Function at 0x1400278c0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14007b658]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov qword [rbp - 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x40]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140027b0f
inc dword [0x14008e3ec]
lea r8, [rbp - 0x20]
xor eax, eax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14002795a
mov rax, qword [rbp - 0x20]
lea r9d, [rbx + 0x10]
mov rcx, qword [rbp - 0x40]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x14], rax
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea r8, [rbp - 0x28]
xor ecx, ecx
lea rdx, str.SeBackupPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400279a7
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeRestorePrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400279fe
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeSystemEnvironmentPrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027a55
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeLoadDriverPrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027aac
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor eax, eax
lea r8, [rbp - 0x28]
lea rdx, str.SeShutdownPrivilege
mov qword [rbp - 0x38], rax
xor ecx, ecx
mov qword [rbp - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027b03
mov rax, qword [rbp - 0x28]
lea r8, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x34], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x2c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140027b14
call fcn.14002fa70
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003da20
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret