Function at 0x140028000
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor eax, eax
mov dword [rbp - 0x29], 1
mov dword [rbp + 7], eax
xor ebx, ebx
mov dword [rbp - 0x31], ebx
mov eax, 2
mov dword [rbp - 0x25], eax
mov eax, 4
mov dword [rbp - 0x21], eax
lea rax, str.SeSecurityPrivilege
mov qword [rbp + 0xf], rax
lea rax, str.SeTakeOwnershipPrivilege
mov qword [rbp + 0x17], rax
xorps xmm0, xmm0
lea rax, str.SeRestorePrivilege
mov r14, r9
mov qword [rbp + 0x1f], rax
mov r12d, r8d
mov r15d, edx
mov r13d, ecx
mov esi, ebx
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
test r9, r9
je 0x140028090
mov dword [r9], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x28
lea r9, [rbp - 0x39]
mov rcx, rax
lea r8d, [rdx - 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1400280e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x1400280d9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x39]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400280e0
xor eax, eax
jmp 0x14002819d
mov qword [rsp + 0xd0], rdi
lea rdi, [rbp + 0xf]
nop dword [rax]
mov rdx, qword [rdi]
lea r8, [rbp - 0x19]
mov eax, ebx
lea rcx, [rax + rax*2]
lea r8, [r8 + rcx*4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140028186
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x1400280f0
test r12d, r12d
je 0x140028126
test r14, r14
je 0x140028223
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x31]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rbp - 0x31]
test ecx, ecx
je 0x140028186
call fcn.1402122d0
mov rcx, qword [rbp - 0x39]
mov rbx, rax
test rax, rax
je 0x140028245
mov r9d, dword [rbp - 0x31]
lea rax, [rbp - 0x31]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 3
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400281c6
mov rcx, rbx
call fcn.1402122e0
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 3
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140208e10
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edi, dword [rbx]
lea r9, [rbp - 0x29]
xor r10d, r10d
nop
test edi, edi
je 0x14002820e
lea rcx, [r10 + r10*2]
mov r8, rdi
lea r11, [rbp - 0x19]
lea r11, [r11 + rcx*4]
lea rcx, [rbx + 0xc]
lea rdx, [rbx + 4]
nop dword [rax + rax]
mov rax, qword [r11]
cmp rax, qword [rdx]
jne 0x140028200
test byte [rcx], 3
je 0x140028200
or esi, dword [r9]
add rdx, 0xc
add rcx, 0xc
sub r8, 1
jne 0x1400281f0
inc r10d
add r9, 4
cmp r10d, 3
jb 0x1400281d0
mov rcx, rbx
call fcn.1402122e0
mov edi, esi
mov ecx, 0x34
or edi, r13d
test r12d, r12d
cmovne edi, r13d
call fcn.1402122d0
mov rbx, rax
test rax, rax
jne 0x140028255
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 6
jmp 0x140028195
xor r8d, r8d
mov edx, r8d
test r15b, 1
je 0x140028277
mov rax, qword [rbp - 0x19]
lea edx, [r8 + 1]
mov qword [rbx + 4], rax
mov eax, edi
and eax, 1
add eax, eax
mov dword [rbx + 0xc], eax
mov r9d, 2
test r15d, r9d
je 0x1400282a3
mov eax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0xd]
mov qword [rbx + rcx*4 + 4], rax
mov eax, edi
and eax, r9d
neg eax
sbb eax, eax
and eax, r9d
mov dword [rbx + rcx*4 + 0xc], eax
inc edx
mov r9d, 4
test r15d, r9d
je 0x1400282cd
mov eax, edx
and edi, r9d
neg edi
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 1]
mov qword [rbx + rcx*4 + 4], rax
sbb eax, eax
and eax, 2
mov dword [rbx + rcx*4 + 0xc], eax
inc edx
mov qword [rsp + 0x28], r8
xor r9d, r9d
mov dword [rbx], edx
xor edx, edx
mov rcx, qword [rbp - 0x39]
mov qword [rsp + 0x20], r8
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140028306
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1402122e0
jmp 0x140028190
test r14, r14
je 0x14002830e
mov dword [r14], esi
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1402122e0
xor eax, eax
jmp 0x140028195