Function at 0x14000b6d0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
call fcn.14000b0a0
movsx ebx, al
call fcn.14000b090
movsx ecx, al
imul ebx, ecx
call fcn.14000b0d0
movsx esi, al
lea ebp, [r15 + 0xa]
lea eax, [rbx + rbx*4]
xor edx, edx
lea r14d, [rsi + rax*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r14d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b9dc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
lea edx, [rbp + 0x1e]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, r15d
xorps xmm2, xmm2
test eax, eax
movsx eax, byte [0x14005bcd2]
sete cl
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtsi2sd xmm2, rcx
movd xmm0, eax
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r14d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b800
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14000b800
mov r9d, ebp
lea edi, [rbx + rbx]
jmp 0x14000b861
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea edi, [rbx + rbx]
movsx ecx, byte [0x14005bcd0]
add eax, edi
add eax, esi
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b85c
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea edx, [rbx + rbx*2]
movsx ecx, byte [0x14005bcd0]
add eax, esi
xorps xmm0, xmm0
lea eax, [rax + rdx*2]
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si r9d, xmm0
jmp 0x14000b861
mov r9d, dword [rsp + 0x38]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, ebx
add eax, esi
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x14000b9dc
lea rdx, str.Failed_to_open_process_token.
lea rcx, [0x14005c4f0]
call fcn.140021a20
mov rcx, rax
call fcn.140021cd0
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea r9d, [rsi + rdi]
movsx ecx, byte [0x14005bcd0]
add eax, r9d
xor edx, edx
xorps xmm2, xmm2
div ecx
movsx ecx, byte [0x14005bcd3]
xor edx, edx
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
movsx ecx, byte [0x14005bcd0]
add eax, r14d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b95d
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14000c12a
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r9d
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000b9cf
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
jmp 0x14000b9d3
mov eax, dword [rsp + 0x38]
cmp r15d, eax
jl 0x14000c12a
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
imul r9d, edx, 7
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000bd86
lea r8, [rsp + 0x40]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, r15
xorps xmm2, xmm2
test eax, eax
movsx eax, byte [0x14005bcd2]
sete cl
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvtsi2sd xmm2, rcx
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000baf5
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14000baf5
mov r9d, ebp
jmp 0x14000bb8a
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000bb85
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si r9d, xmm0
jmp 0x14000bb8a
mov r9d, dword [rsp + 0x38]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*8]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
imul eax, r9d
test eax, eax
je 0x14000bd86
lea rdx, str.Failed_to_look_up_privilege_value.
lea rcx, [0x14005c4f0]
call fcn.140021a20
mov rcx, rax
call fcn.140021cd0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*8]
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
xorps xmm2, xmm2
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000bcea
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14000c12a
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000bd79
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
jmp 0x14000bd7d
mov eax, dword [rsp + 0x38]
cmp r15d, eax
jl 0x14000c12a
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x54], 2
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*4]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000c131
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], r15
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, r15
xorps xmm2, xmm2
test eax, eax
movsx eax, byte [0x14005bcd2]
sete cl
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvtsi2sd xmm2, rcx
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000bebf
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14000bf52
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000bf4e
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm0, xmm0
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si ebp, xmm0
jmp 0x14000bf52
mov ebp, dword [rsp + 0x38]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r9d, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx eax, al
add eax, r9d
add eax, ecx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx edx, byte [0x14005bcd3]
sub eax, edx
imul eax, ebp
test eax, eax
je 0x14000c131
lea rdx, str.Failed_to_adjust_token_privileges.
lea rcx, [0x14005c4f0]
call fcn.140021a20
mov rcx, rax
call fcn.140021cd0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm2, xmm2
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea r9d, [rcx + rdx*2]
movsx ecx, byte [0x14005bcd0]
add eax, r9d
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000c0b2
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14000c12a
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000c121
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r9d
div ecx
movsx ecx, byte [0x14005bcd3]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
jmp 0x14000c125
mov eax, dword [rsp + 0x38]
cmp r15d, eax
jge 0x14000c131
xor eax, eax
jmp 0x14000c2a9
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
xorps xmm2, xmm2
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
lea r9d, [rcx + rdx*2]
movsx ecx, byte [0x14005bcd0]
add eax, r9d
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
movsx eax, byte [0x14005bcd4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x40], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000c22c
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14000c2a4
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea eax, [rcx + rdx*2]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ecx
xor edx, edx
movsx ecx, byte [0x14005bcd0]
div ecx
movsx ecx, byte [0x14005bcd3]
cmp eax, ecx
je 0x14000c29b
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
xor edx, edx
movsx ecx, byte [0x14005bcd0]
add eax, r9d
div ecx
movsx ecx, byte [0x14005bcd3]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x40]
cvttsd2si eax, xmm0
jmp 0x14000c29f
mov eax, dword [rsp + 0x38]
cmp r15d, eax
jge 0x14000c2a9
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140025340
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret