Function at 0x18003dc40
Capabilities:
Get token privileges

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov qword [r11 - 0x38], r12
xor r14b, r14b
mov byte [r11 - 0x48], r14b
mov qword [r11 - 0x40], r12
mov dword [r11 - 0x30], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
lea edx, [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18003dcf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003dce2
test byte [rcx + 0x1c], 1
je 0x18003dce2
cmp byte [rcx + 0x19], 2
jb 0x18003dce2
lea edx, [r12 + 0x2d]
mov dword [rsp + 0x20], eax
lea r9, str.OpenProcessToken_for_TOKEN_QUERY
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
or ebx, 0xe8f00000
lea r15, str.E:_buildsARK23181_2_trufos_dll_trufos_dll.c
jmp 0x18003e287
mov dword [rsp + 0x48], r12d
mov esi, 0x400
cmp byte [0x18009b380], 0
je 0x18003dd36
mov eax, 0x425
lea r15, str.E:_buildsARK23181_2_trufos_dll_trufos_dll.c
mov qword [rsp + 0x28], r15
mov word [rsp + 0x20], ax
xor r9d, r9d
mov r8d, 0x4e49423a
mov edx, esi
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x18003dd56
mov r8, rsi
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
lea r15, str.E:_buildsARK23181_2_trufos_dll_trufos_dll.c
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18003dd9c
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003dd92
test byte [rcx + 0x1c], 1
je 0x18003dd92
cmp byte [rcx + 0x19], 2
jb 0x18003dd92
lea edx, [rax + 0x2e]
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov ebx, 0xc000009a
jmp 0x18003e287
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.18005f850
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, qword [rsp + 0x38]
mov edx, 3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x18003df7e
mov edx, dword [rsp + 0x48]
cmp edx, esi
jbe 0x18003df49
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x18003de34
cmp byte [0x18009b380], al
je 0x18003de15
mov r9d, 0x436
mov qword [rsp + 0x20], r15
mov r8d, 0x4e49423a
lea rdx, [rsp + 0x38]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18003de2b
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [rsp + 0x38], r12
mov edx, dword [rsp + 0x48]
mov esi, edx
cmp byte [0x18009b380], 0
je 0x18003de67
mov eax, 0x438
mov qword [rsp + 0x28], r15
mov word [rsp + 0x20], ax
xor r9d, r9d
mov r8d, 0x4e49423a
lea rcx, [0x18009cc40]
call fcn.18004b960
mov ebx, esi
jmp 0x18003de83
mov rbx, rsi
mov r8, rsi
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18003dec0
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003dd92
test byte [rcx + 0x1c], 1
je 0x18003dd92
cmp byte [rcx + 0x19], 2
jb 0x18003dd92
lea edx, [rax + 0x2f]
jmp 0x18003dd82
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.18005f850
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, qword [rsp + 0x38]
mov edx, 3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x18003df7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003df3e
test byte [rcx + 0x1c], 1
je 0x18003df3e
cmp byte [rcx + 0x19], 2
jb 0x18003df3e
mov edx, 0x30
lea r9, str.GetTokenInformation_2time
mov dword [rsp + 0x20], ebx
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
or ebx, 0xe8f00000
jmp 0x18003e287
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003df3e
test byte [rcx + 0x1c], 1
je 0x18003df3e
cmp byte [rcx + 0x19], 2
jb 0x18003df3e
mov edx, 0x31
lea r9, [0x180091d88]
jmp 0x18003df2a
lea r8, [rsp + 0x50]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x18003dfe8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003df3e
test byte [rcx + 0x1c], 1
je 0x18003df3e
