Function at 0x14015ada0
Capabilities:
Get token privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor eax, eax
mov dword [rbp - 0x39], 1
mov dword [rbp + 0x1f], eax
xor edi, edi
mov dword [rbp - 9], edi
mov eax, 2
mov dword [rbp - 0x35], eax
mov eax, 4
mov dword [rbp - 0x31], eax
lea rax, str.SeSecurityPrivilege
mov qword [rbp - 0x29], rax
lea rax, str.SeTakeOwnershipPrivilege
mov qword [rbp - 0x21], rax
xorps xmm0, xmm0
lea rax, str.SeRestorePrivilege
mov r14, r9
mov qword [rbp - 0x19], rax
mov r12d, r8d
mov r15d, edx
mov r13d, ecx
mov esi, edi
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
test r9, r9
je 0x14015ae35
mov dword [r9], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0x28
lea r9, [rbp - 0x11]
mov rcx, rax
lea r8d, [rdx - 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
setne bl
test eax, eax
jne 0x14015ae84
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x14015ae84
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x11]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
setne bl
test bl, bl
jne 0x14015aea9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_open_token_to_adjust_privileges__winError:__d_
mov ecx, 2
mov r8d, eax
call fcn.140157a90
xor eax, eax
jmp 0x14015af55
mov ebx, edi
lea rdi, [rbp - 0x29]
nop
mov rdx, qword [rdi]
lea r8, [rbp - 1]
mov eax, ebx
lea rcx, [rax + rax*2]
lea r8, [r8 + rcx*4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14015af46
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x14015aeb0
test r12d, r12d
je 0x14015aee6
test r14, r14
je 0x14015afe3
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rbp - 9]
test ecx, ecx
je 0x14015af46
call fcn.140368330
mov rcx, qword [rbp - 0x11]
mov rbx, rax
test rax, rax
je 0x14015b005
mov r9d, dword [rbp - 9]
lea rax, [rbp - 9]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 3
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14015af82
mov rcx, rbx
call fcn.1403683a0
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 3
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edi, dword [rbx]
lea r9, [rbp - 0x39]
xor r10d, r10d
nop dword [rax + rax]
test edi, edi
je 0x14015afce
lea rcx, [r10 + r10*2]
mov r8, rdi
lea r11, [rbp - 1]
lea r11, [r11 + rcx*4]
lea rcx, [rbx + 0xc]
lea rdx, [rbx + 4]
nop dword [rax + rax]
mov rax, qword [r11]
cmp rax, qword [rdx]
jne 0x14015afc0
test byte [rcx], 3
je 0x14015afc0
or esi, dword [r9]
add rdx, 0xc
add rcx, 0xc
sub r8, 1
jne 0x14015afb0
inc r10d
add r9, 4
cmp r10d, 3
jb 0x14015af90
mov rcx, rbx
call fcn.1403683a0
mov edi, esi
mov ecx, 0x34
or edi, r13d
test r12d, r12d
cmovne edi, r13d
call fcn.140368330
mov rbx, rax
test rax, rax
jne 0x14015b015
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 6
jmp 0x14015af55
xor r8d, r8d
mov edx, r8d
test r15b, 1
je 0x14015b037
mov rax, qword [rbp - 1]
lea edx, [r8 + 1]
mov qword [rbx + 4], rax
mov eax, edi
and eax, 1
add eax, eax
mov dword [rbx + 0xc], eax
mov r9d, 2
test r15d, r9d
je 0x14015b063
mov eax, edx
lea rcx, [rax + rax*2]
mov rax, qword [rbp + 0xb]
mov qword [rbx + rcx*4 + 4], rax
mov eax, edi
and eax, r9d
neg eax
sbb eax, eax
and eax, r9d
mov dword [rbx + rcx*4 + 0xc], eax
inc edx
mov r9d, 4
test r15d, r9d
je 0x14015b08d
mov eax, edx
and edi, r9d
neg edi
lea rcx, [rax + rax*2]
mov rax, qword [rbp + 0x17]
mov qword [rbx + rcx*4 + 4], rax
sbb eax, eax
and eax, 2
mov dword [rbx + rcx*4 + 0xc], eax
inc edx
mov qword [rsp + 0x28], r8
xor r9d, r9d
mov dword [rbx], edx
xor edx, edx
mov rcx, qword [rbp - 0x11]
mov qword [rsp + 0x20], r8
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14015b0e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_adjust_privileges__winError:__d_
mov ecx, 3
mov r8d, eax
call fcn.140157a90
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1403683a0
jmp 0x14015af50
test r14, r14
je 0x14015b0e8
mov dword [r14], esi
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1403683a0
xor eax, eax
jmp 0x14015af55