Function at 0x18000aed0
Capabilities:
Acquire debug privileges

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x110
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x18003c008]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, r9
mov esi, r8d
mov r15d, edx
mov rbp, rcx
mov qword [rsp + 0x48], r9
xor r12d, r12d
mov qword [r11 - 0x68], r12
mov dword [r11 - 0x60], 1
mov dword [r11 - 0x58], r12d
xor eax, eax
mov qword [r11 - 0x54], rax
mov dword [r11 - 0x4c], eax
mov ebx, r12d
mov rdx, qword [r9]
cmp dword [rdx - 0x10], eax
je 0x18000af82
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
lea r8d, [r12 + 3]
lea rcx, [rsp + 0x50]
call fcn.1800026a0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
movzx eax, byte [rcx]
nop dword [rax]
ror ebx, 0xd
movsx eax, al
add ebx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x18000af60
lea rax, [rsp + 0x58]
cmp rcx, rax
je 0x18000af82
call fcn.180010cf0
test esi, esi
jne 0x18000afb2
lea edx, [rsi + 0x45]
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000afaf
lea edx, [rsi + 0x45]
lea rcx, [0x1800413b0]
call fcn.180009060
call rax
mov esi, eax
jmp 0x18000afb2
mov esi, r12d
mov edx, 0x89
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000b0f5
mov edx, 0x44
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000affa
mov edx, 0x44
lea rcx, [0x1800413b0]
call fcn.180009060
call rax
mov rdi, rax
jmp 0x18000affd
mov rdi, r12
mov edx, 0x89
lea rcx, [0x1800413b0]
call fcn.180009060
lea r8, [rsp + 0xe0]
mov edx, 0x28
mov rcx, rdi
call rax
test eax, eax
je 0x18000b0f5
mov dword [rsp + 0xf0], 1
mov dword [rsp + 0xfc], 2
mov edx, 0x8c
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000b0c4
mov edx, 0x8c
lea rcx, [0x1800413b0]
call fcn.180009060
lea r8, [rsp + 0xf4]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call rax
test eax, eax
je 0x18000b0c4
mov edx, 0x8d
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000b0c4
mov edx, 0x8d
lea rcx, [0x1800413b0]
call fcn.180009060
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0xf0]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call rax
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000b0f5
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
mov rcx, qword [rsp + 0xe0]
call rax
mov edx, 0x46
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000b1a1
mov edx, 0x46
lea rcx, [0x1800413b0]
call fcn.180009060
mov r8d, esi
xor edx, edx
mov ecx, 0x43a
call rax
mov rdi, rax
test rax, rax
je 0x18000b1a1
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebx
mov r8d, r15d
mov rdx, rbp
mov rcx, rax
call fcn.18000b660
mov rbx, rax
test rax, rax
je 0x18000b175
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xe8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
test rax, rax
je 0x18000b1a1
mov edx, 0x15
lea rcx, [0x1800413b0]
call fcn.180009060
mov rcx, rdi
call rax
mov ebx, dword [rsp + 0xe8]
mov rdx, qword [r14]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18000b1c0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180010cd0
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret