Function at 0x18002bb50
Capabilities:
Manipulate user privileges

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1800a0238]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov ebx, ecx
mov dword [rsp + 0x64], ecx
mov rcx, qword [rbp + 0x2f0]
mov r10, r9
mov qword [rsp + 0x50], r9
mov r14, rdx
mov qword [rsp + 0x58], r8
lea edi, [rbx + 0x367]
mov qword [rbp - 0x20], rdx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x74], edi
cmp ebx, edi
ja case.0x18002c27a.17058
mov r15d, dword [rsp + 0x70]
lea rdx, [0x180000000]
mov r12, qword [rsp + 0x68]
xor esi, esi
movzx r13d, byte [rsp + 0x30]
lea eax, [rsi + 0x4e]
lea r9d, [rsi + 0x6c]
lea r11d, [rsi + 0x53]
nop dword [rax]
cmp ebx, 0x59a8
ja 0x18002c3cc
je 0x18002c3b5
cmp ebx, 0x428f
ja 0x18002c259
je 0x18002c23e
cmp ebx, 0x396c
ja 0x18002c1f3
je 0x18002bf0e
mov eax, ebx
sub eax, 0x3945
je 0x18002bf04
sub eax, 0xd
je 0x18002bc47
cmp eax, 0xd
jne case.default.0x18002c401
cmp qword [rsp + 0x68], 0
je 0x18002c4cb
mov r12, qword [rsp + 0x68]
jmp case.default.0x18002c401
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x70]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18002be9f
mov r15, qword [rbp - 0x30]
lea r13, [0x180000000]
mov r14d, 0x692f
mov dword [rsp + 0x48], r14d
nop dword [rax]
mov eax, r14d
sub eax, 0x692f
je 0x18002be67
sub eax, 2
je 0x18002be26
sub eax, 2
je 0x18002bcb4
cmp eax, 2
jne 0x18002be72
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002be72
cmp dword [rsp + 0x60], 0
jbe 0x18002be72
cmp dword [rbp - 0x64], 0
je 0x18002be72
movzx r14d, byte [rsp + 0x40]
mov ebx, esi
mov edi, 9
nop word [rax + rax]
cmp ebx, 0xf8
ja case.0x18002bd02.9
mov eax, ebx
movzx eax, byte [rax + r13 + 0x2c664]
mov ecx, dword [r13 + rax*4 + 0x2c63c]
add rcx, r13
jmp rcx
mov word [rbp + 0x24c], si
jmp case.0x18002bd02.9
mov eax, 0x65
mov dword [rbp + 0x246], 0x730072
mov word [rbp + 0x24a], ax
jmp case.0x18002bd02.9
test r14b, r14b
je case.0x18002bd02.9
mov r9d, dword [rbp - 0x68]
lea rax, [rbp - 8]
mov edx, dword [rbp - 0x54]
lea r8, [rbp - 0x50]
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetEventLogInformation]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp case.0x18002bd02.9
mov eax, 0x6d
mov dword [rbp + 0x238], 0x61004e
mov word [rbp + 0x23c], ax
jmp case.0x18002bd02.9
mov edx, dword [rsp + 0x60]
mov ecx, 0x40
mov dword [rbp - 0x54], esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x68], rax
mov r12, rax
mov dword [rbp - 0x50], esi
jmp case.0x18002bd02.9
mov r9d, dword [rsp + 0x60]
lea rax, [rsp + 0x60]
mov rcx, qword [rbp - 0x70]
mov r8, r12
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp case.0x18002bd02.9
lea rdx, [rbp + 0x238]
mov dword [rbp - 0x68], 4
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r15, rax
test rax, rax
jne case.0x18002bd02.9
xor r14b, r14b
jmp case.0x18002bd02.9
mov eax, 0x65
mov dword [rbp + 0x240], 0x6f0053
mov word [rbp + 0x23e], ax
mov eax, 0x75
mov word [rbp + 0x244], ax
jmp case.0x18002bd02.9
mov r14b, 1
mov r15, rsi
add ebx, 0x1f
sub rdi, 1
jne 0x18002bce0
mov byte [rsp + 0x40], r14b
mov r14d, dword [rsp + 0x48]
mov qword [rbp - 0x30], r15
jmp 0x18002be72
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x60]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x64]
lea edx, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
jmp 0x18002be72
mov dword [rbp - 0x60], 4
mov dword [rsp + 0x60], esi
add r14d, 2
mov dword [rsp + 0x48], r14d
cmp r14d, 0x6935
jbe 0x18002bc80
mov r15d, dword [rsp + 0x70]
movzx r13d, byte [rsp + 0x30]
mov r14, qword [rbp - 0x20]
mov ebx, dword [rsp + 0x64]
mov edi, dword [rsp + 0x74]
mov r9d, 0x6c
mov r10, qword [rsp + 0x50]
lea rdx, [0x180000000]
mov r8, qword [rsp + 0x58]
mov r11d, 0x53
mov rcx, qword [rsp + 0x38]
mov eax, 0x4e
add ebx, 0xd
mov dword [rsp + 0x64], ebx
cmp ebx, edi
jbe 0x18002bbe0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.18005fbe0
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x68], rsi
mov r12, rsi
jmp case.default.0x18002c401
xor eax, eax
lea r9, [rbp - 0x38]
xor r13b, r13b
mov qword [rbp + 0x18], rax
mov r8d, 0xf0fff
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x28], rax
xor ecx, ecx
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov byte [rsp + 0x30], r13b
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x18002be9f
mov r13d, 0xc
mov dword [rsp + 0x48], esi
mov qword [rbp - 0x28], r13
mov r12d, esi
nop
lea rdx, [0x180000000]
cmp r12d, 0x6e
ja case.0x18002bf86.12
mov eax, r12d
movzx eax, byte [rdx + rax + 0x2c794]
mov ecx, dword [rdx + rax*4 + 0x2c760]
add rcx, rdx
jmp rcx
mov rax, qword [rsp + 0x68]
lea r9, [rbp - 0x80]
mov rcx, qword [rbp - 0x38]
lea r8, [rbp - 0x40]
mov dword [rbp - 0x80], esi
mov r15d, esi
mov dword [rsp + 0x70], esi
mov rdx, qword [rax]
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
jne 0x18002c1a9
movzx r13d, byte [rsp + 0x41]
mov r15d, 0x1586
mov r12, qword [rbp]
nop dword [rax]
nop word [rax + rax]
mov eax, r15d
sub eax, 0x1586
je 0x18002c092
sub eax, 0x5a
je 0x18002c037
sub eax, 0x5a
je 0x18002c086
sub eax, 0x5a
je 0x18002c017
cmp eax, 0x5a
jne 0x18002c09c
test r13b, r13b
je 0x18002c009
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call sub.ADVAPI32.dll_LsaFreeMemory
jmp 0x18002c09c
mov r8d, dword [rbp - 0x58]
lea r9, [rbp - 0x48]
mov edx, dword [rbp - 0x5c]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp qword [rbp - 0x48], 0
jne 0x18002c09c
xor r13b, r13b
jmp 0x18002c09c
mov r14d, dword [rbp - 0x80]
mov rdi, rsi
mov dword [rbp - 0x5c], esi
mov dword [rbp - 0x58], esi
test r14, r14
je 0x18002c09c
mov rbx, qword [rbp - 0x40]
nop dword [rax]
movzx eax, word [rbp - 0x18]
cmp word [rbx], ax
jne 0x18002c070
mov rdx, qword [rbp - 0x10]
mov r8d, 0x2a
mov rcx, qword [rbx + 8]
call fcn.180061140
test eax, eax
je 0x18002c07e
inc rdi
add rbx, 0x10
cmp rdi, r14
jb 0x18002c050
jmp 0x18002c09c
mov dword [rsp + 0x70], 1
mov r15d, 0x163a
mov qword [rbp - 0x48], rsi
jmp 0x18002c09c
mov r13b, 1
mov r12, 0xffffffffffffffff
add r15d, 0x5a
cmp r15d, 0x16ee
jbe 0x18002bfd0
mov r15d, dword [rsp + 0x70]
mov qword [rbp], r12
mov r12d, dword [rsp + 0x48]
mov byte [rsp + 0x41], r13b
mov r13, qword [rbp - 0x28]
jmp 0x18002c1a9
mov dword [rbp + 0x274], 0x670065
mov dword [rbp + 0x278], 0x65
jmp case.0x18002bf86.12
mov dword [rbp + 0x268], 0x720050
jmp case.0x18002bf86.12
mov dword [rbp + 0x254], 0x6f004c
mov dword [rbp + 0x258], 0x6b0063
mov dword [rbp + 0x25c], 0x65004d
jmp case.0x18002bf86.12
mov dword [rbp + 0x26c], 0x760069
jmp case.0x18002bf86.12
mov qword [rbp - 0x40], rsi
jmp case.0x18002bf86.12
mov eax, 0x2c
mov word [rbp - 0x16], ax
jmp case.0x18002bf86.12
lea rax, [rbp + 0x250]
mov qword [rbp - 0x10], rax
mov eax, 0x2a
mov word [rbp - 0x18], ax
jmp case.0x18002bf86.12
mov dword [rbp + 0x250], 0x650053
jmp case.0x18002bf86.12
mov dword [rbp + 0x270], 0x6c0069
jmp case.0x18002bf86.12
mov dword [rbp + 0x260], 0x6f006d
mov dword [rbp + 0x264], 0x790072
jmp case.0x18002bf86.12
test r15d, r15d
jne 0x18002c1a0
mov rax, qword [rsp + 0x68]
lea r9d, [r15 + 1]
mov rcx, qword [rbp - 0x38]
lea r8, [rbp - 0x18]
mov rdx, qword [rax]
call sub.ADVAPI32.dll_LsaAddAccountRights
test eax, eax
sete byte [rsp + 0x30]
mov rcx, qword [rbp - 0x38]
call sub.ADVAPI32.dll_LsaClose
lea rdx, [0x180000000]
add r12d, 0xa
mov r9d, 0x6c
sub r13, 1
mov dword [rsp + 0x48], r12d
mov qword [rbp - 0x28], r13
jne 0x18002bf60
mov ebx, dword [rsp + 0x64]
mov r12, qword [rsp + 0x68]
mov r14, qword [rbp - 0x20]
mov edi, dword [rsp + 0x74]
movzx r13d, byte [rsp + 0x30]
mov r8, qword [rsp + 0x58]
mov r10, qword [rsp + 0x50]
jmp 0x18002beb6
mov eax, ebx
sub eax, 0x3979
je 0x18002c224
sub eax, 0xd
je case.0x18002c27a.17058
cmp eax, 0x8fc
mov eax, 0x4e
jne 0x18002bec6
mov dword [rbp + 0x1f0], 0x540053
jmp 0x18002bec6
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rsp + 0x68]
mov byte [rsp + 0x78], r13b
jmp 0x18002be9f
mov dword [rbp + 0x1f4], 0x490052
xor esi, esi
mov dword [rbp + 0x1f8], 0x47004e
jmp 0x18002bec6
lea eax, [rbx - 0x429c]
cmp eax, 0x4e
ja case.default.0x18002c401
movzx eax, byte [rdx + rax + 0x2c824]
mov ecx, dword [rdx + rax*4 + 0x2c804]
add rcx, rdx
jmp rcx
lea rdx, [rbp + 0x1fa]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.USER32.dll_CharPrevW]
lea rdx, [rbp + 0x1fc]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.USER32.dll_CharPrevW]
jmp 0x18002be9f
mov word [rbp + 0x1fc], si
jmp case.0x18002c401.22978
lea rdx, [rbp + 0x1f4]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.USER32.dll_CharPrevW]
lea rdx, [rbp + 0x1f6]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.USER32.dll_CharPrevW]
mov rdi, qword [r14]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18002be97
movzx esi, byte [rsp + 0x31]
mov eax, dword [rbx + 0x20]
lea r8, [rsp + 0x48]
mov rdx, r14
mov dword [rsp + 0x48], eax
mov ecx, 0x4a1e
call fcn.180047c40
and sil, al
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18002c339
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18002c334
cmp rbx, qword [rax + 0x10]
jne 0x18002c334
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18002c321
mov rbx, rax
jmp 0x18002c35f
mov rcx, qword [rax]
mov rbx, rax
cmp byte [rcx + 0x19], 0
jne 0x18002c35f
nop word [rax + rax]
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18002c350
cmp rbx, rdi
jne 0x18002c2f1
mov byte [rsp + 0x31], sil
xor esi, esi
jmp 0x18002be97
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x78], al
