Function at 0x14002adb0
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
call fcn.14002ac00
mov ecx, eax
mov ebx, eax
call fcn.140002400
mov r8d, ebx
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r8, [rbp + 0x20]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rbp + 0x28]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x20]
xor edi, edi
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 1
lea r9d, [rdi + 0x10]
lea edx, [rdi + 1]
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x2c], rax
mov dword [rbp - 0x24], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002ae83
mov rax, qword [rbp + 0x30]
lea r9d, [rdi + 0x10]
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeChangeNotifyPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002aed3
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeTcbPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002af23
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeImpersonatePrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002af73
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002afc3
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeRestorePrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b013
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeBackupPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b063
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeSecurityPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b0b3
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeSystemEnvironmentPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b103
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeIncreaseQuotaPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b153
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeTakeOwnershipPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b1a3
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeIncreaseBasePriorityPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b1f3
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b243
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rbx, qword [rbp + 0x20]
lea r8, [rbp + 0x30]
lea rdx, str.SeAssignPrimaryTokenPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x14002b293
mov rax, qword [rbp + 0x30]
lea r8, [rbp - 0x20]
mov r9d, 0x10
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], eax
mov qword [rbp - 8], rax
lea rax, [rbp - 0x40]
mov word [rbp - 0x40], 0x101
mov byte [rbp - 0x39], 0x10
mov dword [rbp - 0x38], edi
mov dword [rbp - 8], 0x20
mov qword [rbp - 0x10], rax
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov rcx, qword [rbp + 0x20]
lea r8, [rbp - 0x10]
lea r9d, [rax + 0x10]
mov edx, 0x19
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
xor eax, eax
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret