Function at 0x140007050
Capabilities:
Acquire debug privileges
Create process on windows
Query environment variable
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r14d, ecx
movsxd rax, r8d
mov rcx, qword [rbp + 0x108]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x110]
mov qword [rsp + 0x78], rcx
movsxd r10, r9d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x64], edx
cmp eax, 6
ja case.default.0x140007113
lea rdx, [0x140000000]
mov r13d, 0x4000
mov r9d, dword [rdx + rax*4 + 0x79f4]
add r9, rdx
xor r12d, r12d
jmp r9
mov r15d, r12d
jmp 0x1400070fe
mov r15d, 0x1000
jmp 0x1400070fe
mov r15d, 0x2000
jmp 0x1400070fe
mov r15d, 0x2100
jmp 0x1400070fe
mov r15d, 0x3000
jmp 0x1400070fe
mov r15d, r13d
jmp 0x1400070fe
mov r15d, 0x5000
cmp r10d, 5
ja case.default.0x140007113
mov ecx, dword [rdx + r10*4 + 0x7a10]
add rcx, rdx
jmp rcx
mov r13d, 0x40
jmp case.0x140007113.1
mov r13d, 0x20
jmp case.0x140007113.1
mov r13d, 0x8000
jmp case.0x140007113.1
mov r13d, 0x80
jmp case.0x140007113.1
mov r13d, 0x100
mov ecx, dword [rbp + 0xf0]
test ecx, ecx
je 0x14000717d
sub ecx, 1
je 0x140007176
sub ecx, 1
je 0x14000716e
sub ecx, 1
je 0x140007167
cmp ecx, 1
jne case.default.0x140007113
mov dword [rsp + 0x60], 6
jmp 0x140007187
mov eax, 3
jmp 0x140007182
mov word [rsp + 0x60], r12w
jmp 0x140007187
mov eax, 5
jmp 0x140007182
mov eax, 0xa
mov word [rsp + 0x60], ax
mov qword [rsp + 0x1d0], rsi
mov rsi, 0xffffffffffffffff
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov qword [rsp + 0x1d8], rdi
mov dword [rbp + 0x50], 0xffffffff
mov dword [rbp + 0x54], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x68]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400071fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400071f2
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140007244
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000723c
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
lea r8, [rbp + 0x58]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140007278
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140007270
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
mov rbx, qword [rbp - 0x60]
mov dword [rbp + 0x60], 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1400072ad
mov ebx, 0x80070008
jmp 0x1400078fe
mov dword [rax], 1
mov r9d, 0x10
movsd xmm0, qword [rbp + 0x58]
mov r8, rdi
movsd qword [rax + 4], xmm0
xor edx, edx
mov eax, dword [rbp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x28], r12
mov dword [rdi + 0xc], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400072f6
movzx ebx, ax
or ebx, 0x80070000
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x140007314
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1400078fe
mov rdx, qword [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x140007349
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140007341
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp - 0x68]
xor r8d, r8d
mov rcx, rax
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x140007385
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000737d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
mov rcx, qword [rbp - 0x68]
lea rax, [rbp + 0x54]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x50]
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400073c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400073bf
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
lea rdx, [rbp - 0x48]
call fcn.140006e30
mov ebx, eax
test eax, eax
jne 0x1400078fe
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 2]
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140007422
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000741a
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
mov rcx, qword [rbp - 0x58]
mov edx, 2
call fcn.140006660
mov ebx, eax
test eax, eax
jne 0x1400078fe
mov rdx, qword [rbp - 0x58]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x140007467
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000745f
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
cmp r14d, 1
jne 0x140007503
lea rdx, [rbp + 0x68]
call fcn.140006700
mov ebx, eax
test eax, eax
jne 0x1400074b6
mov r8d, dword [rbp + 0x84]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400074a1
mov ebx, r12d
jmp 0x1400074b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400074b6
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
lea r8, [rbp - 0x78]
mov edx, 0x2000000
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400074eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400074ee
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400074ee
mov ebx, r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140007571
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140007571
cmp r14d, 2
jne 0x140007521
lea rdx, [rbp - 0x78]
call fcn.140006e30
mov ebx, eax
test eax, eax
je 0x1400075f1
jmp 0x1400078fe
cmp r14d, 3
jne 0x140007536
mov ecx, dword [rbp + 0x50]
lea rdx, [rbp - 0x78]
call qword [sym.imp.WTSAPI32.dll_WTSQueryUserToken]
jmp 0x140007554
cmp r14d, 4
jne 0x14000757a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x78]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400075f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140007571
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
je 0x1400075f1
jmp 0x1400078fe
cmp r14d, 5
jne 0x1400078f9
mov qword [rbp - 0x70], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x70]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400075bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400075be
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400075be
mov ebx, r12d
test ebx, ebx
jne 0x1400078fe
mov rcx, qword [rbp - 0x70]
lea rdx, [rbp - 0x78]
call fcn.140006a80
mov rcx, qword [rbp - 0x70]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400075e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1400078fe
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14000763b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140007633
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
mov rcx, qword [rbp - 0x80]
lea r8, [rbp + 0x50]
mov r9d, 4
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x140007674
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000766c
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400078fe
mov ecx, dword [rsp + 0x64]
sub ecx, 1
je 0x140007698
cmp ecx, 1
jne 0x1400076b0
mov rcx, qword [rbp - 0x80]
xor edx, edx
call fcn.140006660
mov ebx, eax
test eax, eax
je 0x1400076b0
jmp 0x1400078fe
mov rcx, qword [rbp - 0x80]
mov edx, 2
call fcn.140006660
mov ebx, eax
test eax, eax
jne 0x1400078fe
cmp dword [rsp + 0x68], r12d
je 0x1400076cd
mov rcx, qword [rbp - 0x80]
mov edx, r15d
call fcn.140006990
mov ebx, eax
test eax, eax
jne 0x1400078fe
cmp dword [rbp + 0x100], r12d
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp - 0x80]
xorps xmm1, xmm1
movups xmmword [rbp - 0x20], xmm1
mov eax, 0x404
mov r15d, 0x414
cmove r15d, eax
movaps xmmword [rbp + 0x10], xmm1
xor eax, eax
mov dword [rbp - 0x20], 0x68
mov qword [rbp + 0x40], rax
xorps xmm0, xmm0
mov qword [rbp - 0x30], rax
mov r8d, 1
lea rax, str.WinSta0Default
mov qword [rbp - 0x50], r12
movups xmmword [rbp - 0x10], xmm1
mov qword [rbp - 0x10], rax
mov rdi, r12
movups xmmword [rbp + 0x20], xmm1
mov qword [rbp - 0x70], r12
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x30], xmm1
psrldq xmm1, 0xc
movd eax, xmm1
movups xmmword [rbp - 0x40], xmm0
or eax, 1
mov dword [rbp + 0x1c], eax
mov eax, dword [rsp + 0x60]
mov word [rbp + 0x20], ax
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x140007775
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14000776f
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x140007901
mov r14, qword [rsp + 0x70]
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
jne 0x1400077a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400077a3
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400077f9
mov rcx, rsi
lea rdx, [rbp - 0x70]
add rcx, rcx
call fcn.1400063b0
mov rdi, qword [rbp - 0x70]
mov ebx, eax
test eax, eax
jne 0x1400077f9
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r14d, eax
test eax, eax
jne 0x1400077ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400077eb
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400077f9
cmp esi, r14d
je 0x140007809
mov ebx, 0x8000ffff
mov rcx, rdi
call fcn.140006400
test ebx, ebx
jne 0x1400078e3
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbp - 0x20]
mov r8, rdi
mov qword [rsp + 0x48], rax
xor edx, edx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140007869
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140007867
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x1400078db
mov rcx, qword [rbp - 0x40]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x140007880
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140007895
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbp + 0xf8]
xor r8d, r8d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0xffffffff
jne 0x1400078b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400078c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400078db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call fcn.140006400
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test eax, eax
jne 0x140007901
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140007901
mov ebx, 0x80070057
mov r12d, ebx
mov rcx, qword [rbp - 0x68]
mov rdi, qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x1d0]
cmp rcx, 0xffffffffffffffff
je 0x14000792b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14000792b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x60]
cmp rcx, 0xffffffffffffffff
je 0x140007945
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140007945
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x48]
cmp rcx, 0xffffffffffffffff
je 0x14000795f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14000795f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x58]
cmp rcx, 0xffffffffffffffff
je 0x140007979
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140007979
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x80]
cmp rcx, 0xffffffffffffffff
je 0x140007993
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140007993
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x78]
cmp rcx, 0xffffffffffffffff
je 0x1400079ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400079ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x1400079c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, r12d
jmp 0x1400079cb
mov eax, 0x80070057
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140008c60
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rbp
ret