Function at 0x140001700
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rbp + 0x3a8], rax
mov r12, r8
mov r13, rdx
mov rax, qword [rdx + 8]
cmp rax, qword [rdx]
je 0x140001aa7
mov rax, qword [r8 + 8]
cmp rax, qword [r8]
je 0x140001aad
xor r14d, r14d
mov qword [rbp + 0x3a0], r14
mov r15d, r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001aa1
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001ab3
nop word [rax + rax]
lea rdx, str.dwm.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400017ea
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400017ef
jmp 0x1400017c0
mov r15d, dword [rsp + 0x48]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001802
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r15d, r15d
je 0x140001ab9
mov qword [rbp + 0x394], r14
mov dword [rbp + 0x390], 1
mov dword [rbp + 0x39c], 2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0x394]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140001abf
mov qword [rbp + 0x388], r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x388]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001ac5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp + 0x390]
xor edx, edx
mov rcx, qword [rbp + 0x388]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001acb
mov rcx, qword [rbp + 0x388]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400018cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rbp + 0x3a0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140001a9b
mov edx, r15d
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rbp + 0x390], rax
dec rax
cmp rax, 0xfffffffffffffffd
setbe al
test al, al
je 0x1400019a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001ae9
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x438
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140001ad1
nop dword [rax]
cmp dword [rsp + 0x48], r15d
jne 0x14000198f
mov r8, r13
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1400014c0
mov rdi, rax
test rax, rax
jne 0x1400019eb
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140001970
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400019b5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r14
mov rcx, qword [rbp + 0x3a8]
xor rcx, rsp
call fcn.14000a720
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp + 0x380], r14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [r13 + 8]
sub r8, qword [r13]
lea rax, [rbp + 0x380]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140001ad7
mov qword [rsp + 0x30], r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [r12]
mov r9, qword [r12 + 8]
sub r9, r8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001add
mov dword [rbp + 0x388], r14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [r13 + 8]
sub r8, qword [r13]
lea rax, [rbp + 0x388]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x380]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140001ae3
mov r14, rdi
jmp 0x1400019a1
call fcn.140001480
nop
call fcn.140001480
nop
call fcn.140001480
int3
call fcn.140001480
nop
call fcn.140001480
nop
call fcn.140001480
int3
call fcn.140001480
nop
call fcn.140001480
int3
call fcn.140001480
nop
call fcn.140001480
int3
call fcn.140001480
int3
call fcn.140001480
int3
call fcn.140001480
int3
call fcn.140001480
int3