Function at 0x18000c560
Capabilities:
Manipulate user privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x180063088]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor r13d, r13d
mov qword [rsp + 0x58], rdx
lea r12d, [rcx + 0x120]
mov edi, ecx
cmp ecx, r12d
jae 0x18000cec0
mov r15d, dword [rsp + 0x54]
mov rsi, qword [rsp + 0x48]
movzx r14d, byte [rsp + 0x38]
lea eax, [rdi - 0x10]
mov r10d, 0x50
lea rdx, [0x180000000]
cmp eax, 0xd8
ja case.0x18000c5ef.25
movzx eax, byte [rdx + rax + 0xcf5c]
mov ecx, dword [rdx + rax*4 + 0xcf34]
add rcx, rdx
jmp rcx
mov rsi, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, r10d
mov qword [rsp + 0x48], 8
xor ecx, ecx
call fcn.18000c140
mov qword [rsp + 0x40], rax
mov edi, 0x88
jmp case.0x18000c5ef.25
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0x77
lea rcx, [rsp + 0x58]
call fcn.18001b410
jmp case.0x18000c5ef.25
mov r14, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x78]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000cc80
mov ebx, 0x106
nop dword [rax]
mov eax, ebx
sub eax, 0x106
je 0x18000c6a1
cmp eax, 1
jne 0x18000c72d
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000c72d
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x70]
mov r9d, 4
mov dword [rbp - 0x70], 4
lea r8, [rsp + 0x54]
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x78]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x18000c72d
cmp dword [rsp + 0x54], r13d
je 0x18000c72d
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rbp - 0x78]
mov r14, rax
lea rax, [rsp + 0x50]
mov r8, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
inc ebx
cmp ebx, 0x108
jb 0x18000c680
mov qword [rsp + 0x60], r14
test r14, r14
je 0x18000cc80
xorps xmm0, xmm0
xor r14b, r14b
movups xmmword [rbp - 0x60], xmm0
mov byte [rsp + 0x38], r14b
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
jmp case.0x18000c5ef.25
mov eax, r10d
cmp eax, 0x50
je 0x18000c77d
cmp eax, 0x37a0
je 0x18000cb3c
jmp 0x18000c8b7
cmp qword [rsi + 0x18], r13
je 0x18000c7c9
cmp rsi, qword [rsp + 0x58]
je 0x18000c7c9
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x52
mov byte [rsp + 0x30], 0x2c
lea rcx, [rsp + 0x68]
call fcn.18001f4f0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm0
cmp eax, 1
jne 0x18000c9da
lea rdx, [0x180000000]
movsxd rax, dword [rsi]
cmp eax, 6
ja case.default.0x18000c7df
mov ecx, dword [rdx + rax*4 + 0xd038]
add rcx, rdx
jmp rcx
mov ebx, 0xcd
nop word [rax + rax]
cmp ebx, 0x3c0f
ja case.0x18000c7df.1
cmp ebx, 0xcd
je 0x18000c8fb
cmp ebx, 0x14d2
je 0x18000c8cc
cmp ebx, 0x28d7
jne 0x18000c933
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x52
mov byte [rsp + 0x30], 0x22
lea rcx, [rsp + 0x68]
call fcn.18001f4f0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm0
cmp eax, 1
jne 0x18000c9da
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x18000c866
cmp dword [rax], 2
jne 0x18000c8a8
cmp qword [rsi + 0x28], r13
je 0x18000cc8a
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x52
mov byte [rsp + 0x30], 0x3a
lea rcx, [rsp + 0x68]
call fcn.18001f4f0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm0
cmp eax, 1
jne 0x18000c9da
mov eax, 0x50
lea rdx, [0x180000000]
lea edi, [rax + 0x58]
add eax, 0x3750
cmp eax, 0x6ea0
jbe 0x18000c768
jmp case.0x18000c5ef.25
mov rcx, qword [rsi + 8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r13b
jne 0x18000c8d7
mov r8, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov edx, 0x60
mov qword [rsp + 0x48], rax
call fcn.180011d50
jmp 0x18000c92a
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x52
mov byte [rsp + 0x30], 0x22
lea rcx, [rsp + 0x68]
call fcn.18001f4f0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm0
cmp eax, 1
jne 0x18000c9da
add ebx, 0x1405
jmp 0x18000c7f0
mov ebx, 0x98
mov eax, ebx
sub eax, 0x98
je 0x18000ca24
sub eax, 1
je 0x18000c9e7
sub eax, 1
je 0x18000c989
sub eax, 1
je 0x18000cb3c
cmp eax, 1
jne 0x18000ca3c
xor r9d, r9d
lea rdx, [rbp + 0x10]
mov r8d, r15d
lea rcx, [rbp - 0x28]
call qword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
jmp 0x18000c8a8
movsd xmm0, qword [0x180059cc8]
lea rdx, [rsp + 0x30]
movzx eax, word [0x180059cd0]
lea rcx, [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov r9d, 0x52
movsd qword [rbp - 0xe], xmm0
mov word [rbp - 6], ax
mov word [rbp - 4], r13w
mov byte [rsp + 0x30], 0x5b
call fcn.18001f4f0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm0
cmp eax, 1
je 0x18000ca3c
mov dword [rsp + 0x40], 6
jmp 0x18000cec0
mov r8d, 3
mov word [rbp - 0x1e], r13w
lea rdx, [0x180059d20]
lea rcx, [rbp - 0x1e]
call fcn.18003315c
mov r8d, 5
mov word [rbp - 0x18], r13w
lea rdx, [0x180059e6e]
lea rcx, [rbp - 0x18]
call fcn.18003315c
mov word [rbp - 0xe], r13w
jmp 0x18000ca3c
movsd xmm0, qword [0x180059f58]
movzx eax, word [0x180059f60]
movsd qword [rbp - 0x28], xmm0
mov word [rbp - 0x20], ax
inc ebx
cmp ebx, 0x9d
jb 0x18000c943
mov ebx, 0xc0
nop
cmp ebx, 0x3cc0
ja case.0x18000c7df.5
cmp ebx, 0xc0
je 0x18000ca84
cmp ebx, 0x1500
je case.0x18000c5ef.23
cmp ebx, 0x2940
je 0x18000c8a8
add ebx, 0x1440
jmp 0x18000ca50
mov eax, dword [str.true]
lea r9, [rsp + 0x48]
mov r8, qword [rsp + 0x40]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], eax
mov edx, 0x60
movzx eax, byte [0x1800587ec]
mov byte [rbp - 0x2c], al
mov qword [rsp + 0x48], 4
call fcn.180011d50
cmp eax, 1
jne 0x18000c9da
add ebx, 0x1440
jmp 0x18000ca50
mov rcx, qword [rsi + 8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r13b
jne 0x18000cad4
mov r8, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov edx, 0x60
mov qword [rsp + 0x48], rax
call fcn.180011d50
cmp eax, 1
jne 0x18000c9da
jmp case.0x18000c5ef.23
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x52
mov byte [rsp + 0x30], 0x7b
lea rcx, [rsp + 0x68]
call fcn.18001f4f0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm0
cmp eax, 1
jne 0x18000c9da
mov rax, qword [rsi + 0x28]
test rax, rax
je case.0x18000c5ef.23
mov rsi, rax
mov edi, 0x88
jmp case.0x18000c5ef.25
mov eax, 0xcd
nop dword [rax + rax]
cmp eax, 0xcd
je 0x18000cba2
inc eax
cmp eax, 0xce
jb 0x18000cb60
mov r8, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov edx, 0x60
mov qword [rsp + 0x48], 4
lea rcx, str.null
call fcn.180011d50
cmp eax, 1
jne 0x18000c9da
jmp case.0x18000c5ef.23
mov r8, qword [rsp + 0x40]
lea r9, [rsp + 0x48]
mov edx, 0x60
mov qword [rsp + 0x48], 5
lea rcx, str.false
call fcn.180011d50
cmp eax, 1
jne 0x18000c9da
jmp case.0x18000c5ef.23
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov edx, 0x10a
call fcn.18001c830
jmp case.0x18000c5ef.25
movsxd rax, dword [rsi]
cmp eax, 6
ja case.default.0x18000c7df
mov ecx, dword [rdx + rax*4 + 0xd054]
add rcx, rdx
jmp rcx
mov byte [rsp + 0x30], 0x7d
jmp 0x18000cc14
mov byte [rsp + 0x30], 0x5d
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x52
lea rcx, [rsp + 0x68]
call fcn.18001f4f0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm0
cmp eax, 1
jne 0x18000c9da
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x18000cca6
cmp rsi, qword [rsp + 0x58]
je 0x18000cca6
mov rsi, qword [rsi + 0x10]
test rsi, rsi
je 0x18000cc67
mov edi, 0x88
jmp case.0x18000c5ef.25
mov rsi, rax
mov edi, 0xc8
add edi, 0x20
cmp edi, r12d
jae 0x18000cec0
jmp 0x18000c5c2
mov byte [rsp + 0x40], r13b
jmp 0x18000cec0
mov edx, 0x71
lea rcx, [rsp + 0x40]
call fcn.18001b410
mov dword [rsp + 0x40], 8
jmp 0x18000cec0
mov r8, qword [rsp + 0x40]
xor edx, edx
mov ecx, 0x127
call fcn.18001a750
mov qword [r13], rax
mov dword [rsp + 0x40], 1
jmp 0x18000cec0
mov edx, 0x71
lea rcx, [rsp + 0x40]
call fcn.18001b410
mov dword [rsp + 0x40], 0xa
jmp 0x18000cec0
mov rax, qword [rsp + 0x58]
mov rcx, rax
call qword [rax]
jmp 0x18000cec5
lea r9, [rbp - 0x68]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x18000ceb0
mov r13d, dword [rsp + 0x54]
lea ebx, [rax + 0x1a]
mov rdi, qword [rsp + 0x60]
lea esi, [rax + 0x67]
lea edx, [rax + 0x2a]
lea r11d, [rax + 0x6c]
lea r8d, [rax + 0x65]
lea r14d, [rax + 0x4d]
lea r15d, [rax + 0x6d]
lea r12d, [rax + 0x76]
lea r9d, [rax + 0x79]
lea r10d, [rax + 0x2c]
lea eax, [rbx - 0x1a]
cmp eax, 9
ja case.default.0x18000cd64
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0xd070]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov dword [rbp - 6], 0x65006c
mov word [rbp - 2], si
jmp case.default.0x18000cd64
test r13d, r13d
jne case.default.0x18000cd64
mov rdx, qword [rdi]
lea r9d, [r13 + 1]
mov rcx, qword [rbp - 0x68]
lea r8, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
sete byte [rsp + 0x38]
jmp 0x18000ce89
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
jmp 0x18000ce89
mov dword [rbp - 0x24], 0x6f004c
mov dword [rbp - 0x20], 0x6b0063
mov dword [rbp - 0x1c], 0x65004d
mov word [rbp - 0x18], r15w
jmp case.default.0x18000cd64
mov eax, 0x50
mov dword [rbp - 0xe], 0x690072
mov word [rbp - 0x10], ax
mov dword [rbp - 0xa], 0x690076
jmp case.default.0x18000cd64
mov dword [rbp - 0x28], 0x650053
jmp case.default.0x18000cd64
mov rax, qword [rsp + 0x60]
lea r9, [rbp - 0x30]
mov rcx, qword [rbp - 0x68]
lea r8, [rsp + 0x48]
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_LsaEnumerateAccountRights]
test eax, eax
jne 0x18000ce84
mov esi, dword [rbp - 0x30]
xor eax, eax
mov r12, qword [rsp + 0x48]
mov edi, eax
test rsi, rsi
je 0x18000ce6f
mov r15, qword [rsp + 0x70]
mov rbx, r12
movzx r14d, word [rsp + 0x68]
cmp word [rbx], r14w
jne 0x18000ce51
mov rcx, qword [rbx + 8]
mov r8d, 0x2a
mov rdx, r15
call fcn.18002e2a0
test eax, eax
je 0x18000ce5f
inc rdi
add rbx, 0x10
cmp rdi, rsi
jb 0x18000ce35
jmp 0x18000ce65
mov r13d, 1
mov r15d, 0x6d
lea r14d, [r15 - 0x20]
mov rcx, r12
mov ebx, 0x21
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
lea esi, [rbx + 0x46]
lea r12d, [rbx + 0x55]
mov rdi, qword [rsp + 0x60]
mov r11d, 0x6c
lea r10d, [r11 - 0x40]
lea r9d, [r11 + 0xd]
lea r8d, [r11 - 7]
lea edx, [r11 - 0x42]
inc ebx
cmp ebx, 0x24
jb 0x18000cd40
movzx r14d, byte [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [rsp + 0x40], r14b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.18002c4c0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp - 0x16], 0x72006f
mov word [rbp - 0x12], r9w
jmp case.default.0x18000cd64
xor eax, eax
mov word [rsp + 0x6a], r10w
mov qword [rsp + 0x48], rax
mov r13d, eax
mov dword [rbp - 0x30], eax
jmp case.default.0x18000cd64
lea rax, [rbp - 0x28]
mov dword [rbp], 0x65
mov qword [rsp + 0x70], rax
mov word [rsp + 0x68], dx
jmp case.default.0x18000cd64