Function at 0x140002ee0
Capabilities:
Acquire debug privileges
List tcp connections and listeners
Listen for remote procedure calls
Terminate process

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r9d, r9d
mov qword [rsp + 0x260], r15
lea r8, [0x14004a8c0]
lea rcx, [0x1400407d8]
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
xor r15d, r15d
mov ebx, eax
test eax, eax
je 0x140003135
cmp eax, 0x6cc
jne 0x140003110
cmp byte [0x14004a7ff], r15b
je 0x140003110
mov qword [rsp + 0x288], rsi
lea r9d, [r15 + 2]
mov dword [rsp + 0x28], r15d
lea r8d, [r15 + 1]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x268], r14
xor ecx, ecx
mov dword [rsp + 0x20], 5
mov dword [rsp + 0x30], r15d
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov ecx, dword [rsp + 0x30]
call fcn.14001abc4
lea r9d, [r15 + 2]
mov dword [rsp + 0x28], r15d
lea r8d, [r15 + 1]
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r14, rax
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov esi, r15d
cmp dword [r14], r15d
jbe 0x1400030d8
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x290], rdi
nop word [rax + rax]
mov ecx, esi
lea rax, [rcx + rcx*2]
mov ebp, dword [r14 + rax*8 + 0x18]
lea rdi, [r14 + rax*8]
lea rcx, [0x14004a8c0]
call fcn.14001a814
movzx ecx, word [rdi + 0xc]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
cmp ecx, ebx
je 0x14000300a
inc esi
cmp esi, dword [r14]
jb 0x140002fd0
jmp 0x1400030c8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x44]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, ebp
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400030a2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400030c8
mov r9d, ebp
lea r8, str.Failed_to_get_handle_to_kill_Process_ID:__i._n
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.140001220
or edx, 0xffffffff
lea rcx, [rsp + 0x50]
call fcn.140003ea0
mov rbp, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x290]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
lea r8, [0x14004a8c0]
lea rcx, str.ncacn_ip_tcp
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov r14, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x288]
jmp 0x140003135
mov r9d, ebx
lea r8, str.RpcServerUseProtseqEp_failed_with_code__i._n
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.140001220
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140003ea0
mov qword [rsp + 0x28], r15
lea rcx, [0x140041a60]
mov r9d, 0x11
mov dword [rsp + 0x20], 0x4d2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov r15, qword [rsp + 0x260]
mov ebx, eax
test eax, eax
je 0x14000318d
mov r9d, eax
lea r8, str.RpcServerRegisterIfEx_failed_with_code__i._n
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.140001220
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140003ea0
lea rcx, str._nKMS_Server_Emulator_started_successfully._n
call fcn.140003d80
xor r8d, r8d
mov edx, 0x4d2
lea ecx, [r8 + 1]
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
test eax, eax
je 0x1400031d6
mov r9d, eax
lea r8, str.RpcServerListen_failed_with_code__i._n
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.140001220
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140003ea0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400102f0
add rsp, 0x270
pop rbx
ret