jmp case.0x18002c401.22978
lea rdx, [rbp + 0x1f2]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.USER32.dll_CharPrevW]
mov byte [rsp + 0x31], 1
jmp 0x18002be9f
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.USER32.dll_CharPrevW]
jmp 0x18002be9f
mov dword [rbp + 0x218], 0x730073
mov word [rbp + 0x21c], r9w
jmp 0x18002bec6
cmp ebx, 0x61b6
ja 0x18002c55a
je 0x18002c547
lea eax, [rbx - 0x59b5]
cmp eax, 0x9c
ja case.default.0x18002c401
movzx eax, byte [rdx + rax + 0x2c8ac]
mov ecx, dword [rdx + rax*4 + 0x2c874]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x21e], 0x610065
mov dword [rbp + 0x222], 0x330079
jmp case.0x18002c401.22978
mov dword [rbp + 0x22e], 0x6c
jmp case.0x18002c401.22978
mov eax, 0x33
mov word [rbp + 0x208], ax
jmp case.0x18002c401.22978
mov r8d, 1
lea rdx, [0x180085770]
lea rcx, [rbp + 0x200]
call fcn.18006416c
mov r9d, 0x6c
mov dword [rbp + 0x212], r9d
jmp 0x18002bea5
mov word [rbp + 0x210], si
jmp case.0x18002c401.22978
mov r8d, 2
mov word [rbp + 0x204], si
lea rdx, [0x1800857d8]
lea rcx, [rbp + 0x204]
call fcn.1800641b4
jmp 0x18002be9f
mov eax, dword [0x1800857f4]
mov dword [rbp + 0x20a], eax
movzx eax, word [0x1800857f8]
mov word [rbp + 0x20e], ax
jmp case.0x18002c401.22978
mov ecx, 0x202
lea rdx, [rbp + 0x50]
call qword [rbp + 8]
test eax, eax
je 0x18002be9f
mov byte [rsp + 0x78], 0
jmp case.0x18002c27a.17058
mov dword [rbp + 0x200], 0x730077
jmp case.0x18002c401.22978
mov dword [rbp + 0x228], 0x64002e
mov word [rbp + 0x22c], r9w
jmp case.0x18002c401.22978
mov r8d, 0xb7
lea rdx, [rbp + 0x218]
mov ecx, 0x51b7
call fcn.180047c40
mov r8d, 0x73
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x200]
mov ecx, 0x51b7
call fcn.180047c40
mov qword [rbp + 8], rax
jmp 0x18002be9f
mov eax, 0x32
mov word [rbp + 0x226], ax
jmp case.0x18002c401.22978
mov ecx, 0x38
call fcn.180064534
mov qword [rbp - 0x78], rax
jmp 0x18002be9f
cmp ebx, 0x61f7
ja 0x18002c5d4
je 0x18002c5c6
mov eax, ebx
sub eax, 0x61c3
je 0x18002c5b4
sub eax, 0xd
je 0x18002c5a3
sub eax, 0xd
je 0x18002c592
cmp eax, 0xd
jne case.default.0x18002c401
mov rcx, qword [rbp - 0x78]
mov qword [rcx + 0x10], rsi
mov eax, dword [r14]
mov dword [rcx], eax
jmp case.0x18002c401.22978
mov rax, qword [rbp - 0x78]
mov qword [rax + 0x30], rsi
mov qword [rax + 0x18], rsi
jmp case.default.0x18002c401
mov rax, qword [rbp - 0x78]
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], rsi
jmp case.default.0x18002c401
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x18002c632
mov qword [rcx + 8], rsi
jmp case.0x18002c401.22978
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x78], rax
jmp case.default.0x18002c401
mov eax, ebx
sub eax, 0x6204
je case.0x18002c27a.17058
sub eax, 0xbbe
je 0x18002c615
sub eax, 0x963
je 0x18002c5fd
cmp eax, 0xd
je case.0x18002c27a.17058
jmp case.default.0x18002c401
mov edx, dword [r10]
mov r9, rcx
mov rcx, r14
call qword [0x1800a11f0]
mov byte [rsp + 0x78], al
jmp 0x18002be9f
mov byte [r14 + 0x1ee], 1
jmp case.default.0x18002c401
call qword [rbp + 0x10]
cmp eax, 1
sete byte [rsp + 0x78]
jmp case.0x18002c27a.17058
mov rax, rsi
jmp 0x18002beda