Function at 0x1400998b4
Capabilities:
Acquire debug privileges

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov al, byte [0x140353270]
mov edx, 0x120
xor ecx, ecx
call fcn.140190370
test rax, rax
je 0x140099b6e
mov rsi, rax
lea rax, str.SeAssignPrimaryTokenPrivilege
mov qword [rsi], rax
lea rax, str.SeAuditPrivilege
mov qword [rsi + 8], rax
lea rax, str.SeBackupPrivilege
mov qword [rsi + 0x10], rax
lea rax, str.SeChangeNotifyPrivilege
mov qword [rsi + 0x18], rax
lea rax, str.SeCreateGlobalPrivilege
mov qword [rsi + 0x20], rax
lea rax, str.SeCreatePagefilePrivilege
mov qword [rsi + 0x28], rax
lea rax, str.SeCreatePermanentPrivilege
mov qword [rsi + 0x30], rax
lea rax, str.SeCreateSymbolicLinkPrivilege
mov qword [rsi + 0x38], rax
lea rax, str.SeCreateTokenPrivilege
mov qword [rsi + 0x40], rax
lea rax, str.SeDebugPrivilege
mov qword [rsi + 0x48], rax
lea rax, str.SeDelegateSessionUserImpersonatePrivilege
mov qword [rsi + 0x50], rax
lea rax, str.SeEnableDelegationPrivilege
mov qword [rsi + 0x58], rax
lea rax, str.SeImpersonatePrivilege
mov qword [rsi + 0x60], rax
lea rax, str.SeIncreaseQuotaPrivilege
mov qword [rsi + 0x68], rax
lea rax, str.SeIncreaseBasePriorityPrivilege
mov qword [rsi + 0x70], rax
lea rax, str.SeIncreaseWorkingSetPrivilege
mov qword [rsi + 0x78], rax
lea rax, str.SeLoadDriverPrivilege
mov qword [rsi + 0x80], rax
lea rax, str.SeLockMemoryPrivilege
mov qword [rsi + 0x88], rax
lea rax, str.SeMachineAccountPrivilege
mov qword [rsi + 0x90], rax
lea rax, str.SeManageVolumePrivilege
mov qword [rsi + 0x98], rax
lea rax, str.SeProfileSingleProcessPrivilege
mov qword [rsi + 0xa0], rax
lea rax, str.SeRelabelPrivilege
mov qword [rsi + 0xa8], rax
lea rax, str.SeRemoteShutdownPrivilege
mov qword [rsi + 0xb0], rax
lea rax, str.SeRestorePrivilege
mov qword [rsi + 0xb8], rax
lea rax, str.SeSecurityPrivilege
mov qword [rsi + 0xc0], rax
lea rax, str.SeShutdownPrivilege
mov qword [rsi + 0xc8], rax
lea rax, str.SeSyncAgentPrivilege
mov qword [rsi + 0xd0], rax
lea rax, str.SeSystemtimePrivilege
mov qword [rsi + 0xd8], rax
lea rax, str.SeSystemEnvironmentPrivilege
mov qword [rsi + 0xe0], rax
lea rax, str.SeSystemProfilePrivilege
mov qword [rsi + 0xe8], rax
lea rax, str.SeTakeOwnershipPrivilege
mov qword [rsi + 0xf0], rax
lea rax, str.SeTcbPrivilege
mov qword [rsi + 0xf8], rax
lea rax, str.SeTimeZonePrivilege
mov qword [rsi + 0x100], rax
lea rax, str.SeTrustedCredManAccessPrivilege
mov qword [rsi + 0x108], rax
lea rax, str.SeUndockPrivilege
mov qword [rsi + 0x110], rax
lea rax, str.SeUnsolicitedInputPrivilege
mov qword [rsi + 0x118], rax
lea rdi, [rsp + 0x38]
mov qword [rdi], 0
movaps xmm0, xmmword [0x14023fdb0]
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rdi
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
jne 0x140099ae6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [rsp + 0x44]
xor r14d, r14d
mov r15, qword [sym.imp.advapi32.dll_LookupPrivilegeValueW]
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm6, xmm6
lea rbx, [rsp + 0x40]
mov r13, qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
mov rdx, qword [rsi + r14]
xor ecx, ecx
mov r8, rdi
call r15
test eax, eax
jne 0x140099b1e
call r12
mov rcx, qword [rsp + 0x38]
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rbx
xor r9d, r9d
call r13
test eax, eax
jne 0x140099b3a
call r12
add r14, 8
cmp r14, 0x120
jne 0x140099b0b
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x120
call fcn.1402316b0
int3