 0xa48]
mov qword [rbp + 0xa88], rax
lea rdx, [0x1401356f5]
mov rcx, qword [rbp + 0xa28]
call fcn.14005f9be
mov qword [rbp + 0xed8], rax
mov rax, qword [rbp + 0xed8]
mov qword [rbp + 0xee0], rax
lea rdx, str.CoercedPotato_is_an_automated_tool_for_privilege_escalation_exploit_using_SeImpersonatePrivilege_or_SeImpersonatePrimaryToken.
mov rcx, qword [rbp + 0xa88]
call fcn.14005f9be
mov qword [rbp + 0xee8], rax
mov r8, qword [rbp + 0xee0]
mov rdx, qword [rbp + 0xee8]
lea rcx, [rbp + 0x10]
call fcn.14005f8d3
nop
cmp dword [rbp + 0xf20], 1
jne 0x1400f5184
lea rcx, str.Use___help_to_show_all_usefull_information._r_n
call fcn.14005e1e5
lea rcx, str.____Exiting..._r_n
call fcn.14005e1e5
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp + 0x3e8]
call fcn.1400619e4
nop
lea rax, [rbp + 0xaa8]
mov qword [rbp + 0xae8], rax
lea rax, [rbp + 0xb08]
mov qword [rbp + 0xb48], rax
lea rdx, str.Program_to_execute_as_SYSTEM__i.e._cmd.exe_
mov rcx, qword [rbp + 0xae8]
call fcn.14005f9be
mov qword [rbp + 0xed8], rax
mov rax, qword [rbp + 0xed8]
mov qword [rbp + 0xee0], rax
lea rdx, str._c___command
mov rcx, qword [rbp + 0xb48]
call fcn.14005f9be
mov qword [rbp + 0xee8], rax
mov r9, qword [rbp + 0xee0]
lea r8, [rbp + 0x3e8]
mov rdx, qword [rbp + 0xee8]
lea rcx, [rbp + 0x10]
call fcn.14006157f
mov dl, 1
mov rcx, rax
call fcn.14005e488
lea rcx, [rbp + 0x428]
call fcn.1400619e4
nop
lea rax, [rbp + 0xb68]
mov qword [rbp + 0xba8], rax
lea rax, [rbp + 0xbc8]
mov qword [rbp + 0xc08], rax
lea rdx, str.Optionnal_interface_to_use__default_:_ALL___Possible_values_:_ms_rprn__ms_efsr
mov rcx, qword [rbp + 0xba8]
call fcn.14005f9be
mov qword [rbp + 0xed8], rax
mov rax, qword [rbp + 0xed8]
mov qword [rbp + 0xee0], rax
lea rdx, str._i___interface
mov rcx, qword [rbp + 0xc08]
call fcn.14005f9be
mov qword [rbp + 0xee8], rax
mov r9, qword [rbp + 0xee0]
lea r8, [rbp + 0x428]
mov rdx, qword [rbp + 0xee8]
lea rcx, [rbp + 0x10]
call fcn.14006157f
mov dword [rbp + 0x464], 0xffffffff
lea rax, [rbp + 0xc28]
mov qword [rbp + 0xc68], rax
lea rax, [rbp + 0xc88]
mov qword [rbp + 0xcc8], rax
lea rdx, str.Optionnal_exploit_ID__Only_usuable_if_interface_is_defined___n____ms_rprn_:__n____0__RpcRemoteFindFirstPrinterChangeNotificationEx___n____1__RpcRemoteFindFirstPrinterChangeNotification___n____ms_efsr__n____0__EfsRpcOpenFileRaw___n____1__EfsRpcEncryptFileSrv___n____2__EfsRpcDecryptFileSrv___n____3__EfsRpcQueryUsersOnFile___n____4__EfsRpcQueryRecoveryAgents___n____5__EfsRpcRemoveUsersFromFile___n____6__EfsRpcAddUsersToFile___n____7__EfsRpcFileKeyInfo____NOT_WORKING_n____8__EfsRpcDuplicateEncryptionInfoFile___n____9__EfsRpcAddUsersToFileEx___n____10__EfsRpcFileKeyInfoEx____NOT_WORKING_n____11__EfsRpcGetEncryptedFileMetadata___n____12__EfsRpcEncryptFileExSrv___n____13__EfsRpcQueryProtectors___n
mov rcx, qword [rbp + 0xc68]
call fcn.14005f9be
mov qword [rbp + 0xed8], rax
mov rax, qword [rbp + 0xed8]
mov qword [rbp + 0xee0], rax
lea rdx, str._n___exploitId
mov rcx, qword [rbp + 0xcc8]
call fcn.14005f9be
mov qword [rbp + 0xee8], rax
mov r9, qword [rbp + 0xee0]
lea r8, [rbp + 0x464]
mov rdx, qword [rbp + 0xee8]
lea rcx, [rbp + 0x10]
call fcn.14005f248
mov byte [rbp + 0x484], 0
lea rax, [rbp + 0xce8]
mov qword [rbp + 0xd28], rax
lea rax, [rbp + 0xd48]
mov qword [rbp + 0xd88], rax
lea rdx, str.Force_all_RPC_functions_even_if_it_says_Exploit_worked___Default_value_:_false_
mov rcx, qword [rbp + 0xd28]
call fcn.14005f9be
mov qword [rbp + 0xed8], rax
mov rax, qword [rbp + 0xed8]
mov qword [rbp + 0xee0], rax
lea rdx, str._f___force
mov rcx, qword [rbp + 0xd88]
call fcn.14005f9be
mov qword [rbp + 0xee8], rax
mov r9, qword [rbp + 0xee0]
lea r8, [rbp + 0x484]
mov rdx, qword [rbp + 0xee8]
lea rcx, [rbp + 0x10]
call fcn.14005ef46
mov byte [rbp + 0x4a4], 1
lea rax, [rbp + 0xda8]
mov qword [rbp + 0xde8], rax
lea rax, [rbp + 0xe08]
mov qword [rbp + 0xe48], rax
lea rdx, str.Set_wether_the_process_should_be_run_within_the_same_shell_or_open_a_new_window.__Default_value_:_true_
mov rcx, qword [rbp + 0xde8]
call fcn.14005f9be
mov qword [rbp + 0xed8], rax
mov rax, qword [rbp + 0xed8]
mov qword [rbp + 0xee0], rax
lea rdx, str.__interactive
mov rcx, qword [rbp + 0xe48]
call fcn.14005f9be
mov qword [rbp + 0xee8], rax
mov r9, qword [rbp + 0xee0]
lea r8, [rbp + 0x4a4]
mov rdx, qword [rbp + 0xee8]
lea rcx, [rbp + 0x10]
call fcn.14005ef46
nop
mov r8, qword [rbp + 0xf28]
mov edx, dword [rbp + 0xf20]
lea rcx, [rbp + 0x10]
call fcn.14005e924
nop
jmp 0x1400f5474
lea rcx, [rbp + 0x3e8]
call fcn.14005e4dd
mov qword [rbp + 0x4e8], rax
lea rcx, [rbp + 0x3e8]
call fcn.140060981
inc rax
mov qword [rbp + 0x508], rax
mov eax, 2
mul qword [rbp + 0x508]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14005f8d8
mov qword [rbp + 0xe88], rax
mov rax, qword [rbp + 0xe88]
mov qword [rbp + 0x528], rax
mov qword [rbp + 0x548], 0
mov rax, qword [rbp + 0x508]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x4e8]
mov r8, qword [rbp + 0x508]
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 0x548]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov rax, qword [rbp + 0x528]
mov qword [0x140174d90], rax
movzx eax, byte [rbp + 0x4a4]
mov dword [section..data], eax
lea rcx, [rbp + 0x428]
call fcn.14005ecbc
movzx eax, al
test eax, eax
je 0x1400f5576
cmp dword [rbp + 0x464], 0xffffffff
je 0x1400f5576
mov edx, dword [rbp + 0x464]
lea rcx, [0x140138700]
call fcn.14005e1e5
lea rcx, str.Please_use_rpcInterface_parameter_before_defining_exploitId.__r_n
call fcn.14005e1e5
lea rcx, str.____Exiting..._r_n
call fcn.14005e1e5
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
lea rcx, [rbp + 0x428]
call fcn.14005ecbc
movzx eax, al
test eax, eax
je 0x1400f55e6
cmp dword [rbp + 0x464], 0xffffffff
jne 0x1400f55e6
movzx r8d, byte [rbp + 0x484]
mov edx, dword [rbp + 0x464]
mov rcx, qword [rbp + 0x528]
call fcn.14005f013
mov dword [rbp + 0xea4], 0
lea rcx, [rbp + 0x428]
call fcn.14005ea32
nop
lea rcx, [rbp + 0x3e8]
call fcn.14005ea32
nop
lea rcx, [rbp + 0x10]
call fcn.14005eccb
mov eax, dword [rbp + 0xea4]
jmp 0x1400f5683
lea rdx, str.ms_rprn
lea rcx, [rbp + 0x428]
call fcn.14005f6a3
movzx eax, al
test eax, eax
je 0x1400f561c
movzx r8d, byte [rbp + 0x484]
mov edx, dword [rbp + 0x464]
mov rcx, qword [rbp + 0x528]
call fcn.140061c46
jmp 0x1400f5650
lea rdx, str.ms_efsr
lea rcx, [rbp + 0x428]
call fcn.14005f6a3
movzx eax, al
test eax, eax
je 0x1400f5650
movzx r8d, byte [rbp + 0x484]
mov edx, dword [rbp + 0x464]
mov rcx, qword [rbp + 0x528]
call fcn.14005f7e3
mov dword [rbp + 0xec4], 0
lea rcx, [rbp + 0x428]
call fcn.14005ea32
nop
lea rcx, [rbp + 0x3e8]
call fcn.14005ea32
nop
lea rcx, [rbp + 0x10]
call fcn.14005eccb
mov eax, dword [rbp + 0xec4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140132900]
call fcn.140060fc6
mov rax, rdi
mov rcx, qword [rbp + 0xef0]
xor rcx, rbp
call fcn.14005fb8a
lea rsp, [rbp + 0xf08]
pop rdi
pop rbp
ret