Function at 0x1400020c0
Capabilities:
Acquire debug privileges

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x140035410]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rbx, r8
mov dword [rbp - 0x79], edx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rbx
mov r12b, 1
xor r15d, r15d
mov qword [rbp - 0x71], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x61], r15
lea rcx, [rbp - 0x71]
call fcn.140001fd0
nop
mov qword [rbp + 0x17], 0xf
mov qword [rbp + 0xf], r15
mov byte [rbp - 1], r15b
or r14, 0xffffffffffffffff
mov r9, r14
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 1]
call fcn.140001990
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x59]
call fcn.140001eb8
mov rdx, rax
mov rcx, rbx
call fcn.1400023a4
cmp qword [rbp - 0x41], 0x10
jb 0x14000216b
mov rcx, qword [rbp - 0x59]
call fcn.14000c484
mov rcx, qword [rbp - 0x69]
mov r13, qword [rbp - 0x71]
sub rcx, r13
movabs rax, 0x6bca1af286bca1b
imul rcx
mov rdi, rdx
sar rdi, 3
mov rax, rdi
shr rax, 0x3f
add rdi, rax
je 0x14000234a
lea rsi, [r13 + 0x2c]
mov r13, qword [rbp - 0x11]
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r15
mov byte [rbp - 0x59], r15b
cmp byte [rsi], r15b
jne 0x1400021bc
mov r8, r15
jmp 0x1400021c8
mov r8, r14
inc r8
cmp byte [rsi + r8], r15b
jne 0x1400021bf
mov rdx, rsi
lea rcx, [rbp - 0x59]
call fcn.140001808
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x31]
call fcn.140001eb8
mov r15, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400021ef
mov rax, qword [rax]
mov r14, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400021ff
mov rcx, qword [rbx]
jmp 0x140002202
mov rcx, rbx
mov r8, r15
cmp r14, r15
cmovb r8, r14
test r8, r8
jne 0x140002215
xor eax, eax
jmp 0x14000221d
mov rdx, rax
call fcn.140018a80
movsxd rcx, eax
xor eax, eax
cmp r14, r15
setne al
cmp r14, r15
mov rdx, 0xffffffffffffffff
cmovb eax, edx
xor r15d, r15d
test rcx, rcx
cmovne eax, ecx
test eax, eax
sete r14b
cmp qword [rbp - 0x19], 0x10
jb 0x140002254
mov rcx, qword [rbp - 0x31]
call fcn.14000c484
test r14b, r14b
je 0x14000232f
mov r14d, dword [rsi - 0x24]
mov qword [rbp - 0x11], r15
mov qword [rbp - 1], r15
xor eax, eax
mov qword [rbp + 7], rax
lea r15d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x11]
lea edx, [r15 + 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400022d9
mov dword [rbp - 1], r15d
mov dword [rbp + 0xb], 2
lea r8, [rbp + 3]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400022cf
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 1]
xor edx, edx
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140002324
mov r8d, dword [rbp - 0x79]
mov rdx, r13
mov rcx, rax
call fcn.140003084
test rax, rax
jne 0x14000230a
xor r15d, r15d
jmp 0x140002316
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
jne 0x14000232c
xor r15d, r15d
mov r12b, r15b
jmp 0x14000232f
xor r15d, r15d
add rsi, 0x130
dec rdi
mov r14, 0xffffffffffffffff
jne 0x1400021a2
mov r13, qword [rbp - 0x71]
movzx edi, r12b
test r13, r13
je 0x14000235c
mov rcx, r13
call fcn.14000c484
nop
cmp qword [rbx + 0x18], 0x10
jb 0x14000236b
mov rcx, qword [rbx]
call fcn.14000c484
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r15
mov byte [rbx], r15b
mov eax, edi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14000bb20
mov rbx, qword [rsp + 0x128]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret