Function at 0x180019ee0
Capabilities:
Manipulate user privileges

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x1800a4088]
xor rax, rsp
mov qword [rbp + 0x250], rax
movzx ebx, byte [rsp + 0x30]
lea r15d, [rcx + rcx*4]
shl r15d, 4
mov r11, r9
mov qword [rbp - 0x60], r9
mov r9, r8
mov qword [rbp - 0x58], r8
mov r10, rdx
mov qword [rsp + 0x68], rdx
mov r12d, ecx
mov dword [rbp - 0x70], ecx
mov esi, ecx
mov dword [rbp - 0x6c], r15d
cmp ecx, r15d
ja 0x18001a4b4
movzx edi, byte [rsp + 0x30]
xor r13d, r13d
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0x50]
lea ecx, [r13 + 0x73]
mov qword [rsp + 0x38], rax
lea r8d, [r13 + 0x61]
mov edx, 0x74
cmp esi, 0x348
ja 0x18001a34d
je case.0x18001a46d.0
cmp esi, 0x28
je 0x18001a227
cmp esi, 0x38
je 0x18001a46f
cmp esi, 0x10a
je 0x18001a1ee
cmp esi, 0x1b8
jne 0x18001a407
lea r9, [rbp - 0x68]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x18001a1cd
mov rbx, qword [rsp + 0x60]
mov edi, 0x100
nop word [rax + rax]
mov eax, edi
sub eax, 0x100
je 0x18001a15b
sub eax, 0x4e
je 0x18001a126
sub eax, 0x4e
je 0x18001a0e9
sub eax, 0x4e
je 0x18001a0cc
cmp eax, 0x4e
jne 0x18001a1a7
mov rdx, qword [rbx]
lea r9, [rsp + 0x78]
mov rcx, qword [rbp - 0x68]
lea r8, [rbp - 0x80]
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x7c], r13d
call qword [sym.imp.ADVAPI32.dll_LsaEnumerateAccountRights]
test eax, eax
jne 0x18001a09c
mov r14d, dword [rsp + 0x78]
mov rsi, r13
mov r13, qword [rbp - 0x80]
test r14, r14
je 0x18001a084
mov r12, qword [rbp - 0x18]
mov rdi, r13
movzx r15d, word [rbp - 0x20]
cmp word [rdi], r15w
jne 0x18001a06e
mov rcx, qword [rdi + 8]
mov r8d, 0x2a
mov rdx, r12
call fcn.1800557b0
test eax, eax
je 0x18001a07c
inc rsi
add rdi, 0x10
cmp rsi, r14
jb 0x18001a052
jmp 0x18001a084
mov dword [rsp + 0x7c], 1
mov edi, 0x238
mov rcx, r13
lea esi, [rdi - 0x80]
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
cmp dword [rsp + 0x7c], 0
jne 0x18001a0ba
mov rdx, qword [rbx]
lea r8, [rbp - 0x20]
mov rcx, qword [rbp - 0x68]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
sete byte [rsp + 0x30]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
xor r13d, r13d
jmp 0x18001a1a7
lea rax, [rbp + 0x18]
mov word [rbp + 0x42], r13w
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x2c002a
mov qword [rbp - 0x80], r13
jmp 0x18001a1a7
mov eax, dword [0x180092bc0]
lea rdx, [0x180092c56]
mov dword [rbp + 0x38], eax
lea rcx, [rbp + 0x18]
movzx eax, word [0x180092bc4]
mov r8d, 1
mov word [rbp + 0x3c], ax
mov word [rbp + 0x3e], r13w
call fcn.180057d10
mov eax, 0x65
mov word [rbp + 0x40], ax
jmp 0x18001a1a7
movsd xmm0, qword [0x180092cc0]
lea rdx, [0x180092d80]
movzx eax, word [0x180092cc8]
lea rcx, [rbp + 0x34]
mov r8d, 2
movsd qword [rbp + 0x2a], xmm0
mov word [rbp + 0x32], ax
mov word [rbp + 0x34], r13w
call fcn.180061318
jmp 0x18001a1a7
mov r8d, 1
lea rdx, [0x180092dd8]
lea rcx, [rbp + 0x18]
call fcn.180061318
mov r8d, 4
mov word [rbp + 0x1a], r13w
lea rdx, [0x180092e38]
lea rcx, [rbp + 0x1a]
call fcn.180061318
mov r8d, 4
mov word [rbp + 0x22], r13w
lea rdx, [0x180092e88]
lea rcx, [rbp + 0x18]
call fcn.180057d10
add edi, 0x4e
cmp edi, 0x286
jb 0x180019fe0
mov rbx, qword [rsp + 0x50]
movzx edi, byte [rsp + 0x30]
