Function at 0x140027ce0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x40]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140027f2f
inc dword [0x14008f43c]
lea r8, [rbp - 0x20]
xor eax, eax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027d7a
mov rax, qword [rbp - 0x20]
lea r9d, [rbx + 0x10]
mov rcx, qword [rbp - 0x40]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x14], rax
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea r8, [rbp - 0x28]
xor ecx, ecx
lea rdx, str.SeBackupPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027dc7
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeRestorePrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027e1e
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeSystemEnvironmentPrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027e75
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeLoadDriverPrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027ecc
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeShutdownPrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027f23
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140027f34
call fcn.14002ffd0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003e210
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret