Function at 0x140001ab4
Capabilities:
Accept command line arguments
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov eax, dword [0x14000505c]
xor r12d, r12d
mov r14d, r12d
mov r15d, r12d
mov ebx, r12d
lea esi, [r12 + 2]
mov rdi, qword [0x140005060]
mov ebp, 0x20
test rdi, rdi
jne 0x140001b46
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
mov qword [0x140005060], rax
mov ecx, r12d
movzx eax, word [rax]
test ax, ax
je 0x140001b40
cmp ax, 0x22
jne 0x140001b1f
test ecx, ecx
mov eax, r12d
sete al
mov ecx, eax
jmp 0x140001b2e
test ecx, ecx
jne 0x140001b2e
cmp ax, bp
je 0x140001b39
cmp ax, 9
je 0x140001b39
add rdi, rsi
movzx eax, word [rdi]
test ax, ax
jne 0x140001b0d
mov qword [0x140005060], rdi
mov eax, dword [0x14000505c]
test rbx, rbx
je 0x140001b6c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x14000505c]
mov rdi, qword [0x140005060]
movzx ecx, word [rdi]
cmp cx, bp
je 0x140001b7a
cmp cx, 9
jne 0x140001b7f
add rdi, rsi
jmp 0x140001b6c
mov qword [0x140005060], rdi
test cx, cx
je 0x140001cc8
mov rax, rdi
mov rbp, rdi
mov rdx, rdi
mov r8d, 0x20
cmp cx, r8w
je 0x140001bc5
mov rbp, rdx
cmp cx, 9
je 0x140001bc5
add rax, rsi
mov rbp, rax
mov qword [0x140005060], rax
mov rdx, rax
movzx ecx, word [rax]
test cx, cx
jne 0x140001b9e
sub rbp, rdi
sar rbp, 1
add rbp, rbp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbp + 2]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.msvcrt.dll_memcpy]
movzx eax, word [rbx]
mov ecx, 0xfffd
sub ax, 0x2d
test cx, ax
jne 0x140001c96
lea r8, [rbx + 2]
movzx ecx, word [r8]
test cx, cx
je 0x140001c96
mov eax, dword [0x14000505c]
movzx edx, cx
sub edx, 0x68
je 0x140001c83
sub edx, 0xa
je 0x140001c4a
sub edx, 1
je 0x140001c46
sub edx, 3
je 0x140001c41
cmp edx, 1
jne 0x140001c64
or eax, 8
jmp 0x140001c4d
or eax, 4
jmp 0x140001c4d
or eax, esi
jmp 0x140001c4d
or eax, 1
add r8, rsi
mov dword [0x14000505c], eax
movzx ecx, word [r8]
test cx, cx
jne 0x140001c20
jmp 0x140001ae1
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str._E__Invalid_option_n
lea rcx, [rax + 0x60]
call qword [sym.imp.msvcrt.dll_fwprintf]
mov r14d, 1
jmp 0x140001c99
lea rcx, str.superUser.exe__options___command_to_run__nOptions:__You_can_use_either___or____n___h___Display_this_help_message._n___r___Return_exit_code_of_child_process._Requires__w._n___s___Child_process_shares_parents_console._Requires__w._n___v___Display_verbose_messages._n___w___Wait_for_the_created_process_to_finish_before_exiting.
call qword [sym.imp.msvcrt.dll__putws]
or r14d, 0xffffffff
jmp 0x140001c99
mov r15, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
je 0x140001cc2
cmp r14d, 0xffffffff
mov ecx, r12d
cmovne ecx, r14d
jmp 0x140001e26
mov eax, dword [0x14000505c]
test al, 1
jne 0x140001cd1
test sil, al
je 0x140001d04
test al, 8
jne 0x140001d04
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str._E___r_or__s_option_requires__w_n
lea rcx, [rax + 0x60]
call qword [sym.imp.msvcrt.dll_fwprintf]
mov eax, dword [0x14000505c]
and al, 1
neg al
sbb eax, eax
and eax, 0xfff0bdbe
inc eax
jmp 0x140001e46
test r15, r15
lea rdi, str.cmd.exe
cmovne rdi, r15
test al, 4
je 0x140001d26
mov rdx, rdi
lea rcx, str._D__Your_commandline_is___ls__n
call qword [sym.imp.msvcrt.dll_wprintf]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcslen]
lea rbx, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call qword [sym.imp.msvcrt.dll_memcpy]
mov qword [rsp + 0x60], r12
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edi, [rbx + 0x1f]
jmp 0x140001d94
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x140001dab
test ebx, ebx
je 0x140001dab
mov ecx, esi
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x140001d72
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140001df2
lea rdx, str.SeDebugPrivilege
call fcn.140001e60
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140001df2
test byte [0x14000505c], sil
je 0x140001de6
call fcn.140001f3c
mov esi, eax
test eax, eax
jne 0x140001e09
mov rcx, rbp
call fcn.140001624
mov esi, eax
jmp 0x140001e09
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str._E__Acquiring_SeDebugPrivilege_failed_n
lea rcx, [rax + 0x60]
call qword [sym.imp.msvcrt.dll_fwprintf]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, 0xffffffff
mov ecx, r12d
cmovne ecx, esi
test byte [0x14000505c], 1
je 0x140001e44
test ecx, ecx
je 0x140001e3e
mov eax, 0xfff0bdc0
sub eax, ecx
mov ecx, eax
jmp 0x140001e44
mov ecx, dword [0x140005058]
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret