Function at 0x1400c9fa7
Capabilities:
Get token privileges

Disassembly:
adc eax, 0x24c713
lea r13d, [rbx + 1]
mov r14, rax
test rax, rax
je 0x140001208
mov r9d, 0x104
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1400011aa
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
ja 0x1400011aa
mov rdx, r12
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov r15d, r13d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140001208
lea rax, str.MSBuild.exe
mov r14d, ebx
mov qword [rsp + 0x70], rax
lea r15, [rsp + 0x70]
lea rax, str.WmiPrvSE.exe
mov qword [rsp + 0x78], rax
lea rax, str.dialer.exe
mov qword [rbp - 0x80], rax
mov rdx, qword [r15]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1400014bc
add r14d, r13d
add r15, 8
cmp r14d, 3
jb 0x1400011e3
mov r9d, 4
mov qword [rsp + 0x20], rbx
lea r8, [rbp + 0x3f8]
mov rcx, rsi
lea edx, [r9 + 0x19]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400014bc
cmp dword [rbp + 0x3f8], ebx
jne 0x1400014bc
lea r8, [rsp + 0x68]
mov edx, 8
mov rcx, rsi
mov r12d, ebx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400014bc
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x400]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea r15d, [r9 + 0x19]
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400012fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400012fc
mov edx, dword [rbp + 0x400]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x1400012fc
mov r9d, dword [rbp + 0x400]
lea rax, [rbp + 0x400]
mov rcx, qword [rsp + 0x68]
mov r8, r14
mov edx, r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400012ea
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [r14]
movzx edx, byte [rax]
sub edx, r13d
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov r12d, r13d
mov r15d, dword [rax]
jmp 0x1400012f1
mov r15d, dword [rbp + 0x400]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140001303
mov r15d, dword [rbp + 0x400]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x1400014bc
cmp r15d, 0x2000
jb 0x1400014bc
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400014bc
mov ecx, 0x10b
cmp word [rax + rdi + 0x18], cx
je 0x1400014bc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub r14w, r14w
not r14w
call fcn.14009d73a
mov rax, qword [rax]
call fcn.140090d4a
mov bh, byte [0x1bc885b52]
and al, 0x38
pushfq
sub al, byte [rcx]
jo 0x140049e2a
jle 0x1400773ed
add byte [rax], al
add qword [rsp + r8*2 - 0x6a16a8e8], 0xffffffffbff24ce9
mov r8, qword [rsp + r8 - 0x350b541c]
call fcn.14001e457
popfq
js 0x140075b4b
shr dword [rbp + rdx - 0x33695aea], 0x53
jl 0x140075b61
xchg byte [rdi + 0x54], al
scasd eax, dword [rdi]
sbb al, 0x96
sti
ret 0x8a91
mov r13, qword [rsp + 0x28]
or r8d, 0x782ccd02
je 0x140075b77
call fcn.14001e1f4
mov rdx, qword [rsp + 0x48]
je 0x140070357
jns 0x14008a47f
movsx si, byte [rsp + rsi - 0x548affd8]
jne 0x14000114c
mov rsi, qword [rsp + rsi - 0x548bffa6]
call fcn.1400787f5