Function at 0x180012bf8
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov r13d, edx
mov rbx, rcx
cmp qword [rcx + 0x10], rdi
jne 0x180012c31
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx + 0x10]
lea rdx, str.ZwQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x10]
lea rdx, str.ZwQueryInformationProcess
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test r12, r12
je 0x180012e41
test rax, rax
je 0x180012e41
cmp qword [rbx + 0x18], rdi
je 0x180012e41
cmp qword [rbx + 0x18], 0xffffffffffffffff
je 0x180012e41
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x50]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180012ce7
lea r8, [rbp - 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rbp - 0x40], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0x50]
lea r8, [rbp - 0x40]
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rbp - 0x34], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.180014738
xor edx, edx
lea ecx, [rdx + 0x40]
mov r8d, eax
mov dword [rbp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x180012d15
mov ecx, r13d
call fcn.180012e60
jmp 0x180012e43
mov esi, 0x4000
mov dword [rbp + 0x40], edi
mov rcx, qword [rbx + 0x18]
mov r8d, esi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180012e41
lea r9, [rbp + 0x40]
mov r8d, esi
mov rdx, rax
mov ecx, 0x10
call r12
cmp eax, 0xc0000004
jne 0x180012d67
mov rcx, qword [rbx + 0x18]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add esi, esi
jmp 0x180012d1d
test eax, eax
jne 0x180012e32
xor r12d, r12d
cmp dword [rdi], r12d
jbe 0x180012de2
lea rsi, [rdi + 8]
cmp byte [rsi + 4], 5
jne 0x180012dd6
mov eax, dword [rbp + 0x50]
cmp dword [rsi], eax
jne 0x180012dd6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx edx, word [rsi + 6]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [rbp + 0x58]
mov r8, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
jne 0x180012dd6
mov rcx, qword [rbp + 0x58]
and qword [rsp + 0x20], 0
lea r9d, [rax + 0x2f]
lea r8, [rbp - 0x30]
xor edx, edx
call r15
cmp qword [rbp - 0x10], r13
je 0x180012dff
inc r12d
add rsi, 0x18
cmp r12d, dword [rdi]
jb 0x180012d7b
mov rcx, qword [rbx + 0x18]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180012d08
mov r8, qword [rbp + 0x58]
lea rdx, str.myHandle__0x_x_n
mov ecx, 0xde
call fcn.180030818
mov rcx, qword [rbx + 0x18]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x58]
jmp 0x180012e43
mov rcx, qword [rbx + 0x18]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret