Function at 0x140013c40
Capabilities:
Acquire debug privileges

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400ad388]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rsi, r9
mov rdi, r8
mov qword [rsp + 0x30], rdx
mov rbx, qword [rbp + 0x80]
xor r14d, r14d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
lea rcx, [rbp - 0x10]
call fcn.140014370
nop
mov r9, rbx
mov r8, qword [rsp + 0x30]
lea rdx, [rbp + 0x60]
mov rcx, rsi
call fcn.14000dd20
lea rdx, str.SeDebugPrivilege
call fcn.140003430
lea rdx, str.SeBackupPrivilege
call fcn.140003430
lea rdx, str.SeRestorePrivilege
call fcn.140003430
lea rdx, str.SeCreateSymbolicLinkPrivilege
call fcn.140003430
lea rdx, str.SeSecurityPrivilege
call fcn.140003430
lea rdx, str.SeManageVolumePrivilege
call fcn.140003430
lea rdx, str.SeRelabelPrivilege
call fcn.140003430
lea rdx, str.SeTcbPrivilege
call fcn.140003430
lea rdx, str.SeSystemProfilePrivilege
call fcn.140003430
lea rdx, str.SeTakeOwnershipPrivilege
call fcn.140003430
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea ecx, [r14 + 0x18]
call fcn.14004c570
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001eb00]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14001427e
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea ecx, [r14 + 0x18]
call fcn.14004c570
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001eb40]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14001426f
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rsi
lea ecx, [r14 + 0x10]
call fcn.14004c570
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001eb80]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14001435b
lea ecx, [r14 + 8]
call fcn.14004c570
mov qword [rax], rdi
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001ed30]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14001434c
cmp dword [rbp - 0x28], r14d
je 0x140014341
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x28], eax
je 0x140014336
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x14001432b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
cmp dword [rbp - 0x38], eax
je 0x140014341
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x38], eax
je 0x140014336
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x14001432b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
cmp dword [rbp - 0x48], eax
je 0x140014341
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x48], eax
je 0x140014336
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x14001432b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
cmp dword [rbp - 0x58], eax
je 0x140014341
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x58], eax
je 0x140014336
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x14001432b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
lea ecx, [r14 + 0x10]
call fcn.14004c570
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001ed60]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14001431c
lea ecx, [r14 + 1]
call fcn.14004c570
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001ee70]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001430d
lea ecx, [r14 + 8]
call fcn.14004c570
lea rcx, [rbp - 0x10]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001eec0]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400142fd
lea ecx, [r14 + 8]
call fcn.14004c570
lea rcx, [rbp - 0x10]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001f030]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400142ed
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
lea ecx, [r14 + 0x10]
call fcn.14004c570
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x14001f060]
xor edx, edx
xor ecx, ecx
call fcn.14005b404
mov qword [rbp - 0x20], rax
test rax, rax
je 0x1400142de
cmp dword [rbp - 0x68], r14d
je 0x1400142d3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x68], eax
je 0x1400142c8
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x1400142bd
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
cmp dword [rbp - 0x78], eax
je 0x1400142d3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x78], eax
je 0x1400142c8
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x1400142bd
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
cmp dword [rsp + 0x78], eax
je 0x1400142d3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x78], eax
je 0x1400142c8
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x1400142bd
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
cmp dword [rsp + 0x68], eax
je 0x1400142d3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x68], eax
je 0x1400142c8
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x1400142bd
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
cmp dword [rbp - 0x18], eax
je 0x1400142d3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x18], eax
je 0x1400142c8
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140049d54
test eax, eax
jne 0x1400142bd
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
cmp dword [rsp + 0x68], eax
jne 0x14001428d
cmp dword [rsp + 0x78], eax
jne 0x140014293
cmp dword [rbp - 0x78], eax
jne 0x140014299
cmp dword [rbp - 0x68], eax
jne 0x14001429f
cmp dword [rbp - 0x58], eax
jne 0x1400142a5
cmp dword [rbp - 0x48], eax
jne 0x1400142ab
cmp dword [rbp - 0x38], eax
jne 0x1400142b1
cmp dword [rbp - 0x28], eax
jne 0x1400142b7
lea rcx, [rbp + 8]
call fcn.14001b3d0
lea rcx, [rbp - 0x10]
call fcn.140006440
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.14004c550
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rbp - 0x38], r14d
mov ecx, 6
call fcn.140049898
nop
mov dword [rbp - 0x28], r14d
mov ecx, 6
call fcn.140049898
nop
call fcn.14005b634
nop
call fcn.14005b634
nop
call fcn.14005b634
nop
call fcn.14005b634
nop
call fcn.14005b634
nop
call fcn.14005b634
nop
call fcn.14005b634
nop
call fcn.14005b634
nop
mov ecx, 2
call fcn.140049898
int3
mov ecx, 5
call fcn.140049898
int3
mov ecx, 1
call fcn.140049898
nop
mov dword [rbp - 0x18], r14d
mov ecx, 6
call fcn.140049898
nop
mov dword [rsp + 0x68], r14d
mov ecx, 6
call fcn.140049898
nop
mov dword [rsp + 0x78], r14d
mov ecx, 6
call fcn.140049898
nop
mov dword [rbp - 0x78], r14d
mov ecx, 6
call fcn.140049898
nop
mov dword [rbp - 0x68], r14d
mov ecx, 6
call fcn.140049898
nop
mov ecx, 2
call fcn.140049898
int3
mov ecx, 5
call fcn.140049898
int3
mov ecx, 1
call fcn.140049898
nop
mov dword [rbp - 0x58], r14d
mov ecx, 6
call fcn.140049898
nop
mov dword [rbp - 0x48], r14d
mov ecx, 6
call fcn.140049898
int3