Function at 0x140031080
Capabilities:
Acquire debug privileges
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
mov edx, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor esi, esi
test eax, eax
je 0x14003110f
lea r8, [rsp + 0x44]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140031104
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140111218], sil
jne 0x1400312c5
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400312c5
lea rdx, str.NtClose
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111c8], rax
lea rdx, str.NtDuplicateObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111c0], rax
lea rdx, str.NtOpenKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111e8], rax
lea rdx, str.NtOpenKeyEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111e0], rax
lea rdx, str.NtQueryKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140111208], rax
lea rdx, str.NtQueryValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111b0], rax
lea rdx, str.NtEnumerateKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111f8], rax
lea rdx, str.NtEnumerateValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111f0], rax
lea rdx, str.NtDeleteKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140111200], rax
lea rdx, str.NtDeleteValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111d0], rax
lea rdx, str.NtSetValueKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111b8], rax
lea rdx, str.NtSetSecurityObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401111d8], rax
lea rdx, str.RtlHashUnicodeString
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140111220], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140111228], rax
lea rdx, str.NtQueryObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140111210], rax
lea rdx, str.NtWow64QueryVirtualMemory64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWow64ReadVirtualMemory64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x140111218], 1
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401111a8], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140111180], rax
mov ecx, 0x68
call fcn.140091bc8
mov rdi, rax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
mov qword [rdi + 0x60], rax
lea rax, vtable.Clean::TaskQueue.0
mov qword [rdi], rax
lea rbx, [rdi + 0x30]
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
lfence
mov ecx, 0x10
call fcn.140091bc8
mov qword [rax + 8], rsi
mov qword [rbx], rax
mov qword [rax], rbx
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x60], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x58], rax
lea rcx, [rdi + 8]
mov edx, 0xfa0
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
nop
mov qword [0x140111198], rdi
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140091ba0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret