Function at 0x140003820
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor edi, edi
mov word [rbp - 0x18], 0x500
lea rax, [rbp - 0x10]
mov dword [rbp - 0x20], edi
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x1c]
mov dword [rsp + 0x48], edi
mov r9d, 0x220
mov dword [rsp + 0x40], edi
mov r8d, 0x20
mov dword [rsp + 0x38], edi
mov dl, 2
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov qword [rbp - 0x10], rdi
mov dword [rbp - 0x1c], edi
push rsi
call fcn.1400115fd
test eax, eax
je 0x140003b24
mov rdx, qword [rbp - 0x10]
lea r8, [rbp - 0x20]
xor ecx, ecx
push rdx
call fcn.140018889
test eax, eax
jne 0x1400038b5
mov dword [rbp - 0x20], edi
mov rcx, qword [rbp - 0x10]
call fcn.14001e27b
xchg esi, eax
cmp dword [rbp - 0x20], edi
je 0x140003b24
mov edx, 1
lea rcx, [0x1400029c0]
push rdi
call fcn.14001c2bd
test eax, eax
jne 0x14000390b
mov rcx, qword [0x140007208]
lea rdx, str.Failed_to_set_control_handler.
call fcn.140004080
mov rcx, rax
lea rdx, [0x140004260]
push rsi
call fcn.14001f01c
mov eax, 1
jmp 0x140003acb
push rax
call fcn.14001b972
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call fcn.140014132
lodsd eax, dword [rsi]
test eax, eax
jne 0x140003950
push rdx
call fcn.1400147ab
mov rcx, qword [0x140007208]
lea rdx, str.Failed_to_open_process_token:
mov ebx, eax
call fcn.140004080
mov rcx, rax
mov edx, ebx
push rcx
call fcn.14001cd64
jmp 0x1400038f1
mov rbx, qword [rsp + 0x60]
lea r8, [rbp - 0x10]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
push rdi
call fcn.14001a7f8
test eax, eax
je 0x140003aef
mov rax, qword [rbp - 0x10]
lea r8, [rbp - 8]
mov qword [rsp + 0x28], rdi
mov r9d, 0x10
xor edx, edx
mov qword [rbp - 4], rax
mov rcx, rbx
mov dword [rbp - 8], 1
mov dword [rbp + 4], 2
mov qword [rsp + 0x20], rdi
call fcn.14001fc79
test rax, r8
je 0x140003aef
call fcn.140021897
cmp byte [0x140003ecd], 0xf
test byte [rcx], dh
add dword [rax], eax
add byte [rax - 0x75], cl
and al, 0x60
call fcn.140017e01
add al, 0xf
invalid
xor eax, eax
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140005300
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov rcx, qword [0x140007208]
lea rdx, str.Failed_to_set_privilege.
call fcn.140004080
mov rcx, rax
lea rdx, [0x140004260]
call fcn.140011a83
adc ecx, dword [rax - 0x75]
and al, 0x60
call fcn.14001ead6
xchg dword [rax + 1], edi
jmp 0x140003acb
mov rcx, qword [0x1400071e8]
lea rdx, str.This_program_requires_administrative_privileges._Restarting_as_administrator...
call fcn.140004080
mov rcx, rax
lea rdx, [0x140004260]
call fcn.140015446
sub al, byte [rcx - 0x48]
add al, 1
add byte [rax], al
lea rdx, [rbp + 0x10]
xor ecx, ecx
push rax
call fcn.14001b52c
test eax, eax
je 0x140003ac9
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x70
xor eax, eax
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x2c], rax
mov dword [rbp - 0x24], eax
lea rax, str.runas
movups xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x78], rdi
movups xmmword [rbp - 0x7c], xmm0
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x10]
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x78], rax
movups xmmword [rbp - 0x5c], xmm0
mov dword [rbp - 0x60], 1
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
push rdi
call fcn.140021cf4
test eax, eax
jne 0x140003ac9
call fcn.1400105de
dec byte [rax - 0x75]
or eax, 0x363b
mov ebx, eax
cmp eax, 0x4c7
jne 0x140003be4
lea rdx, str.User_declined_to_elevate_privileges.
call fcn.140004080
jmp 0x140003bfb
lea rdx, str.Error_elevating_privileges:
call fcn.140004080
mov rcx, rax
mov edx, ebx
call fcn.14001acfb
enter 0xffffffffffff8d48, 0x15
pop rsi
invalid
lea rdx, [0x140004260]
mov rcx, rax
call fcn.14001ee6f
invalid