Function at 0x140164580
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
add rcx, 0x1018
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, [0x140362b78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x1401645cb
mov rdx, qword [rax + 8]
jmp 0x1401645cf
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14016464c
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140164655
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140362ba0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140164677
mov rdx, qword [rax + 8]
jmp 0x14016467b
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1401646f8
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140164701
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140362bc8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140164723
mov rdx, qword [rax + 8]
jmp 0x140164727
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1401647a4
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1401647ad
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140362bf0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x1401647cf
mov rdx, qword [rax + 8]
jmp 0x1401647d3
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140164850
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140164859
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140362c28]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x14016487b
mov rdx, qword [rax + 8]
jmp 0x14016487f
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1401648fc
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140164905
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140362c58]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140164927
mov rdx, qword [rax + 8]
jmp 0x14016492b
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1401649a8
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1401649b1
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140362c80]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x1401649d3
mov rdx, qword [rax + 8]
jmp 0x1401649d7
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140164a54
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140164a5d
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140362ca8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140164a7f
mov rdx, qword [rax + 8]
jmp 0x140164a83
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140164b04
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rax, rdi
jmp 0x140164b11
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rax, rdi
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret