Function at 0x1400022a0
Capabilities:
Create process on windows
Enumerate processes
Get token membership

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x338]
sub rsp, 0x438
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x310], rax
xor r13d, r13d
mov word [rbp + 0x84], 0x500
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x48], r13d
mov r9d, 0x220
mov dword [rsp + 0x40], r13d
lea r8d, [r13 + 0x20]
mov dword [rsp + 0x38], r13d
mov dl, 2
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov dword [rbp + 0x80], r13d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000234c
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, r13d
mov dword [rsp + 0x60], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], r13d
jne 0x140002397
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400049b8]
call fcn.140002890
lea rdx, [0x140002a60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x10
lea r8, str.message
lea rdx, [0x1400049d0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140002802
mov r9d, 0x21
lea r8, str.Inject
lea rdx, [0x1400049e8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x140002804
mov qword [rsp + 0x450], rbx
lea rcx, [rbp + 0x200]
xor edx, edx
mov qword [rsp + 0x460], rdi
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rcx, [rsp + 0x70]
xor eax, eax
mov qword [rbp], rax
lea rax, str.Executable_Files
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], 0x98
movups xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x78], r13
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x200]
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x60], rax
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x58], 0x104
movups xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x30], 0x81800
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
je 0x14000245f
mov rcx, qword [rbp - 0x60]
mov qword [0x1400298e8], rcx
call qword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov r8, qword [0x1400298e8]
mov rdi, 0xffffffffffffffff
mov r9d, edi
mov dword [rsp + 0x28], r13d
xor edx, edx
mov qword [rsp + 0x20], r13
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140002de4
mov r8, qword [0x1400298e8]
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
mov dword [rbp + 0x10], 0x70
xor eax, eax
mov dword [rbp + 0x14], 0x40
mov qword [rbp + 0x74], rax
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x7c], eax
lea rax, str.runas
mov qword [rbp + 0x20], rax
movups xmmword [rbp + 0x44], xmm0
mov qword [rbp + 0x18], r13
movups xmmword [rbp + 0x54], xmm0
mov qword [rbp + 0x28], rdi
movups xmmword [rbp + 0x64], xmm0
mov dword [rbp + 0x40], 5
movdqa xmmword [rbp + 0x30], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov qword [rbp + 0x98], r13
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0xa0], r13
lea rax, [rbp + 0x200]
mov r8, rbx
inc r8
cmp byte [rax + r8], r13b
jne 0x140002544
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x88]
call fcn.140002aa0
lea rcx, [rbp + 0x88]
call fcn.140001fa0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x1400025b0
mov rcx, qword [rbp + 0x88]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002da0
mov qword [rsp + 0x458], rsi
mov qword [rsp + 0x430], r12
mov qword [rsp + 0x428], r14
mov qword [rsp + 0x420], r15
xorps xmm0, xmm0
mov qword [rbp + 0xb8], r13
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xc0], r13
lea rax, [rbp + 0x200]
mov r8, rbx
inc r8
cmp byte [rax + r8], r13b
jne 0x1400025f2
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xa8]
call fcn.140002aa0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, qword [rbp + 0xc0]
mov rsi, rax
mov r14, qword [rbp + 0xa8]
cmp rax, 0xffffffffffffffff
je 0x14000277f
lea rdx, [rbp + 0xd0]
mov dword [rbp + 0xd0], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140002776
mov r12, qword [rbp + 0xb8]
nop dword [rax]
xorps xmm0, xmm0
mov qword [rbp + 0x98], r13
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0xa0], r13
lea rax, [rbp + 0xfc]
mov r8, rbx
inc r8
cmp byte [rax + r8], r13b
jne 0x140002682
lea rdx, [rbp + 0xfc]
lea rcx, [rbp + 0x88]
call fcn.140002aa0
mov rdi, qword [rbp + 0xa0]
lea rdx, [rbp + 0xa8]
mov rbx, qword [rbp + 0x88]
lea rcx, [rbp + 0x88]
mov r8, qword [rbp + 0x98]
cmp r15, 0x10
cmovae rdx, r14
cmp rdi, 0x10
cmovae rcx, rbx
cmp r8, r12
jne 0x1400026df
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140002736
cmp rdi, 0x10
jb 0x140002716
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000270e
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400027c4
mov rcx, rbx
call fcn.140002da0
lea rdx, [rbp + 0xd0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140002776
mov rbx, 0xffffffffffffffff
jmp 0x140002660
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0x10
jb 0x140002772
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000276a
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400027c4
mov rcx, rbx
call fcn.140002da0
mov bl, 1
jmp 0x140002781
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
cmp r15, 0x10
jb 0x1400027b4
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400027ac
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400027cb
mov rcx, r14
call fcn.140002da0
test bl, bl
je 0x1400027d2
mov rbx, 0xffffffffffffffff
jmp 0x1400025d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r14, qword [rsp + 0x428]
mov r12, qword [rsp + 0x430]
mov rsi, qword [rsp + 0x458]
mov r15, qword [rsp + 0x420]
mov rbx, qword [rsp + 0x450]
mov rdi, qword [rsp + 0x460]
xor eax, eax
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140002d80
add rsp, 0x438
pop r13
pop rbp
ret