Function at 0x140001ce0
Capabilities:
Acquire debug privileges
Create process on windows
Create process suspended
Enumerate processes
Impersonate user
Start service

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x2a8]
sub rsp, 0x3a0
mov rax, qword [0x14003a080]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov qword [r11 + 0x10], rbx
xorps xmm0, xmm0
mov qword [r11 + 0x18], rsi
xor edx, edx
mov qword [r11 - 0x10], rdi
mov r8d, 0xf003f
mov qword [r11 - 0x18], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
mov r15, rcx
xor ecx, ecx
mov qword [rbp + 0x88], r12
movdqu xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0x70], r12
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov ebx, r12d
mov rdi, rax
setne bl
test rax, rax
je 0x140001f98
lea r8d, [r12 + 0x10]
mov qword [rsp + 0x388], r14
lea rdx, str.TrustedInstaller
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x140001d94
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
lea rcx, [rbp + 0x144]
mov r8d, 0x12c
call fcn.14000aa70
xor edx, edx
mov dword [rbp + 0x140], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, r12d
mov edi, r12d
cmp rax, 0xffffffffffffffff
mov r14, rax
mov esi, r12d
setne bl
je 0x140001e55
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, eax
test eax, eax
je 0x140001e4c
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140001e11
mov esi, dword [rbp + 0x148]
jmp 0x140001e2e
lea rdx, str.TrustedInstaller.exe
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
cmove edi, dword [rbp + 0x148]
test esi, esi
je 0x140001e36
test edi, edi
jne 0x140001e4c
lea rdx, [rbp + 0x140]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
mov ebx, eax
test eax, eax
jne 0x140001df1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x388]
test ebx, ebx
je 0x140001f98
mov r8d, esi
mov qword [rbp + 0x78], r12
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov ebx, r12d
mov rsi, rax
setne bl
test rax, rax
je 0x140001ed0
lea r8, [rbp + 0x78]
mov edx, 0xb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, eax
test eax, eax
je 0x140001ed0
mov rcx, qword [rbp + 0x78]
lea rax, [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov ebx, eax
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140001edf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140001eed
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140001f98
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ebx, eax
test eax, eax
je 0x140001f98
mov r8d, edi
mov qword [rbp + 0x80], r12
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001f70
lea r8, [rbp + 0x80]
mov edx, 0xb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140001f70
mov rcx, qword [rbp + 0x80]
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x140001f82
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140001f90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov ebx, eax
lea rax, str.SeAssignPrimaryTokenPrivilege
mov edi, r12d
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x50]
lea rax, str.SeAuditPrivilege
mov qword [rsp + 0x58], rax
lea rax, str.SeBackupPrivilege
mov qword [rsp + 0x60], rax
lea rax, str.SeChangeNotifyPrivilege
mov qword [rsp + 0x68], rax
lea rax, str.SeCreateGlobalPrivilege
mov qword [rsp + 0x70], rax
lea rax, str.SeCreatePagefilePrivilege
mov qword [rsp + 0x78], rax
lea rax, str.SeCreatePermanentPrivilege
mov qword [rbp - 0x80], rax
lea rax, str.SeCreateSymbolicLinkPrivilege
mov qword [rbp - 0x78], rax
lea rax, str.SeCreateTokenPrivilege
mov qword [rbp - 0x70], rax
lea rax, str.SeDebugPrivilege
mov qword [rbp - 0x68], rax
lea rax, str.SeDelegateSessionUserImpersonatePrivilege
mov qword [rbp - 0x60], rax
lea rax, str.SeEnableDelegationPrivilege
mov qword [rbp - 0x58], rax
lea rax, str.SeImpersonatePrivilege
mov qword [rbp - 0x50], rax
lea rax, str.SeIncreaseBasePriorityPrivilege
mov qword [rbp - 0x48], rax
lea rax, str.SeIncreaseQuotaPrivilege
mov qword [rbp - 0x40], rax
lea rax, str.SeIncreaseWorkingSetPrivilege
mov qword [rbp - 0x38], rax
lea rax, str.SeLoadDriverPrivilege
mov qword [rbp - 0x30], rax
lea rax, str.SeLockMemoryPrivilege
mov qword [rbp - 0x28], rax
lea rax, str.SeMachineAccountPrivilege
mov qword [rbp - 0x20], rax
lea rax, str.SeManageVolumePrivilege
mov qword [rbp - 0x18], rax
lea rax, str.SeProfileSingleProcessPrivilege
mov qword [rbp - 0x10], rax
lea rax, str.SeRelabelPrivilege
mov qword [rbp - 8], rax
lea rax, str.SeRemoteShutdownPrivilege
mov qword [rbp], rax
lea rax, str.SeRestorePrivilege
mov qword [rbp + 8], rax
lea rax, str.SeSecurityPrivilege
mov qword [rbp + 0x10], rax
lea rax, str.SeShutdownPrivilege
mov qword [rbp + 0x18], rax
lea rax, str.SeSyncAgentPrivilege
mov qword [rbp + 0x20], rax
lea rax, str.SeSystemEnvironmentPrivilege
mov qword [rbp + 0x28], rax
lea rax, str.SeSystemProfilePrivilege
mov qword [rbp + 0x30], rax
lea rax, str.SeSystemtimePrivilege
mov qword [rbp + 0x38], rax
lea rax, str.SeTakeOwnershipPrivilege
mov qword [rbp + 0x40], rax
lea rax, str.SeTcbPrivilege
mov qword [rbp + 0x48], rax
lea rax, str.SeTimeZonePrivilege
mov qword [rbp + 0x50], rax
lea rax, str.SeTrustedCredManAccessPrivilege
mov qword [rbp + 0x58], rax
lea rax, str.SeUndockPrivilege
mov qword [rbp + 0x60], rax
lea rax, str.SeUnsolicitedInputPrivilege
mov qword [rbp + 0x68], rax
mov rdx, qword [rsi]
lea r8, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rax, qword [rbp + 0x120]
lea r8, [rbp + 0x128]
mov rcx, qword [rbp + 0x70]
mov r9d, 0x10
mov qword [rsp + 0x28], r12
xor edx, edx
mov qword [rbp + 0x12c], rax
mov dword [rbp + 0x128], 1
mov dword [rbp + 0x134], 2
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
inc edi
lea rsi, [rsi + 8]
cmp edi, 0x24
jb 0x140002132
test ebx, ebx
je 0x1400022c8
xorps xmm0, xmm0
mov dword [rsp + 0x28], r12d
xor eax, eax
mov qword [rsp + 0x20], r12
movups xmmword [rbp + 0xb0], xmm0
mov rsi, 0xffffffffffffffff
mov dword [rbp + 0xb0], 0x68
mov r9d, esi
mov qword [rbp + 0x110], rax
lea r8, str.winsta0default
xor edx, edx
xor ecx, ecx
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.140008534
mov r9d, esi
mov dword [rsp + 0x28], edi
lea r8, str.winsta0default
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, esi
mov dword [rsp + 0x28], r12d
mov r8, r15
mov qword [rbp + 0xc0], rbx
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.140008534
mov r9d, esi
mov dword [rsp + 0x28], ebx
mov r8, r15
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rbp + 0x70]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov r9, rdi
lea rax, [rbp + 0xb0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x410
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
mov rcx, qword [rbp + 0x70]
mov r15, qword [rsp + 0x380]
mov r12, qword [rsp + 0x390]
mov rdi, qword [rsp + 0x398]
mov rsi, qword [rsp + 0x3c0]
mov rbx, qword [rsp + 0x3b8]
test rcx, rcx
je 0x1400022ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140002311
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x140002323
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x140002335
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140008400
add rsp, 0x3a0
pop rbp
ret