Function at 0x14000d380
Capabilities:
Acquire debug privileges

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402aa8c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
call fcn.14003a7d4
mov r9, qword [rdi + 0x130]
mov edx, pe_nt_image_headers64
lea r8d, [rdx - 0x7f]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rdi + 0x130]
xor r8d, r8d
mov edx, pe_nt_image_headers64
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.1400347dc
mov rcx, rax
test rax, rax
je 0x14000dbe5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov qword [0x1402c0c48], rdi
call fcn.1400347dc
mov rcx, rax
test rax, rax
je 0x14000dbda
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, 0xea62
lea rcx, [rsp + 0x38]
call fcn.14000ef10
mov edx, 0x3e9
mov rcx, rdi
call fcn.140032c74
mov rcx, rax
mov rdx, qword [rsp + 0x38]
call fcn.140033864
mov r8d, 0xea64
lea rcx, [rsp + 0x38]
call fcn.14000ef10
mov edx, 1
mov rcx, rdi
call fcn.140032c74
mov rcx, rax
mov rdx, qword [rsp + 0x38]
call fcn.140033864
mov r8d, 0xea63
lea rcx, [rsp + 0x38]
call fcn.14000ef10
mov edx, 2
mov rcx, rdi
call fcn.140032c74
mov rcx, rax
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.140033864
nop
lea rdx, [rbx - 0x18]
mov rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d4e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi + 0x478]
lea r8, [rdi + 0x340]
mov edx, 0xca
lea rcx, [rdi + 0x478]
call qword [rax + 0x2c8]
mov r8d, 0xea65
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov r8, qword [rsp + 0x30]
cmp dword [r8 - 8], 1
jle 0x14000d52f
mov edx, dword [r8 - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov r8, qword [rsp + 0x30]
lea rdx, [rdi + 0x478]
lea rcx, [rdi + 0x340]
call fcn.1400288a0
mov rax, qword [rdi + 0xa48]
lea r8, [rdi + 0x340]
mov edx, 0xcb
lea rcx, [rdi + 0xa48]
call qword [rax + 0x2c8]
mov r8d, 0xea6a
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov r8, qword [rsp + 0x30]
cmp dword [r8 - 8], 1
jle 0x14000d591
mov edx, dword [r8 - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov r8, qword [rsp + 0x30]
lea rdx, [rdi + 0xa48]
lea rcx, [rdi + 0x340]
call fcn.1400288a0
lea rcx, [0x140263030]
call fcn.140a767ae
nop
mov rdx, rax
mov r8d, dword [0x1402c0c3c]
lea rcx, [rsp + 0x60]
call fcn.14000a640
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140033864
lea rcx, [0x140263050]
call fcn.140a767ae
nop
mov r8, rax
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x14000d66c
lea rcx, [0x140263050]
call fcn.140a767ae
nop
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x258
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x14000d64e
mov qword [rsp + 0x20], 0x258
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [0x1402c0bb8], rax
jmp 0x14000d655
mov rbx, qword [0x1402c0bb8]
test rbx, rbx
je 0x14000d6b9
xor edx, edx
mov r8d, 0x258
mov rcx, rbx
call fcn.1401cafc0
jmp 0x14000d693
mov qword [rsp + 0x20], 0x258
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [0x1402c0bb8], rax
test rbx, rbx
je 0x14000d6b9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [0x1402c0c3c]
dec ecx
movsxd rdx, ecx
lea r8, [rdx + rdx*2]
mov rcx, qword [0x1402c0bb8]
mov dword [rcx + r8*4 + 4], eax
lea rcx, [0x1402630a0]
call fcn.140a767ae
nop
mov rdx, rax
mov r8d, dword [0x1402c0c3c]
lea rcx, [rsp + 0x60]
call fcn.14000a640
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x7538
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x14000d729
mov qword [rsp + 0x20], 0x7538
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x1402c0ba8], rax
jmp 0x14000d730
mov rax, qword [0x1402c0ba8]
test rax, rax
je 0x14000d745
xor edx, edx
mov r8d, 0x7538
mov rcx, rax
call fcn.1401cafc0
xor r14d, r14d
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
lea edx, [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000d7be
lea r8, [rsp + 0x54]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000d7be
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x14000d7f8
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402c2438], rax
test rax, rax
jne 0x14000d7f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
mov r8d, 0x320
lea rbx, [0x1402bf9f0]
mov rcx, rbx
call fcn.1401cafc0
mov r8d, 0xeab9
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 1
jle 0x14000d83c
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rax, qword [rsp + 0x30]
sub rbx, rax
nop
movzx ecx, word [rax]
mov word [rax + rbx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d840
mov r8d, 0xeaba
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 1
jle 0x14000d87d
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rax, qword [rsp + 0x30]
lea rdx, [0x1402bfa54]
sub rdx, rax
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rdx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d890
mov r8d, 0xeabb
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 1
jle 0x14000d8cd
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rax, qword [rsp + 0x30]
lea rdx, [0x1402bfab8]
sub rdx, rax
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rdx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d8e0
mov r8d, 0xeabc
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 1
jle 0x14000d91d
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rax, qword [rsp + 0x30]
lea rdx, [0x1402bfb1c]
sub rdx, rax
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rdx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d930
mov r8d, 0xeabd
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 1
jle 0x14000d96d
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rax, qword [rsp + 0x30]
lea rdx, [0x1402bfb80]
sub rdx, rax
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rdx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d980
mov r8d, 0xeabe
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 1
jle 0x14000d9bd
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rax, qword [rsp + 0x30]
lea rdx, [0x1402bfbe4]
sub rdx, rax
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rdx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000d9d0
mov r8d, 0xeabf
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 1
jle 0x14000da0d
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rax, qword [rsp + 0x30]
lea rdx, [0x1402bfc48]
sub rdx, rax
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rax + rdx], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000da20
mov r8d, 0xeb9c
lea rcx, [rsp + 0x30]
call fcn.14000ef10
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 8], 1
jle 0x14000da5d
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000b5a0
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
lea r8, [0x1402bfcac]
sub r8, rbx
nop word [rax + rax]
movzx eax, word [rdx]
mov word [rdx + r8], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14000da70
lea rcx, [rdi + 0x478]
call fcn.140021130
cmp qword [0x1402c0bb0], r14
je 0x14000daaa
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword [0x1402c0bb0]
mov qword [rcx + 0x278], rax
xor r9d, r9d
mov edx, 0x20210714
mov r8d, 0x2710
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetTimer]
xor r9d, r9d
mov edx, 0x20210921
mov r8d, 0x3e8
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetTimer]
lea rcx, [0x140263118]
jmp 0x14071c89e
mov ecx, 0x80004005
call fcn.14000bb00
nop
mov ecx, 0x80004005
call fcn.14000bb00
int3