mov r14, qword [rsp + 0x60]
mov r12d, dword [rbp - 0x70]
mov r15d, dword [rbp - 0x6c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r10, qword [rsp + 0x68]
mov ecx, 0x73
mov byte [rsp + 0x70], dil
lea r8d, [rcx - 0x12]
jmp 0x18001a407
lea rdx, [0x18008f1b8]
mov byte [rbp + 0x10], 0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.rror
lea rcx, [rbp + 0x11]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r10, qword [rsp + 0x68]
mov ecx, 0x73
lea r8d, [rcx - 0x12]
jmp 0x18001a407
mov r14, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x78]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18001a4aa
mov edi, 0xf6
nop
mov eax, edi
sub eax, 0xf4
je 0x18001a2fd
sub eax, 1
je 0x18001a29d
cmp eax, 1
jne 0x18001a307
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x58], 4
lea r8, [rsp + 0x40]
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp 0x18001a307
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x18001a307
cmp dword [rsp + 0x40], 0
je 0x18001a307
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x48]
mov edx, 1
mov rcx, qword [rbp - 0x78]
mov r14, rax
lea rax, [rsp + 0x48]
mov r8, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp 0x18001a307
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec edi
cmp edi, 0xf3
ja 0x18001a250
mov qword [rsp + 0x60], r14
test r14, r14
je 0x18001a4aa
mov r10, qword [rsp + 0x68]
xorps xmm0, xmm0
mov ecx, 0x73
xor dil, dil
movups xmmword [rbp - 0x50], xmm0
mov byte [rsp + 0x30], dil
movups xmmword [rbp - 0x40], xmm0
lea r8d, [rcx - 0x12]
movups xmmword [rbp - 0x30], xmm0
jmp 0x18001a407
cmp esi, 0xb6e
je 0x18001a3f3
cmp esi, 0x15d2
je 0x18001a3a7
cmp esi, 0x2036
jne 0x18001a407
xor bl, bl
mov word [rsp + 0x4e], 0x62
mov r9d, 0x8b
mov qword [rsp + 0x50], rbx
lea r8, [rbp + 0x10]
xor edx, edx
mov rcx, r10
call fcn.180043820
mov r10, qword [rsp + 0x68]
mov ecx, 0x73
mov rdx, rax
mov qword [rsp + 0x38], rax
lea r8d, [rcx - 0x12]
jmp 0x18001a40c
movzx eax, word [0x180092b68]
lea rdx, [0x180090388]
mov dword [rbp + 8], 0x736572
lea rcx, [rbp + 8]
mov word [rbp + 0xb], ax
movzx eax, byte [0x180092b6a]
mov byte [rbp + 0xd], al
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r10, qword [rsp + 0x68]
mov ecx, 0x73
mov eax, 0x6f6a
mov byte [rsp + 0x4e], 0
mov word [rsp + 0x4c], ax
lea r8d, [rcx - 0x12]
jmp 0x18001a407
mov word [rbp], cx
mov word [rbp + 1], dx
mov word [rbp + 2], r8w
mov dword [rbp + 3], 0x737574
mov rdx, qword [rsp + 0x38]
lea eax, [r12 + r12*4]
lea esi, [rsi + rax*2]
cmp esi, r15d
jbe 0x180019f6c
mov r11, qword [rbp - 0x60]
mov r9, qword [rbp - 0x58]
lea r15d, [r12 - 8]
mov dword [rsp + 0x40], r15d
cmp r12d, r15d
jbe case.0x18001a46d.0
mov r13, qword [rbp - 0x80]
lea esi, [r12 - 0x103]
mov r12, qword [rsp + 0x50]
lea rdi, [0x180000000]
mov r14, qword [rsp + 0x50]
mov r8d, 0x6a62
cmp esi, 7
ja case.default.0x18001a46d
mov ecx, dword [rdi + rsi*4 + 0x1a7b0]
add rcx, rdi
jmp rcx
mov rax, qword [rbp - 0x58]
lea r8, [rsp + 0x58]
mov rcx, qword [rbp - 0x60]
mov r9, r10
mov qword [rsp + 0x28], rax
mov edx, 0x16
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], r13d
call fcn.180038e20
jmp 0x18001a596
mov byte [rsp + 0x70], 0
jmp case.0x18001a46d.0
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rdx
jmp 0x18001a424
mov rax, qword [rsp + 0x50]
mov r8, 0xffffffffffffffff
mov rax, qword [rax + 0x28]
mov rdx, qword [rax + 8]
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x18001a4e0
mov rcx, r9
call fcn.180047660
mov rcx, qword [r12 + 0x28]
lea r8, [rsp + 0x4c]
mov r9d, 0x8b
xor edx, edx
call fcn.180043820
mov r13, rax
mov qword [rbp - 0x80], rax
jmp 0x18001a786
test r13, r13
je case.default.0x18001a46d
mov rdx, qword [r13 + 0x28]
mov r8, r11
mov ecx, 0x13
call fcn.180012d20
mov rbx, rax
jmp 0x18001a786
test rdx, rdx
je 0x18001a58d
mov rax, qword [rdx + 0x28]
cmp qword [rax + 8], 0
jne 0x18001a58d
mov r9d, 0x8b
lea r8, [rbp]
xor edx, edx
mov rcx, r10
call fcn.180043820
mov qword [rsp + 0x60], rax
jmp 0x18001a77f
mov rcx, qword [r12 + 0x28]
lea r8, [0x180092f0c]
mov r9d, 0x8b
xor edx, edx
call fcn.180043820
mov qword [rsp + 0x50], rax
cmp rax, 0
jne 0x18001a786
mov byte [rsp + 0x70], bl
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.180053490
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x70], bl
jmp case.default.0x18001a46d
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x18001a58d
mov rax, qword [rdi + 0x28]
mov rcx, qword [rax + 8]
cmp byte [rcx], 0x4f
jne 0x18001a58d
cmp byte [rcx + 1], 0x4b
jne 0x18001a58d
cmp byte [rcx + 2], 0
jne 0x18001a58d
mov r9d, 0x8b
lea r8, [rbp + 8]
xor edx, edx
mov rcx, r10
call fcn.180043820
mov r12, rax
test rax, rax
je 0x18001a58d
mov r14, qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
jmp 0x18001a77f
mov edi, 0xb6
mov r15d, 0x5767
mov r13d, 0x7374
nop word [rax + rax]
cmp edi, 0xcd76
ja 0x18001a728
je 0x18001a6e7
cmp edi, 0xb6
je 0x18001a6bc
cmp edi, 0x33e6
je 0x18001a684
cmp edi, 0x6716
je 0x18001a67b
cmp edi, 0x9a46
jne 0x18001a764
mov dword [rbp - 0x12], 0x656c7069
mov byte [rbp - 0xe], 0x4f
mov word [rbp - 0xd], r8w
jmp 0x18001a764
mov byte [rbp - 0x12], 0
jmp 0x18001a764
mov r8d, 4
lea rdx, [0x180092f9e]
lea rcx, [rbp - 0x20]
call fcn.1800620d0
mov eax, dword [0x180092fbc]
mov r8d, 0x6a62
mov dword [rbp - 0x17], eax
movzx eax, byte [0x180092fc0]
mov byte [rbp - 0x13], al
mov byte [rbp - 0x18], 0x6f
jmp 0x18001a764
mov r8d, 2
mov byte [rbp - 0x20], 0
lea rdx, [0x180092f7a]
lea rcx, [rbp - 0x20]
call fcn.1800620d0
mov r8d, 0x6a62
mov word [rbp - 0x1e], r15w
mov byte [rbp - 0x1c], 0
jmp 0x18001a764
mov r8d, 2
mov byte [rbp - 0xb], 0
lea rdx, [0x180092f11]
lea rcx, [rbp - 0x20]
call fcn.1800620d0
mov r8d, 3
mov word [rbp - 9], r13w
lea rdx, [0x180092f24]
mov byte [rbp - 7], 0
lea rcx, [rbp - 7]
call fcn.1800613d0
mov r8d, 0x6a62
jmp 0x18001a764
cmp edi, 0x100a6
je 0x18001a75e
cmp edi, 0x133d6
je 0x18001a758
cmp edi, 0x16706
jne 0x18001a764
mov r8, r14
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x50]
call fcn.180001110
mov r8d, 0x6a62
jmp 0x18001a764
mov byte [rbp - 2], 0
jmp 0x18001a764
mov word [rbp - 4], 0x7025
add edi, 0x3330
cmp edi, 0x19980
jbe 0x18001a630
mov r15d, dword [rsp + 0x40]
mov r13, qword [rbp - 0x80]
lea rdi, [0x180000000]
mov rdx, qword [rsp + 0x38]
dec esi
lea eax, [rsi + 0x103]
cmp eax, r15d
jbe case.0x18001a46d.0
mov r10, qword [rsp + 0x68]
mov r11, qword [rbp - 0x60]
mov r9, qword [rbp - 0x58]
jmp 0x18001a454