Function at 0x140024aa0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
lea rax, [0x1403b6e18]
mov qword [rcx], rax
add rcx, 0x220
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024af5
mov rdx, qword [rax + 8]
jmp 0x140024af9
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140024b76
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140024b7f
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeAuditPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024ba1
mov rdx, qword [rax + 8]
jmp 0x140024ba5
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140024c22
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140024c2b
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeSecurityPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024c4d
mov rdx, qword [rax + 8]
jmp 0x140024c51
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140024cce
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140024cd7
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeTakeOwnershipPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024cf9
mov rdx, qword [rax + 8]
jmp 0x140024cfd
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140024d7a
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140024d83
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeManageVolumePrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024da5
mov rdx, qword [rax + 8]
jmp 0x140024da9
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140024e26
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140024e2f
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeRestorePrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024e51
mov rdx, qword [rax + 8]
jmp 0x140024e55
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140024ed2
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140024edb
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeBackupPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024efd
mov rdx, qword [rax + 8]
jmp 0x140024f01
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140024f7e
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140024f87
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140024fa9
mov rdx, qword [rax + 8]
jmp 0x140024fad
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14002502a
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140025033
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeSystemEnvironmentPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140025055
mov rdx, qword [rax + 8]
jmp 0x140025059
lea rdx, [rax + 8]
lea r8, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xf0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400250da
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rax, rdi
jmp 0x1400250e7
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rax, rdi
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret