Function at 0x140004380
Capabilities:
Acquire debug privileges
Get token privileges

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x20], xmm6
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov eax, 0x26532411
xorps xmm6, xmm6
mov r15d, 0x27be782f
mov r14d, 0xcbdd41cf
mov edi, 0x2ceb2c3f
jmp 0x1400043fd
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc3878231
mov ecx, 0x35325046
nop word cs:[rax + rax]
nop dword [rax + rax]
cmove eax, ecx
cmp dword [0x140038adc], 0xa
cmovl eax, ecx
cmp eax, 0x23df0fe3
jle 0x140004460
cmp eax, 0x3e236375
jle 0x1400044b0
cmp eax, 0x5cb880ba
jg 0x140004551
cmp eax, 0x50c63339
jle 0x140004672
cmp eax, 0x50c6333a
je 0x14000495a
cmp eax, 0x5250fc43
je 0x140004970
cmp eax, 0x5bb6e081
jne 0x1400043fd
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcbd81cc0
mov ecx, 0x6fb0c8a
jmp 0x1400043f0
cmp eax, 0xc3878230
jle 0x140004510
cmp eax, 0xdec0c2c7
jg 0x1400045ab
cmp eax, 0xcbdd41ce
jle 0x14000478a
cmp eax, 0xcbdd41cf
je 0x140004992
cmp eax, 0xd7239829
je 0x1400049c5
cmp eax, 0xde677b7c
jne 0x1400043fd
mov eax, 0x5250fc43
xor r12d, r12d
jmp 0x1400043fd
cmp eax, 0x2ceb2c3e
jle 0x1400045f7
cmp eax, 0x3275ae4d
jle 0x1400047b1
cmp eax, 0x3275ae4e
je 0x1400049db
cmp eax, 0x35325046
je 0x1400049f8
cmp eax, 0x3a399624
jne 0x1400043fd
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov eax, 0xcbdd41cf
jmp 0x1400043fd
cmp eax, 0xa8069db8
jle 0x140004636
cmp eax, 0xa9db401d
jle 0x1400047dd
cmp eax, 0xa9db401e
je 0x140004a1f
cmp eax, 0xb02fcd89
je 0x140004a3a
cmp eax, 0xb4dd1ae5
jne 0x1400043fd
mov eax, 0x508e43d9
jmp 0x1400043fd
cmp eax, 0x70a18380
jle 0x140004802
cmp eax, 0x70a18381
je 0x140004a50
cmp eax, 0x71b35894
je 0x140004a78
cmp eax, 0x74c3732c
jne 0x1400043fd
cmp dword [rbp - 0x20], 0
setne byte [rbp - 3]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1029b74c
cmove eax, edi
cmp dword [0x140038adc], 0xa
cmovl eax, edi
jmp 0x1400043fd
cmp eax, 0x1029b74b
jg 0x140004840
cmp eax, 0x173fa3b
je 0x140004a84
cmp eax, 0x6fb0c8a
jne 0x140004b00
mov rax, qword [rbp - 0x68]
mov ecx, dword [rbp - 0x1c]
cmp ecx, dword [rax]
sete byte [rbp - 2]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcbd81cc0
mov ecx, 0xb02fcd89
jmp 0x1400043f0
cmp eax, 0x27be782e
jg 0x140004894
cmp eax, 0x23df0fe4
je 0x1400048d4
cmp eax, 0x26532411
jne 0x1400043fd
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2c06209d
mov ecx, 0x23df0fe4
jmp 0x1400043f0
cmp eax, 0xa44ff5fe
jg 0x1400048b4
cmp eax, 0x94ac7ea4
je 0x140004925
cmp eax, 0xa01c6849
jne 0x1400043fd
mov rax, qword [rbp - 0x78]
mov eax, dword [rax]
mov dword [rbp - 0x1c], eax
lea rax, [rbp + 4]
mov qword [rbp - 0x68], rax
mov eax, 0x5bb6e081
jmp 0x1400043fd
cmp eax, 0x3e236376
je 0x140004a92
cmp eax, 0x508e43d9
jne 0x1400043fd
sub rsp, 0x20
xor esi, esi
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
mov r8, rbp
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
add rsp, 0x20
lea rax, [rbp + 8]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov dword [rbp + 8], 1
mov rax, qword [rbp - 0x30]
mov rax, qword [rax]
mov qword [rbp + 0xc], rax
mov dword [rbp + 0x14], 2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add rsp, 0x20
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x50], rcx
mov rcx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x10]
sub rsp, 0x20
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x18]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov edx, 3
xor r8d, r8d
xor r9d, r9d
mov r13, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call r13
add rsp, 0x30
mov rax, qword [rbp - 0x18]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.140017594
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x18]
mov r9d, dword [rax]
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x18]
mov r8, qword [rbp - 0x28]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov edx, 3
call r13
add rsp, 0x30
mov eax, 0x5cb880bb
jmp 0x1400043fd
cmp eax, 0xc3878231
je 0x140004aa2
cmp eax, 0xcbd81cc0
jne 0x1400043fd
mov rax, qword [rbp - 0x68]
mov eax, dword [rbp - 0x1c]
mov eax, 0x6fb0c8a
jmp 0x1400043fd
cmp eax, 0x2ceb2c3f
je 0x140004ab2
cmp eax, 0x305cb9a2
jne 0x1400043fd
cmp byte [rbp - 1], 0
mov eax, 0xa44ff5ff
mov ecx, 0xd7239829
cmovne eax, ecx
jmp 0x1400043fd
cmp eax, 0xa8069db9
je 0x140004ac8
cmp eax, 0xa8508327
jne 0x1400043fd
mov eax, 0xdec0c2c8
mov ebx, 1
jmp 0x1400043fd
cmp eax, 0x5cb880bb
je 0x140004ad5
cmp eax, 0x652586f4
jne 0x1400043fd
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x173fa3b
cmove eax, r15d
cmp dword [0x140038adc], 0xa
cmovl eax, r15d
jmp 0x1400043fd
cmp eax, 0x1029b74c
je 0x140004af3
cmp eax, 0x136c7fb6
jne 0x1400043fd
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x30
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
lea r8, [rbp + 8]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add rsp, 0x30
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.140017580
add rsp, 0x20
mov eax, 0x70a18381
jmp 0x1400043fd
cmp eax, 0x27be782f
je 0x14000492f
cmp eax, 0x2c06209d
jne 0x1400043fd
mov eax, 0x23df0fe4
jmp 0x1400043fd
cmp eax, 0xa44ff5ff
je 0x1400043c8
cmp eax, 0xa55bff5f
jne 0x1400043fd
mov eax, 0x3e236376
jmp 0x1400043fd
mov eax, 0x10
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x10
call fcn.140008fb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, rbp
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2c06209d
mov ecx, 0xb4dd1ae5
jmp 0x1400043f0
mov eax, 0xa8069db9
jmp 0x1400043fd
mov rax, qword [rbp - 0x38]
mov eax, dword [rax]
cmp eax, dword [rbp]
sete byte [rbp - 1]
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x173fa3b
mov ecx, 0x305cb9a2
jmp 0x1400043f0
mov rax, qword [rbp - 0x60]
add rax, 4
mov qword [rbp - 0x70], rax
mov eax, 0x3275ae4e
jmp 0x1400043fd
mov dword [rbp - 0x20], r12d
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1029b74c
mov ecx, 0x74c3732c
jmp 0x1400043f0
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3a399624
mov ecx, 0xa8508327
jmp 0x1400043f0
mov rax, qword [rbp - 0x38]
add rax, 4
mov qword [rbp - 0x78], rax
mov eax, 0xa01c6849
jmp 0x1400043fd
mov eax, dword [rbp - 8]
lea rax, [rax + rax*2]
shl rax, 2
add rax, qword [rbp - 0x70]
mov qword [rbp - 0x38], rax
mov eax, 0x652586f4
jmp 0x1400043fd
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 0x3c], eax
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc3878231
mov ecx, 0x94ac7ea4
jmp 0x1400043f0
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.140017580
add rsp, 0x20
mov eax, 0x71b35894
jmp 0x1400043fd
cmp byte [rbp - 2], 0
mov eax, 0xa44ff5ff
mov ecx, 0xa55bff5f
cmovne eax, ecx
jmp 0x1400043fd
mov eax, dword [0x140038ad8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3a399624
cmove eax, r14d
cmp dword [0x140038adc], 0xa
cmovl eax, r14d
jmp 0x1400043fd
mov eax, 0xdec0c2c8
xor ebx, ebx
jmp 0x1400043fd
mov rax, qword [rbp - 0x38]
mov eax, 0x27be782f
jmp 0x1400043fd
mov eax, 0x5250fc43
mov r12d, 1
jmp 0x1400043fd
mov eax, dword [rbp - 8]
mov eax, dword [rbp - 8]
mov eax, 0x35325046
jmp 0x1400043fd
cmp byte [rbp - 3], 0
mov eax, 0xa9db401e
mov ecx, 0x136c7fb6
cmovne eax, ecx
jmp 0x1400043fd
mov eax, 0x5cb880bb
mov esi, dword [rbp - 0x3c]
jmp 0x1400043fd
mov dword [rbp - 8], esi
mov rax, qword [rbp - 0x60]
mov ecx, dword [rbp - 8]
cmp ecx, dword [rax]
mov eax, 0xde677b7c
mov ecx, 0x50c6333a
cmovb eax, ecx
jmp 0x1400043fd
mov eax, dword [rbp - 0x20]
mov eax, 0x74c3732c
jmp 0x1400043fd
cmp eax, 0xdec0c2c8
jne 0x1400043fd
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
sub rsp, 0x20
call fcn.140009010
add rsp, 0x20
mov eax, ebx
movaps xmm6, xmmword [rbp + 0x20]
lea rsp, [rbp + 0x38]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret