Function at 0x1400105d0
Capabilities:
Manipulate user privileges

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea rbx, [rbp - 0x50]
mov rcx, rbx
call fcn.140074ff0
call fcn.140002b00
mov qword [rbp + 0x40], rax
lea r9, [rbp + 0x40]
xor ecx, ecx
mov rdx, rbx
mov r8d, 0xf0fff
call qword [sym.imp.advapi32.dll_LsaOpenPolicy]
test eax, eax
je 0x14001063f
lea rdx, [0x1400ac69a]
mov r8d, 0x19
xor ecx, ecx
call fcn.1400761c0
xor ecx, ecx
call fcn.140075d30
jmp 0x140010857
call fcn.140002b00
mov qword [rbp + 0x10], rax
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea r8, [rbp + 0x10]
mov rcx, rax
mov edx, 8
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x14001077b
movzx eax, byte [0x1400db181]
mov ecx, 0x100
mov edx, 1
call fcn.140013c10
test rax, rax
je 0x140010863
mov rbx, rax
mov dword [rbp + 0x24], 0
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov edx, 1
mov r8, rbx
mov r9d, 0x100
call qword [sym.imp.advapi32.dll_GetTokenInformation]
test eax, eax
mov qword [rbp + 0x48], rbx
je 0x1400107b9
mov rbx, qword [rbx]
add rsi, rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rsi
mov word [rbp - 0x10], 0
mov dword [rbp - 8], 1
lea r8, [0x1400ac630]
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x20]
call fcn.14000dc80
mov rdi, qword [rbp + 0x30]
mov eax, dword [rbp + 0x38]
lea edx, [rax*2 - 2]
add eax, eax
mov rcx, qword [rbp + 0x40]
mov word [rbp], dx
mov word [rbp + 2], ax
mov qword [rbp + 8], rdi
mov r8, rbp
mov rdx, rbx
mov r9d, 1
call qword [sym.imp.advapi32.dll_LsaAddAccountRights]
mov esi, eax
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.advapi32.dll_LsaClose]
test esi, esi
je 0x140010824
mov qword [rbp + 0x18], rdi
lea rdx, str.Failed_to_add_privilegeFailed_to_get_token_informationFailed_to_open_process_tokenFailed_to_open_LSA_policyAdjustTokenPrivileges_failed_with_error:
mov r8d, 0x17
xor ecx, ecx
call fcn.1400761c0
xor ecx, ecx
call fcn.140075d30
mov rsi, rax
mov edi, edx
mov rdx, qword [rbp + 0x28]
test rdx, rdx
je 0x140010809
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x18]
call fcn.140013bf0
jmp 0x140010809
call fcn.140075a70
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x30], edx
test edx, edx
je 0x140010668
test rax, rax
je 0x14001079d
lea rcx, [rbp + 0x28]
call fcn.1400754c0
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.advapi32.dll_LsaClose]
lea rdx, [0x1400ac67e]
mov r8d, 0x1c
jmp 0x14001062c
call fcn.140075a70
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x30], edx
test edx, edx
mov rbx, qword [rbp + 0x48]
je 0x1400106be
test rax, rax
je 0x1400107df
lea rcx, [rbp + 0x28]
call fcn.1400754c0
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.advapi32.dll_LsaClose]
lea rdx, [0x1400ac65f]
mov r8d, 0x1f
xor ecx, ecx
call fcn.1400761c0
xor ecx, ecx
call fcn.140075d30
mov rsi, rax
mov edi, edx
mov rcx, qword [rbp + 0x48]
mov edx, 0x100
mov r8d, 1
call fcn.140013bf0
mov rax, rsi
mov edx, edi
jmp 0x140010857
mov rdx, qword [rbp + 0x28]
test rdx, rdx
mov rsi, qword [rbp + 0x48]
je 0x140010842
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140013bf0
mov edx, 0x100
mov r8d, 1
mov rcx, rsi
call fcn.140013bf0
xor edx, edx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea r8, str.src_token.rs
mov ecx, 1
mov edx, 0x100
call fcn.1400a78a3
int3