Function at 0x140011b72
Capabilities:
Get token privileges

Disassembly:
jmp 0x14001f540
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x748
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x132
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x768]
mov rax, qword [0x14003b018]
xor rax, rbp
mov qword [rbp + 0x6f8], rax
lea rcx, [0x14004619a]
call fcn.140011bcc
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rbp + 4]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 4]
mov r8, qword [rbp + 0x28]
mov edx, 1
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea rdx, [rbp + 0x68]
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.1400114e2
lea rdx, str.User_SID:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14001107d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x1a4], 0x100
mov dword [rbp + 0x2e4], 0x100
lea rax, [rbp + 0x304]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1a4]
lea r8, [rbp + 0x90]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rax]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x14001f6c5
lea rdx, str._nUsername:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call fcn.140011168
lea rdx, [0x140033df0]
mov rcx, rax
call fcn.140011168
lea rdx, [rbp + 0x90]
mov rcx, rax
call fcn.140011168
lea rdx, [0x14001107d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 3
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rbp + 4]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 4]
mov r8, qword [rbp + 0x48]
mov edx, 3
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea rdx, str.Privileges:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [0x14001107d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x324], 0
jmp 0x14001f755
mov eax, dword [rbp + 0x324]
inc eax
mov dword [rbp + 0x324], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
cmp dword [rbp + 0x324], eax
jae 0x14001f7d4
mov dword [rbp + 0x464], 0x100
mov eax, dword [rbp + 0x324]
imul rax, rax, 0xc
mov rcx, qword [rbp + 0x48]
lea rax, [rcx + rax + 4]
lea r9, [rbp + 0x464]
lea r8, [rbp + 0x350]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
test eax, eax
je 0x14001f7cf
lea rdx, [0x140033e18]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [rbp + 0x350]
mov rcx, rax
call fcn.140011168
lea rdx, [0x14001107d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001f747
lea rax, [rbp + 0x4a4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0x484]
mov edx, 8
mov rcx, qword [rbp + 0x720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14001f817
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetTokenInformation_failed_with_error_code__d_n
call fcn.14001158c
cmp dword [rbp + 0x484], 1
jne 0x14001f843
lea rdx, str.___Token_is_TokenPrimary__n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011168
lea rdx, [0x14001107d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_free]
lea rcx, [rbp - 0x40]
lea rdx, [0x140032290]
call fcn.1400119c9
mov rcx, qword [rbp + 0x6f8]
xor rcx, rbp
call fcn.1400115c3
lea rsp, [rbp + 0x708]
pop rdi
pop rbp
ret