Function at 0x140011249
Capabilities:
Get token privileges

Disassembly:
jmp 0x140017390
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x19038
call fcn.140011131
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x627e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x19058]
mov rax, qword [0x14002d068]
xor rax, rbp
mov qword [rbp + 0x18fe0], rax
lea rcx, [0x1400331bc]
call fcn.14001178a
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x186a0
rep stosb byte [rdi], al
mov dword [rbp + 0x186c4], 0
lea rax, [rbp + 0x186c4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x19010]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rbp + 0x186e4], eax
mov eax, dword [rbp + 0x186c4]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x18708], rax
lea rax, [rbp + 0x186c4]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x186c4]
mov r8, qword [rbp + 0x18708]
mov edx, 1
mov rcx, qword [rbp + 0x19010]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rbp + 0x186e4], eax
cmp dword [rbp + 0x186e4], 0
jne 0x14001748b
lea rcx, str.GetTokenInformation_failed___n
call fcn.140011384
xor eax, eax
jmp 0x14001838a
mov qword [rbp + 0x18728], 0
lea rdx, [rbp + 0x18728]
mov rax, qword [rbp + 0x18708]
mov rcx, qword [rax]
call fcn.14001158c
mov edx, 1
mov ecx, 0x1f4
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x18748], rax
mov edx, 1
mov ecx, 0x1f4
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x18768], rax
mov dword [rbp + 0x186c4], 0x32
lea rax, [rbp + 0x18784]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x186c4]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x18768]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x186c4]
mov r8, qword [rbp + 0x18748]
mov rax, qword [rbp + 0x18708]
mov rdx, qword [rax]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov dword [rbp + 0x186e4], eax
cmp dword [rbp + 0x186e4], 0
jne 0x14001754a
lea rcx, str.LookupAccountSidA_failed___n
call fcn.140011384
xor eax, eax
jmp 0x14001838a
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
mov rcx, qword [rbp + 0x18748]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x18768]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x18728]
lea r8, str.User_:__s___s_s__r_n
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov dword [rbp + 0x187a4], 0
lea rax, [rbp + 0x187a4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, qword [rbp + 0x19010]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rbp + 0x187c4], eax
mov eax, dword [rbp + 0x187a4]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x187e8], rax
lea rax, [rbp + 0x187a4]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x187a4]
mov r8, qword [rbp + 0x187e8]
mov edx, 2
mov rcx, qword [rbp + 0x19010]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rbp + 0x187c4], eax
cmp dword [rbp + 0x187c4], 0
jne 0x140017642
lea rcx, str.GetTokenGroupInformation_failed___n
call fcn.140011384
xor eax, eax
jmp 0x14001838a
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.Groups:__r_n
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov qword [rbp + 0x18808], 0
jmp 0x1400176a2
mov rax, qword [rbp + 0x18808]
inc rax
mov qword [rbp + 0x18808], rax
mov rax, qword [rbp + 0x187e8]
mov eax, dword [rax]
cmp qword [rbp + 0x18808], rax
jae 0x140017e27
mov qword [rbp + 0x18828], 0
imul rax, qword [rbp + 0x18808], 0x10
lea rdx, [rbp + 0x18828]
mov rcx, qword [rbp + 0x187e8]
mov rcx, qword [rcx + rax + 8]
call fcn.14001158c
mov edx, 1
mov ecx, 0x1f4
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x18848], rax
mov edx, 1
mov ecx, 0x1f4
call qword [sym.imp.ucrtbased.dll_calloc]
mov qword [rbp + 0x18868], rax
mov dword [rbp + 0x186c4], 0x32
imul rax, qword [rbp + 0x18808], 0x10
lea rcx, [rbp + 0x18884]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x186c4]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x18868]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x186c4]
mov r8, qword [rbp + 0x18848]
mov rcx, qword [rbp + 0x187e8]
mov rdx, qword [rcx + rax + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov dword [rbp + 0x186e4], eax
cmp dword [rbp + 0x186e4], 0
jne 0x14001778b
lea rcx, str.LookupAccountSidA_failed___n
call fcn.140011384
xor eax, eax
jmp 0x14001838a
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
mov rcx, qword [rbp + 0x18848]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x18868]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x18828]
lea r8, str._____s___s_s_
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
imul rax, qword [rbp + 0x18808], 0x10
mov rcx, qword [rbp + 0x187e8]
mov eax, dword [rcx + rax + 0x10]
mov dword [rbp + 0x188a4], eax
mov byte [rbp + 0x188c4], 0
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027db4]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov eax, dword [rbp + 0x188a4]
and eax, 4
test eax, eax
je 0x1400178a4
mov byte [rbp + 0x188c4], 1
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_ENABLED
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov eax, dword [rbp + 0x188a4]
and eax, 2
test eax, eax
je 0x14001794b
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x140017902
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_ENABLED_BY_DEFAULT
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
mov eax, dword [rbp + 0x188a4]
and eax, 0x20
test eax, eax
je 0x1400179f2
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x1400179a9
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_INTEGRITY
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
mov eax, dword [rbp + 0x188a4]
and eax, 0x40
test eax, eax
je 0x140017a99
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x140017a50
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_INTEGRITY_ENABLED
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
mov eax, dword [rbp + 0x188a4]
and eax, 0xc0000000
test eax, eax
je 0x140017b42
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x140017af9
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_LOGON_ID
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
mov eax, dword [rbp + 0x188a4]
and eax, 1
test eax, eax
je 0x140017be9
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x140017ba0
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_MANDATORY
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
mov eax, dword [rbp + 0x188a4]
and eax, 8
test eax, eax
je 0x140017c90
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x140017c47
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_OWNER
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
mov eax, dword [rbp + 0x188a4]
and eax, 0x20000000
test eax, eax
je 0x140017d39
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x140017cf0
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_RESOURCE
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
mov eax, dword [rbp + 0x188a4]
and eax, 0x10
test eax, eax
je 0x140017de0
movzx eax, byte [rbp + 0x188c4]
test eax, eax
je 0x140017d97
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_GROUP_USE_FOR_DENY_ONLY
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x188c4], 1
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027eb0]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
jmp 0x140017691
mov dword [rbp + 0x188e4], 0
lea rax, [rbp + 0x188e4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 3
mov rcx, qword [rbp + 0x19010]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rbp + 0x18904], eax
mov eax, dword [rbp + 0x188e4]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x18928], rax
lea rax, [rbp + 0x188e4]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x188e4]
mov r8, qword [rbp + 0x18928]
mov edx, 3
mov rcx, qword [rbp + 0x19010]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rbp + 0x18904], eax
cmp dword [rbp + 0x18904], 0
jne 0x140017ebe
lea rcx, str.GetTokenFroupInformation_failed___n
call fcn.140011384
xor eax, eax
jmp 0x14001838a
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.Privileges:__r_n
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov qword [rbp + 0x18948], 0
jmp 0x140017f1e
mov rax, qword [rbp + 0x18948]
inc rax
mov qword [rbp + 0x18948], rax
mov rax, qword [rbp + 0x18928]
mov eax, dword [rax]
cmp qword [rbp + 0x18948], rax
jae 0x140018340
mov qword [rbp + 0x18968], 0
mov dword [rbp + 0x18984], 0
imul rax, qword [rbp + 0x18948], 0xc
mov rcx, qword [rbp + 0x18928]
lea rax, [rcx + rax + 4]
lea r9, [rbp + 0x18984]
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
mov eax, dword [rbp + 0x18984]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x18968], rax
imul rax, qword [rbp + 0x18948], 0xc
mov rcx, qword [rbp + 0x18928]
lea rax, [rcx + rax + 4]
lea r9, [rbp + 0x18984]
mov r8, qword [rbp + 0x18968]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
mov r9, qword [rbp + 0x18968]
lea r8, str._____s
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
imul rax, qword [rbp + 0x18948], 0xc
mov rcx, qword [rbp + 0x18928]
mov eax, dword [rcx + rax + 0xc]
mov dword [rbp + 0x189a4], eax
mov byte [rbp + 0x189c4], 0
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027db4]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov eax, dword [rbp + 0x189a4]
and eax, 2
test eax, eax
je 0x1400180b5
mov byte [rbp + 0x189c4], 1
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_PRIVILEGE_ENABLED
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov eax, dword [rbp + 0x189a4]
and eax, 1
test eax, eax
je 0x14001815c
movzx eax, byte [rbp + 0x189c4]
test eax, eax
je 0x140018113
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_PRIVILEGE_ENABLED_BY_DEFAULT
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x189c4], 1
mov eax, dword [rbp + 0x189a4]
and eax, 4
test eax, eax
je 0x140018203
movzx eax, byte [rbp + 0x189c4]
test eax, eax
je 0x1400181ba
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_PRIVILEGE_REMOVED
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x189c4], 1
mov eax, dword [rbp + 0x189a4]
and eax, 0x80000000
test eax, eax
je 0x1400182ac
movzx eax, byte [rbp + 0x189c4]
test eax, eax
je 0x140018263
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027dcc]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.SE_PRIVILEGE_USED_FOR_ACCESS
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
mov byte [rbp + 0x189c4], 1
movzx eax, byte [rbp + 0x189c4]
test eax, eax
jne 0x1400182f9
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, str.none
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
lea rcx, [rbp + 0x10]
call fcn.140011339
mov ecx, 0x186a0
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x18fd8], rax
lea rcx, [rbp + 0x10]
call fcn.140011339
lea rax, [rbp + rax + 0x10]
lea r8, [0x140027eb0]
mov rcx, qword [rbp + 0x18fd8]
mov rdx, rcx
mov rcx, rax
call fcn.14001154b
jmp 0x140017f0d
mov edx, 2
mov ecx, 0x2710
call qword [sym.imp.ucrtbased.dll_calloc]
mov rcx, qword [rbp + 0x19018]
mov qword [rcx], rax
mov dword [rsp + 0x28], 0x2710
mov rax, qword [rbp + 0x19018]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140027320]
call fcn.14001165e
mov rax, rdi
mov rcx, qword [rbp + 0x18fe0]
xor rcx, rbp
call fcn.1400113ac
lea rsp, [rbp + 0x18ff8]
pop rdi
pop rbp
ret