Function at 0x140071c94
Capabilities:
Acquire debug privileges
Check if file exists

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x1401411c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [r11 - 0x28], 0
xor eax, eax
mov qword [r11 - 0x20], rax
mov bl, dl
mov qword [r11 - 0x18], rax
xor edi, edi
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x28]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
mov ebp, 0x80070000
test eax, eax
jne 0x140071d50
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
cmp dword [0x140142444], 2
jb 0x140071d1b
mov r8d, ebx
lea rdx, str.Couldnt_get_current_process_token__OpenProcessToken_returns_hr_0x_X
lea ecx, [rdi + 2]
call fcn.14003929c
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140071e8b
test byte [rcx + 0x1c], 0x10
je 0x140071e8b
cmp byte [rcx + 0x19], 2
jb 0x140071e8b
mov edx, 0x19
jmp 0x140071e74
mov rax, qword [rsp + 0x30]
lea r8, [rsp + 0x3c]
test rax, rax
mov dword [rsp + 0x38], 1
lea rdx, str.SeDebugPrivilege
cmovne rdi, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140071de8
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
cmp dword [0x140142444], 2
jb 0x140071db3
mov r8d, ebx
lea rdx, str.Couldnt_lookup_SeDebugPrivilege_name__LookupPrivilegeValue_returns_hr_0x_X
mov ecx, 2
call fcn.14003929c
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140071e8b
test byte [rcx + 0x1c], 0x10
je 0x140071e8b
cmp byte [rcx + 0x19], 2
jb 0x140071e8b
mov edx, 0x1a
jmp 0x140071e74
and qword [rsp + 0x28], 0
lea r8, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r9d, 0x10
and qword [rsp + 0x20], 0
xor edx, edx
movzx eax, bl
add eax, eax
mov dword [rsp + 0x44], eax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140071e89
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
cmp dword [0x140142444], 2
jb 0x140071e50
mov r8d, ebx
lea rdx, str.Couldnt_enable_debug_privilege__AdjustTokenPrivileges_returns_0x_X
mov ecx, 2
call fcn.14003929c
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140071e8b
test byte [rcx + 0x1c], 0x10
je 0x140071e8b
cmp byte [rcx + 0x19], 2
jb 0x140071e8b
mov edx, 0x1b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401056a8]
mov r9d, ebx
call fcn.140007608
jmp 0x140071e8b
xor ebx, ebx
test rdi, rdi
je 0x140071e9d
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140071ebc
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c20a0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, ebp
test eax, eax
cmovle ecx, eax
call fcn.14002953c
int3