cmp byte [rcx + 0x19], 2
jb 0x18003df3e
mov edx, 0x32
lea r9, str.LookupPrivilegeValue_for_SE_LOAD_DRIVER_NAME
mov dword [rsp + 0x20], ebx
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
or ebx, 0xe8f00000
jmp 0x18003e287
mov ebx, r12d
mov dword [rsp + 0x34], ebx
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
nop dword [rax]
cmp ebx, dword [r8]
jae 0x18003e064
mov ecx, ebx
lea rdx, [rcx + rcx*2]
cmp rax, qword [r8 + rdx*4 + 4]
jne 0x18003e05c
mov ecx, dword [r8 + rdx*4 + 0xc]
test cl, 2
jne 0x18003e021
test cl, 1
je 0x18003e05c
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003e072
test byte [rcx + 0x1c], 1
je 0x18003e072
cmp byte [rcx + 0x19], 4
jb 0x18003e072
mov edx, 0x33
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov r8, qword [rsp + 0x38]
jmp 0x18003e06b
inc ebx
mov dword [rsp + 0x34], ebx
jmp 0x18003e000
lea rdi, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp ebx, dword [r8]
jne 0x18003e1d4
cmp rcx, rdi
je 0x18003e0a1
test byte [rcx + 0x1c], 1
je 0x18003e0a1
cmp byte [rcx + 0x19], 4
jb 0x18003e0a1
mov edx, 0x34
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18003e10b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003df3e
test byte [rcx + 0x1c], 1
je 0x18003df3e
cmp byte [rcx + 0x19], 2
jb 0x18003df3e
mov edx, 0x35
lea r9, str.OpenProcessToken_for_TOKEN_ADJUST_PRIVILEGES__TOKEN_QUERY
jmp 0x18003df2a
mov r8d, esi
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.18005f850
mov rax, qword [rsp + 0x38]
mov dword [rax], 1
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rcx + 4], rax
mov rax, qword [rsp + 0x38]
mov dword [rax + 0xc], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x18003e19f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003df3e
test byte [rcx + 0x1c], 1
je 0x18003df3e
cmp byte [rcx + 0x19], 2
jb 0x18003df3e
mov edx, 0x36
lea r9, [0x180091e40]
jmp 0x18003dfc9
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003e1cc
test byte [rcx + 0x1c], 1
je 0x18003e1cc
cmp byte [rcx + 0x19], 4
jb 0x18003e1cc
mov edx, 0x37
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov r14b, 1
mov byte [rsp + 0x30], r14b
lea rcx, str.trufos
call qword [sym.imp.FLTLIB.DLL_FilterLoad]
test eax, eax
je 0x18003e257
movzx ebx, ax
cmp ebx, 0xb7
je 0x18003e238
cmp ebx, 0x420
je 0x18003e238
or ebx, 0xe8f00000
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003e287
test byte [rcx + 0x1c], 1
je 0x18003e287
cmp byte [rcx + 0x19], 2
jb 0x18003e287
mov edx, 0x39
mov dword [rsp + 0x20], ebx
lea r9, [0x180091e58]
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18003e287
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003e284
test byte [rcx + 0x1c], 1
je 0x18003e284
cmp byte [rcx + 0x19], 4
jb 0x18003e284
mov edx, 0x38
jmp 0x18003e274
mov rcx, qword [0x18009b358]
cmp rcx, rdi
je 0x18003e284
test byte [rcx + 0x1c], 1
je 0x18003e284
cmp byte [rcx + 0x19], 4
jb 0x18003e284
mov edx, 0x3a
lea r8, [0x180091ef8]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
mov ebx, r12d
cmp r14b, 1
jne 0x18003e2b5
mov rax, qword [rsp + 0x38]
mov dword [rax + 0xc], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18003e2c5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x38], 0
je 0x18003e33d
cmp byte [0x18009b380], 0
je 0x18003e322
mov r9d, 0x4c1
mov qword [rsp + 0x20], r15
mov r8d, 0x4e49423a
lea rdx, [rsp + 0x38]
lea rcx, [0x18009cc40]
call fcn.18004be40
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18005e1d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov eax, ebx
jmp 0x18003e2fa