Function at 0x140023580
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
add rcx, 0x1018
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x1400235cb
mov rdx, qword [rax + 8]
jmp 0x1400235cf
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14002364c
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140023655
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeAuditPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140023677
mov rdx, qword [rax + 8]
jmp 0x14002367b
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400236f8
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140023701
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeSecurityPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140023723
mov rdx, qword [rax + 8]
jmp 0x140023727
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400237a4
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400237ad
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeTakeOwnershipPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x1400237cf
mov rdx, qword [rax + 8]
jmp 0x1400237d3
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140023850
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140023859
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeManageVolumePrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x14002387b
mov rdx, qword [rax + 8]
jmp 0x14002387f
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400238fc
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140023905
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeRestorePrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140023927
mov rdx, qword [rax + 8]
jmp 0x14002392b
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400239a8
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x1400239b1
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeBackupPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x1400239d3
mov rdx, qword [rax + 8]
jmp 0x1400239d7
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140023a54
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140023a5d
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rsp + 0x48]
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
mov rbx, rax
cmp qword [rax + 0x20], 8
jb 0x140023a7f
mov rdx, qword [rax + 8]
jmp 0x140023a83
lea rdx, [rax + 8]
lea r8, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140023b04
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rax, rdi
jmp 0x140023b11
mov rcx, rbx
call qword [sym.imp.MSVCP80.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rax, rdi
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret