Function at 0x140002440
Capabilities:
Acquire debug privileges

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rsi, [rsp + 0x50]
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x34], eax
mov eax, 0x1437eb44
lea r13, str.SeDebugPrivilege
xorps xmm6, xmm6
lea rbx, [rsp + 0x58]
mov rsi, qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, 0x7d330aad
mov r15d, 0x7d812a82
mov r12d, 0x52e5ecd3
jmp 0x1400024d0
mov eax, 0x52e5ecd3
nop dword [rax]
cmp eax, 0x31c9adb6
jle 0x140002530
cmp eax, 0x5aea2508
jg 0x140002590
cmp eax, 0x3a201c24
jle 0x1400025f5
cmp eax, 0x3a201c25
je 0x14000266f
cmp eax, 0x52e5ecd3
jne 0x1400024d0
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd9d5b234
cmove eax, r15d
cmp dword [0x140038adc], 0xa
cmovl eax, r15d
jmp 0x1400024d0
cmp eax, 0xed6ddebf
jg 0x1400025c0
cmp eax, 0x990d81f2
je 0x140002686
cmp eax, 0xd9d5b234
je 0x1400024c7
cmp eax, 0xeb295bc5
jne 0x1400024d0
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xed6ddec0
mov ecx, 0x31c9adb7
cmove eax, ecx
cmp dword [0x140038adc], 0xa
cmovl eax, ecx
jmp 0x1400024d0
cmp eax, 0x5aea2509
je 0x14000269e
cmp eax, 0x7d330aad
je 0x1400026cb
cmp eax, 0x7d812a82
jne 0x1400024d0
mov eax, 0x342bdc76
mov ebp, dword [rsp + 0x3c]
jmp 0x1400024d0
cmp eax, 0xed6ddec0
je 0x1400026d5
cmp eax, 0xf3e7135d
je 0x140002718
cmp eax, 0x1437eb44
jne 0x1400024d0
cmp dword [rsp + 0x34], 0
setne byte [rsp + 0x33]
mov eax, 0x3a201c25
jmp 0x1400024d0
cmp eax, 0x31c9adb7
jne 0x140002724
mov qword [rsp + 0x48], rbx
mov rax, qword [rsp + 0x48]
xor ecx, ecx
mov rdx, r13
lea r8, [rsp + 0x5c]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x64], 2
mov rcx, qword [rsp + 0x50]
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call rsi
call rdi
mov dword [rsp + 0x38], eax
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xed6ddec0
cmove eax, r14d
cmp dword [0x140038adc], 0xa
cmovl eax, r14d
jmp 0x1400024d0
cmp byte [rsp + 0x33], 0
mov eax, 0xf3e7135d
mov ecx, 0xeb295bc5
cmovne eax, ecx
jmp 0x1400024d0
xor eax, eax
cmp dword [rsp + 0x38], 0
sete al
mov dword [rsp + 0x3c], eax
mov eax, 0x5aea2509
jmp 0x1400024d0
mov rax, qword [rsp + 0x48]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd9d5b234
cmove eax, r12d
cmp dword [0x140038adc], 0xa
cmovl eax, r12d
jmp 0x1400024d0
mov eax, 0x990d81f2
jmp 0x1400024d0
xor ecx, ecx
mov rdx, r13
lea r8, [rsp + 0x5c]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x64], 2
mov rcx, qword [rsp + 0x50]
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rbx
mov r9d, 0x10
call rsi
call rdi
mov eax, 0x31c9adb7
jmp 0x1400024d0
mov eax, 0x342bdc76
xor ebp, ebp
jmp 0x1400024d0
cmp eax, 0x342bdc76
jne 0x1400024d0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140009010
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret