Function at 0x140002dc4
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x50
or qword [rbp + 0x40], 0xffffffffffffffff
xor esi, esi
and dword [rbp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x40]
lea edx, [rsi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002fad
mov r9d, dword [rbp + 0x30]
lea rax, [rbp + 0x30]
mov rcx, qword [rbp + 0x40]
lea r14d, [rsi + 3]
mov edx, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140002f95
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140002f95
mov ebx, dword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
lea edx, [rsi + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9d, dword [rbp + 0x30]
mov edx, r14d
mov rcx, qword [rbp + 0x40]
mov rdi, rax
lea rax, [rbp + 0x30]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140002f7f
xor r14d, r14d
cmp dword [rdi], esi
jbe 0x140002f7f
lea r12d, [rsi + 1]
test esi, esi
jne 0x140002f7f
and dword [rbp + 0x38], esi
lea rax, [r14 + r14*2]
movsd xmm0, qword [rdi + rax*4 + 4]
lea r9, [rbp + 0x38]
mov eax, dword [rdi + rax*4 + 0xc]
lea rdx, [rbp - 0x20]
xor r8d, r8d
movsd qword [rbp - 0x20], xmm0
xor ecx, ecx
mov dword [rbp - 0x18], eax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
jne 0x140002f73
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140002f73
mov eax, dword [rbp + 0x38]
add eax, r12d
mov ebx, eax
add rbx, rbx
mov dword [rbp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
lea edx, [rsi + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x38]
xor ecx, ecx
mov r8, rax
lea rdx, [rbp - 0x20]
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
je 0x140002f73
lea rdx, str.SeImpersonatePrivilege
mov rcx, rbx
call fcn.1400141c8
test eax, eax
jne 0x140002f5f
mov rax, qword [rbp - 0x20]
lea r9d, [rsi + 0x10]
and qword [rsp + 0x28], 0
lea r8, [rbp - 0x10]
mov rcx, qword [rbp + 0x40]
xor edx, edx
and qword [rsp + 0x20], 0
mov qword [rbp - 0xc], rax
mov dword [rbp - 0x10], r12d
mov dword [rbp - 4], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
cmovne esi, r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
add r14d, r12d
cmp r14d, dword [rdi]
jb 0x140002e8b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002fa1
lea rcx, str...._failed_to_query_required_token_information_length_from_primary_process_token.
call fcn.140002d38
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002fb9
lea rcx, str...._failed_to_open_handle_to_primary_token_of_the_current_process_with_query_modify_permissions.
call fcn.140002d38
mov rbx, qword [rsp + 0x98]
mov eax, esi
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret