Function at 0x180002e80
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov qword [rbp + 7], 0xfffffffffffffffe
mov r14, r9
mov r15d, r8d
mov ebx, edx
mov rsi, rcx
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x49], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x31]
lea edx, [rdi + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1800031ed
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea r8d, [rdi + 1]
lea rdx, str.SeDebugPrivilege
or ecx, 0xffffffff
call fcn.18005bf60
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x41]
lea ecx, [rdi + 0x40]
call fcn.180001a50
test eax, eax
je 0x1800031dc
mov edx, dword [rbp - 0x49]
cmp edx, 0x38
jb 0x1800031dc
mov r13, qword [rbp - 0x41]
mov r8, qword [r13]
test r8, r8
je 0x180002f48
lea ecx, [r8 + r8*4]
lea ecx, [rcx*8 + 0x38]
cmp ecx, edx
ja 0x1800031dc
xor edx, edx
test r8, r8
je 0x1800031dc
lea rcx, [r13 + 0x20]
cmp qword [rcx - 8], rbx
jne 0x180002f66
mov rax, qword [rbp - 0x31]
cmp qword [rcx], rax
je 0x180002f79
inc edx
add rcx, 0x28
mov eax, edx
cmp rax, r8
jae 0x1800031dc
jmp 0x180002f57
movzx r12d, word [rcx + 0xe]
test r12w, r12w
je 0x1800031dc
lea rcx, [rbp - 0x29]
call fcn.180001f20
nop
xor esi, esi
lea rbx, [r13 + 0x18]
cmp word [rbx + 0x16], r12w
jne 0x180003013
mov dword [rsp + 0x20], r15d
mov r9d, dword [rbp + 0x6f]
mov r8, qword [rbp + 0x67]
mov rdx, qword [rbx + 8]
mov ecx, dword [rbx]
call fcn.180001c80
mov rdi, rax
test rax, rax
je 0x180003013
cmp r15d, 0x3000
jne 0x180003182
mov rcx, rax
call fcn.180001920
cmp eax, 2
je 0x18000302a
cmp eax, 1
jne 0x180003008
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov eax, dword [rbx]
mov dword [rbp - 0x11], eax
mov rax, qword [rbx + 8]
mov qword [rbp - 9], rax
mov qword [rbp - 1], rdi
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x29]
call fcn.180002e60
jmp 0x180003011
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
inc esi
add rbx, 0x28
mov eax, esi
cmp rax, qword [r13]
jae 0x1800030a9
jmp 0x180002f98
cmp dword [0x180153b70], 0
je 0x18000306d
mov eax, dword [rbp + 0x6f]
mov dword [rsp + 0x38], eax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.CAdminTokenMgr::GetTokenWithInfo_T_TokenElevationTypeFull___hReturnToken__08x___dwTargetProcessId___d____hTargetHandle__08x____dwSessionId__d_
lea r8, str.AdminToken
or edx, 0xffffffff
lea rcx, [0x180153288]
call fcn.18006d360
xor ebx, ebx
lea rcx, [rbp - 0x29]
call fcn.180001f30
mov esi, eax
test eax, eax
jle 0x18000309b
nop
mov edx, ebx
lea rcx, [rbp - 0x29]
call fcn.180002810
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jl 0x180003080
lea rcx, [rbp - 0x29]
call fcn.180002e50
jmp 0x180003182
test rdi, rdi
jne 0x180003182
xor ebx, ebx
lea rcx, [rbp - 0x29]
call fcn.180001f30
mov r15d, eax
test eax, eax
jle 0x18000317e
nop dword [rax + rax]
mov dword [rbp - 0x49], 0
mov dword [rbp - 0x39], 0
mov edx, ebx
lea rcx, [rbp - 0x29]
call fcn.180002810
mov r14, rax
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x49]
mov rcx, qword [rax + 0x10]
call fcn.1800016c0
mov esi, eax
mov r12d, dword [rbp - 0x49]
mov r13d, dword [rbp - 0x39]
cmp dword [0x180153b70], 0
je 0x180003148
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], eax
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
lea r9, str.CAdminTokenMgr::GetTokenWithInfo_arrReturnToken__i_d____08x___bInGroup__d____bOwner__d____bEnabled__d_
lea r8, str.AdminToken
or edx, 0xffffffff
lea rcx, [0x180153288]
call fcn.18006d360
test esi, esi
je 0x18000315f
test r12d, r12d
je 0x18000315f
test r13d, r13d
jne 0x18000316b
test rdi, rdi
jne 0x18000315f
mov rdi, qword [r14 + 0x10]
inc ebx
cmp ebx, r15d
jge 0x18000317a
jmp 0x1800030d0
mov edx, ebx
lea rcx, [rbp - 0x29]
call fcn.180002810
mov rdi, qword [rax + 0x10]
mov r14, qword [rbp + 0x7f]
mov r15d, dword [rbp + 0x77]
xor ebx, ebx
lea rcx, [rbp - 0x29]
call fcn.180001f30
mov esi, eax
test eax, eax
jle 0x1800031c5
mov edx, ebx
lea rcx, [rbp - 0x29]
call fcn.180002810
mov rcx, qword [rax + 0x10]
cmp rdi, rcx
je 0x1800031bf
test r14, r14
je 0x1800031b9
mov rdx, rax
mov rcx, r14
call fcn.180002e60
jmp 0x1800031bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jl 0x180003193
lea rcx, [rbp - 0x29]
call fcn.180002e50
nop
lea rcx, [rbp - 0x29]
call fcn.180002820
mov rsi, qword [rbp + 0x67]
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1800031ea
call fcn.18006f310
mov ebx, dword [rbp + 0x6f]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x180003204
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x31], 0
cmp dword [0x180153b70], 0
je 0x180003257
mov rdx, rsi
lea rcx, [rbp - 0x41]
call fcn.180001020
nop
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], ebx
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.CAdminTokenMgr::GetTokenWithInfo_hReturnToken___08x__SID__s___dwSessionId__d____dwIntegrityLevel__d_
lea r8, str.AdminToken
or edx, 0xffffffff
lea rcx, [0x180153288]
call fcn.18006d360
nop
lea rcx, [rbp - 0x41]
call fcn.180040610
mov rax, rdi
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret