Function at 0x1800785ac
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, qword [rbp + 0x128]
mov r12, r8
mov qword [rbp + 0x30], r8
mov r15d, edx
xor r8d, r8d
mov qword [rbp - 0x60], r9
mov r11b, r8b
mov qword [rbp - 0x38], rbx
movzx edx, word [r12 + 2]
mov esi, 0x8000
movzx r10d, dx
mov byte [rsp + 0x52], r8b
lea eax, [r8 + 0x10]
mov byte [rsp + 0x51], r8b
mov byte [rsp + 0x5a], r8b
mov byte [rsp + 0x53], r8b
mov byte [rsp + 0x59], r8b
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x55], r8b
mov byte [rsp + 0x56], r8b
mov byte [rsp + 0x57], r8b
mov byte [rsp + 0x58], r8b
mov qword [rbp + 0x10], r8
mov qword [rbp - 0x50], r8
mov qword [rbp + 8], r8
mov qword [rsp + 0x68], r8
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x10], r8
mov qword [rbp - 8], r8
mov qword [rbp + 0x20], r8
mov byte [rsp + 0x50], r8b
mov byte [rbp - 0x24], r8b
mov dword [rbp - 0x20], r11d
mov qword [rbp + 0x18], r8
and r10w, ax
jne 0x1800c159a
mov r14, r8
mov rcx, qword [r9]
mov qword [rbp - 0x80], r14
test byte [rcx + 2], al
je 0x1800c15c1
cmp word [rcx + 2], r8w
jge 0x1800c15c9
cmp dword [rcx + 0xc], r8d
je 0x1800c15c1
mov edi, dword [rcx + 0xc]
add rdi, rcx
mov qword [rbp - 0x40], r8
mov rax, qword gs:[0x60]
mov qword [rsp + 0x70], rdi
mov qword [rbp + 0x28], r8
mov r13, qword [rax + 0x30]
movzx eax, word [rcx + 2]
shr ax, 0xf
test al, al
je 0x1800c15d2
mov r9d, 0x80
movzx eax, dx
and ax, r9w
mov r8d, r15d
mov word [rbp - 0x44], ax
mov al, dl
setne byte [rbp - 0x78]
and r8d, r9d
shr al, 6
mov r9d, r15d
and al, 1
and r9d, 0x100
mov byte [rbp - 0x77], al
bt r15d, 0x10
jb 0x1800c15dc
xor r8d, r8d
mov r11d, 1
test r11b, r15b
jne 0x1800c164a
cmp word [rcx + 2], r8w
jge 0x1800c1707
cmp dword [rcx + 4], r8d
je 0x1800c16f4
mov eax, dword [rcx + 4]
add rax, rcx
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1800c16f4
mov rcx, rax
call sym.ntdll.dll_RtlValidSid
xor r10d, r10d
test al, al
je 0x1800c16f4
test r15b, 2
jne 0x1800c1710
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
cmp word [rax + 2], r10w
jge 0x1800c1746
cmp dword [rax + 8], r10d
je 0x1800c21cd
mov ecx, dword [rax + 8]
add rcx, rax
mov qword [rbp - 0x68], rcx
test rcx, rcx
je 0x1800c21cd
call sym.ntdll.dll_RtlValidSid
xor r10d, r10d
test al, al
je 0x1800c174f
lea edx, [r10 + 4]
test r15d, 0x1f8
jne 0x1800c1759
mov rax, qword [rsp + 0x68]
lea r14d, [r10 + 1]
mov qword [rbp - 0x50], rdi
mov rdi, qword [rbp - 0x30]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rax
mov r11d, 0x140c
test dl, r15b
je 0x1800c2089
movzx ecx, word [r12 + 2]
movzx eax, cx
and ax, dx
test byte [rbp + 0x110], r14b
jne 0x1800c1eee
test ax, ax
je 0x180078af5
test cx, cx
js 0x180078ae1
mov r14, qword [r12 + 0x20]
mov eax, ecx
mov r12d, 4
and eax, 0x1000
or eax, esi
mov esi, eax
or esi, edx
mov edx, 0x500
and cx, dx
cmp cx, dx
je 0x1800c1fb3
cmp word [rbp - 0x44], r10w
jne 0x1800c1fc0
mov rax, qword [rbp - 0x70]
mov edx, 0xfffffffc
movzx eax, byte [rax + 1]
lea ecx, [rax*4 + 8]
mov rax, qword [rbp - 0x68]
mov dword [rbp - 0x48], ecx
movzx eax, byte [rax + 1]
lea r8d, [rax*4 + 8]
mov rax, qword [rbp - 0x50]
mov dword [rbp - 0x38], r8d
test rax, rax
je 0x1800c20bf
movzx ebx, word [rax + 2]
add ebx, 3
and ebx, edx
test r14, r14
je 0x1800c20c7
movzx r12d, word [r14 + 2]
add r12d, 3
and r12d, edx
mov edx, dword [0x18015c294]
lea eax, [r12 + rbx]
add eax, r8d
add edx, 0x140000
lea r8d, [rcx + 0x14]
mov rcx, r13
add r8d, eax
call sym.ntdll.dll_RtlAllocateHeap
xor r10d, r10d
mov rdi, rax
test rax, rax
je 0x1800c2040
xor eax, eax
lea r15, [rdi + 0x14]
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], eax
lea eax, [r10 + 1]
mov byte [rdi], al
cmp byte [rbp - 0x20], r10b
jne 0x1800c20cf
movzx eax, si
mov edx, 0x4000
or ax, word [rdi + 2]
mov word [rdi + 2], ax
movzx ecx, ax
mov rax, qword [rbp + 0x30]
test word [rax + 2], dx
jne 0x1800c20db
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x1800c20ed
movzx r8d, word [rax + 2]
mov rdx, rax
mov rcx, r15
call sym.ntdll.dll_RtlCopyMemory
mov rdx, qword [rbp + 0x120]
mov rcx, r15
call fcn.180078b08
mov rax, qword [rbp - 0x50]
sub r15d, edi
mov dword [rdi + 0xc], r15d
movzx ecx, word [rax + 2]
cmp ebx, ecx
ja 0x1800c20f6
mov r15d, ebx
lea rax, [rdi + 0x14]
add r15, rax
xor r10d, r10d
test sil, 0x10
jne 0x180078977
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
movzx ecx, word [rax + 2]
mov eax, 0x2830
and cx, ax
or word [rdi + 2], cx
test r14, r14
je 0x1800c2110
movzx r8d, word [r14 + 2]
mov rdx, r14
mov rcx, r15
call sym.ntdll.dll_RtlCopyMemory
mov rdx, qword [rbp + 0x120]
mov rcx, r15
call fcn.180078b08
mov eax, r15d
sub eax, edi
mov dword [rdi + 0x10], eax
movzx ecx, word [r14 + 2]
cmp r12d, ecx
ja 0x1800c2119
mov eax, r12d
add r15, rax
xor r10d, r10d
mov r14d, 4
test r14b, sil
mov rsi, qword [rbp - 0x60]
lea r12d, [r14 - 3]
je 0x1800c212f
mov ebx, dword [rbp - 0x48]
mov rcx, r15
mov rdx, qword [rbp - 0x70]
mov r8d, ebx
call sym.ntdll.dll_RtlCopyMemory
mov eax, r15d
add rbx, r15
sub eax, edi
xor r14d, r14d
mov dword [rdi + 4], eax
cmp byte [rsp + 0x51], r14b
jne 0x180078a0b
mov rax, qword [rsi]
movzx ecx, word [rax + 2]
and cx, r12w
or word [rdi + 2], cx
mov r8d, dword [rbp - 0x38]
mov rcx, rbx
mov rdx, qword [rbp - 0x68]
call sym.ntdll.dll_RtlCopyMemory
sub ebx, edi
mov dword [rdi + 8], ebx
cmp byte [rsp + 0x52], r14b
jne 0x180078a36
mov rax, qword [rsi]
movzx ecx, word [rax + 2]
and cx, 2
or word [rdi + 2], cx
mov r8, qword [rsi]
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
mov qword [rsi], rdi
mov ebx, r10d
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
cmp byte [rsp + 0x53], r10b
jne 0x1800c21db
test r14, r14
jne 0x1800c21f1
test rdi, rdi
jne 0x1800c2211
mov r8, qword [rbp - 0x18]
test r8, r8
jne 0x1800c2231
mov r8, qword [rbp - 0x10]
test r8, r8
jne 0x1800c224e
mov r8, qword [rbp - 8]
test r8, r8
jne 0x1800c226b
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x180078aae
cmp byte [rsp + 0x59], r10b
jne 0x1800c2288
cmp byte [rsp + 0x5a], r10b
jne 0x180078afd
mov eax, ebx
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.18008b0e0
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [r12 + 0x10], r10d
je 0x180078af5
mov r14d, dword [r12 + 0x10]
add r14, r12
jmp 0x180078813
mov r14, r10
jmp 0x180078813
mov r8, qword [rbp + 0x18]
jmp 0x1800c1935
test dx, dx
jns 0x1800c15b7
cmp dword [r12 + 0xc], r8d
je 0x180078680
mov r14d, dword [r12 + 0xc]
add r14, r12
jmp 0x180078683
mov r14, qword [r12 + 0x18]
jmp 0x180078683
mov rdi, r8
jmp 0x1800786ae
mov rdi, qword [rcx + 0x18]
jmp 0x1800786ae
mov ebx, 0xc00000e7
jmp 0x180078ab5
or r15d, 0x1ff
mov eax, r15d
btr eax, 7
test r8d, r8d
cmovne eax, r15d
xor r8d, r8d
mov r15d, eax
btr r15d, 8
test r9d, r9d
cmovne r15d, eax
test rdi, rdi
jne 0x180078715
test r14, r14
jne 0x180078715
and r15d, 0xfffffe07
test r10w, r10w
je 0x1800c162b
or r15d, 8
jmp 0x180078715
mov eax, 0x800
movzx r11d, r11b
test ax, dx
mov r9d, 1
cmovne r11d, r9d
mov dword [rbp - 0x20], r11d
jmp 0x180078715
mov eax, r15d
shr eax, 2
not al
and al, r11b
mov dword [rbp - 0x24], eax
test dx, dx
jns 0x1800c1674
cmp dword [r12 + 4], r8d
jne 0x1800c166a
mov qword [rbp - 0x70], r8
jmp 0x1800c167d
mov eax, dword [r12 + 4]
add rax, r12
jmp 0x1800c1679
mov rax, qword [r12 + 8]
mov qword [rbp - 0x70], rax
test byte [rbp + 0x110], 8
mov byte [rsp + 0x51], r11b
jne 0x1800c16fe
test rbx, rbx
je 0x1800c16f4
mov r9d, 0x38
lea rax, [rbp]
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 - 0x2e]
call sym.ntdll.dll_NtQueryInformationToken
mov dword [rsp + 0x78], eax
mov ebx, eax
test eax, eax
js 0x180078ab5
cmp dword [rbp + 0x50], 2
jne 0x1800c16d7
mov eax, 1
cmp dword [rbp + 0x54], eax
jge 0x1800c16d7
mov ebx, 0xc00000a5
jmp 0x180078ab5
mov rbx, qword [rbp - 0x38]
lea r9, [rsp + 0x78]
mov r8b, byte [rbp - 0x78]
mov rcx, rbx
mov rdx, qword [rbp - 0x70]
call fcn.180044394
test al, al
jne 0x1800c16fe
mov ebx, 0xc000005a
jmp 0x180078ab5
mov rax, qword [rbp - 0x70]
jmp 0x18007874c
mov rax, qword [rcx + 8]
jmp 0x18007873f
cmp word [r12 + 2], r10w
jge 0x1800c172f
cmp dword [r12 + 8], r10d
jne 0x1800c1725
mov qword [rbp - 0x68], r10
jmp 0x1800c1738
mov eax, dword [r12 + 8]
add rax, r12
jmp 0x1800c1734
mov rax, qword [r12 + 0x10]
mov qword [rbp - 0x68], rax
mov rcx, qword [rbp - 0x68]
mov byte [rsp + 0x52], 1
jmp 0x18007878f
mov rcx, qword [rax + 0x10]
jmp 0x18007878b
mov ebx, 0xc000005b
jmp 0x180078ab5
mov eax, r15d
and eax, 0x10
mov dword [rbp - 0x48], eax
je 0x1800c1852
mov dword [rsp + 0x60], r10d
lea r8, [rsp + 0x60]
mov edx, 0x11
mov rcx, r14
call sym.ntdll.dll_RtlFindAceByType
mov rdi, rax
test rax, rax
je 0x1800c17a3
add rax, 8
test dword [rdi + 4], 0xfffffff8
mov qword [rbp + 0x20], rax
mov al, byte [rdi + 1]
mov byte [rsp + 0x50], al
jne 0x1800c191c
test rbx, rbx
je 0x1800c17ed
mov r9d, 0x38
lea rax, [rbp]
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 - 0x2e]
call sym.ntdll.dll_NtQueryInformationToken
mov dword [rsp + 0x78], eax
mov ebx, eax
test eax, eax
js 0x180078ab5
cmp dword [rbp + 0x50], 2
jne 0x1800c180d
mov r9d, 1
cmp dword [rbp + 0x54], r9d
jl 0x1800c16cd
jmp 0x1800c180d
lea r8, [rbp - 0x40]
mov edx, 8
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtOpenProcessToken
mov dword [rsp + 0x78], eax
mov ebx, eax
test eax, eax
js 0x180078ab5
mov rbx, qword [rbp - 0x38]
lea r9, [rsp + 0x78]
mov rcx, qword [rbp - 0x40]
test rbx, rbx
mov r8b, byte [rsp + 0x50]
mov rdx, qword [rbp + 0x20]
cmovne rcx, rbx
call fcn.1800e19e4
mov rcx, qword [rbp - 0x40]
test al, al
je 0x1800c1917
call sym.ntdll.dll_NtClose
mov eax, 1
add dword [rsp + 0x60], eax
test rdi, rdi
jne 0x1800c176d
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.18002e46c
xor ecx, ecx
mov dword [rsp + 0x78], eax
mov ebx, eax
test eax, eax
js 0x180078ab5
mov rdi, qword [rbp + 0x28]
mov eax, r15d
and eax, 0x80
mov dword [rbp - 0x38], eax
mov r14, qword [rdi]
je 0x1800c18d6
test r14, r14
je 0x1800c1926
mov dword [rsp + 0x60], ecx
mov rcx, qword [rbp - 0x80]
lea r8, [rsp + 0x60]
mov edx, 0x14
call sym.ntdll.dll_RtlFindAceByType
mov rbx, rax
test rax, rax
je 0x1800c18c8
test dword [rax + 4], 0xff000000
jne 0x1800c192d
lea rdx, [rax + 8]
mov rcx, r14
lea r9, [rsp + 0x78]
call fcn.180002c80
test al, al
je 0x1800c1926
mov eax, 1
add dword [rsp + 0x60], eax
test rbx, rbx
jne 0x1800c188f
mov eax, r15d
and eax, 0x100
mov dword [rsp + 0x78], eax
je 0x1800c1945
mov rcx, qword [rbp - 0x80]
mov rdx, r14
call fcn.18002ec40
mov ebx, eax
test eax, eax
js 0x1800c1932
test byte [rbp + 0x110], 2
jne 0x1800c1945
mov rdx, r14
mov r14, qword [rsp + 0x70]
mov rcx, r14
call fcn.18002ec40
mov ebx, eax
test eax, eax
jns 0x1800c194a
jmp 0x1800c1932
call sym.ntdll.dll_NtClose
mov ebx, 0xc0000446
jmp 0x180078ab5
mov ebx, 0xc0000022
jmp 0x1800c1932
mov ebx, 0xc0000446
mov r8, rdi
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
nop
jmp 0x180078ab5
mov r14, qword [rsp + 0x70]
mov r8, rdi
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
mov edi, dword [rbp + 0x110]
mov r8d, 2
and edi, r8d
mov r9d, 0xa00
test r15b, 8
je 0x1800c1a6d
movzx edx, word [r12 + 2]
test edi, edi
je 0x1800c1a42
mov rax, qword [rbp - 0x60]
mov r9d, edx
shr r9d, 1
and r9d, 0x18
mov rax, qword [rax]
movzx ecx, word [rax + 2]
mov eax, 0x2800
and edx, eax
or r9d, edx
mov edx, ecx
and ecx, eax
shr edx, 1
and edx, 0x18
shr r9d, 1
or edx, ecx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
mov rcx, r14
lea rax, [rsp + 0x68]
shr edx, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x120]
mov dword [rsp + 0x38], r8d
mov r8, qword [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.1800e0408
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1800c1a34
mov eax, dword [rsp + 0x5c]
lea r8d, [r10 + 2]
mov rcx, qword [rsp + 0x68]
mov esi, eax
and esi, 8
mov byte [rsp + 0x54], 1
or esi, 0x2004
mov qword [rsp + 0x68], rcx
add esi, esi
and eax, 0x1400
or esi, eax
mov r9d, 0xa00
add esi, esi
jmp 0x1800c1a72
mov r14, qword [rsp + 0x68]
mov rdi, qword [rbp - 0x30]
jmp 0x180078a61
mov rcx, qword [rbp - 0x80]
mov eax, edx
and eax, 0x2000
mov qword [rsp + 0x68], rcx
or eax, esi
and dx, r9w
mov esi, eax
or esi, 0x10
cmp dx, r9w
jne 0x1800c1a72
mov esi, eax
or esi, 0x810
jmp 0x1800c1a72
mov qword [rsp + 0x68], r14
xor r10d, r10d
test r15b, 0x20
je 0x1800c1b70
movzx edx, word [r12 + 2]
test edi, edi
je 0x1800c1b45
mov rax, qword [rbp - 0x60]
mov r9d, edx
shr r9d, 1
and r9d, 0x18
mov rax, qword [rax]
movzx ecx, word [rax + 2]
mov eax, 0x800
and edx, eax
or r9d, edx
mov edx, ecx
and ecx, eax
shr edx, 1
and edx, 0x18
shr r9d, 1
or edx, ecx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
mov rcx, r14
lea rax, [rbp - 0x30]
shr edx, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x120]
mov dword [rsp + 0x38], r8d
mov r8, qword [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.1800e0408
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1800c1b30
mov eax, dword [rsp + 0x5c]
mov ecx, eax
and ecx, 8
mov byte [rsp + 0x55], 1
or ecx, 4
and eax, 0x1400
add ecx, ecx
or ecx, eax
mov rax, qword [rbp - 0x30]
add ecx, ecx
mov qword [rsp + 0x70], rax
or esi, ecx
jmp 0x1800c1b75
mov rdi, qword [rbp - 0x30]
jmp 0x1800c1b3b
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
jmp 0x180078a61
mov r8, qword [rbp - 0x80]
mov eax, edx
and eax, 0x2000
mov qword [rsp + 0x70], r8
or eax, esi
and dx, r9w
mov esi, eax
or esi, 0x10
cmp dx, r9w
jne 0x1800c1b79
mov esi, eax
or esi, 0x810
jmp 0x1800c1b79
mov qword [rsp + 0x70], r14
mov r8, qword [rbp - 0x80]
test r15b, 0x40
je 0x1800c1c57
movzx edx, word [r12 + 2]
test edi, edi
je 0x1800c1c2e
mov rax, qword [rbp - 0x60]
mov r9d, edx
shr r9d, 1
and r9d, 0x18
mov rax, qword [rax]
movzx ecx, word [rax + 2]
mov eax, 0x800
and edx, eax
or r9d, edx
mov edx, ecx
and ecx, eax
shr edx, 1
and edx, 0x18
shr r9d, 1
or edx, ecx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
mov rcx, r14
lea rax, [rbp - 0x18]
shr edx, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x120]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.1800e0408
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1800c1b36
mov eax, dword [rsp + 0x5c]
mov ecx, eax
and ecx, 8
mov byte [rsp + 0x56], 1
or ecx, 4
and eax, 0x1400
add ecx, ecx
or ecx, eax
add ecx, ecx
or esi, ecx
jmp 0x1800c1c5b
mov eax, edx
mov qword [rbp - 0x18], r8
and eax, 0x2000
mov ecx, 0xa00
or eax, esi
and dx, cx
mov esi, eax
or esi, 0x10
cmp dx, cx
jne 0x1800c1c60
mov esi, eax
or esi, 0x810
jmp 0x1800c1c60
mov qword [rbp - 0x18], r14
mov ecx, 0xa00
cmp dword [rbp - 0x38], r10d
je 0x1800c1d3d
movzx edx, word [r12 + 2]
mov r8, qword [rbp - 0x80]
test edi, edi
je 0x1800c1d19
mov rax, qword [rbp - 0x60]
mov r9d, edx
shr r9d, 1
and r9d, 0x18
mov rax, qword [rax]
movzx ecx, word [rax + 2]
mov eax, 0x800
and edx, eax
or r9d, edx
mov edx, ecx
and ecx, eax
shr edx, 1
and edx, 0x18
shr r9d, 1
or edx, ecx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
mov rcx, r14
lea rax, [rbp - 0x10]
shr edx, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x120]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.1800e0408
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1800c1b36
mov eax, dword [rsp + 0x5c]
mov ecx, eax
and ecx, 8
mov byte [rsp + 0x57], 1
or ecx, 4
and eax, 0x1400
add ecx, ecx
or ecx, eax
add ecx, ecx
or esi, ecx
jmp 0x1800c1d41
mov eax, edx
mov qword [rbp - 0x10], r8
and eax, 0x2000
and dx, cx
or eax, esi
mov esi, eax
or esi, 0x10
cmp dx, cx
jne 0x1800c1d45
mov esi, eax
or esi, 0x810
jmp 0x1800c1d45
mov qword [rbp - 0x10], r14
mov r8, qword [rbp - 0x80]
cmp dword [rsp + 0x78], r10d
je 0x1800c1e27
movzx edx, word [r12 + 2]
test edi, edi
je 0x1800c1dfb
mov rax, qword [rbp - 0x60]
mov r9d, edx
shr r9d, 1
and r9d, 0x18
mov rax, qword [rax]
movzx ecx, word [rax + 2]
mov eax, 0x800
and edx, eax
or r9d, edx
mov edx, ecx
and ecx, eax
shr edx, 1
and edx, 0x18
shr r9d, 1
or edx, ecx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
mov rcx, r14
lea rax, [rbp - 8]
shr edx, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x120]
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.1800e0408
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1800c1b36
mov eax, dword [rsp + 0x5c]
mov ecx, eax
and ecx, 8
mov byte [rsp + 0x58], 1
or ecx, 4
and eax, 0x1400
add ecx, ecx
or ecx, eax
add ecx, ecx
or esi, ecx
jmp 0x1800c1e2b
mov eax, edx
mov qword [rbp - 8], r8
and eax, 0x2000
mov r8d, 0xa00
or eax, esi
and dx, r8w
mov esi, eax
or esi, 0x10
cmp dx, r8w
jne 0x1800c1e31
mov esi, eax
or esi, 0x810
jmp 0x1800c1e31
mov qword [rbp - 8], r14
mov r8d, 0xa00
cmp dword [rbp - 0x48], r10d
je 0x1800c1e5f
movzx ecx, word [r12 + 2]
mov eax, ecx
and cx, r8w
and eax, 0x2000
or eax, esi
mov esi, eax
or esi, 0x10
cmp cx, r8w
jne 0x1800c1e63
mov esi, eax
or esi, 0x810
jmp 0x1800c1e63
mov qword [rbp - 0x80], r14
mov rdi, qword [rsp + 0x70]
lea rax, [rbp + 8]
mov r14, qword [rsp + 0x68]
mov r8, rdi
mov r9, qword [rbp - 0x18]
mov rcx, r14
mov rdx, qword [rbp - 0x80]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.18002e668
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180078a61
mov rcx, qword [rbp + 8]
mov qword [rbp - 0x50], rcx
cmp r14, r10
jne 0x1800c1eda
test rcx, rcx
je 0x1800c1eda
cmp word [rcx + 4], r10w
jne 0x1800c1eda
mov r8, rcx
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
mov qword [rbp - 0x50], r10
mov r14d, 1
mov byte [rsp + 0x59], r14b
lea edx, [r14 + 3]
jmp 0x1800787d4
test ax, ax
je 0x1800c1f09
test cx, cx
jns 0x1800c1f0e
cmp dword [r12 + 0x10], r10d
je 0x1800c1f09
mov r8d, dword [r12 + 0x10]
add r8, r12
jmp 0x1800c1f13
mov r8, r10
jmp 0x1800c1f13
mov r8, qword [r12 + 0x20]
mov rax, qword [rbp - 0x60]
mov r12d, 4
movzx r9d, cx
mov rax, qword [rax]
movzx edx, word [rax + 2]
test r12b, dl
je 0x1800c1f40
test dx, dx
jns 0x1800c1f45
cmp dword [rax + 0x10], r10d
je 0x1800c1f40
mov ecx, dword [rax + 0x10]
add rcx, rax
jmp 0x1800c1f49
mov rcx, r10
jmp 0x1800c1f49
mov rcx, qword [rax + 0x20]
lea rax, [rsp + 0x5c]
and r9d, r11d
mov qword [rsp + 0x48], rax
and edx, r11d
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x120]
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.1800e0408
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1800c1b3b
mov eax, dword [rsp + 0x5c]
and eax, 0x1408
mov byte [rsp + 0x53], r14b
mov r14, qword [rbp + 0x10]
or eax, r12d
or esi, eax
jmp 0x180078837
mov esi, eax
or esi, 0x404
jmp 0x180078837
mov edx, dword [0x18015c294]
mov r8d, 0x4c
add edx, 0x140000
mov dword [rbp - 0x28], r8d
mov rcx, r13
call sym.ntdll.dll_RtlAllocateHeap
xor r10d, r10d
mov rdi, rax
test rax, rax
je 0x1800c2040
lea r8, [rbp - 0x40]
or rcx, 0xffffffffffffffff
lea edx, [r10 + 8]
call sym.ntdll.dll_NtOpenProcessToken
mov ebx, eax
mov r8, rdi
test eax, eax
js 0x1800c202e
mov r9d, dword [rbp - 0x28]
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x40]
mov edx, r12d
mov qword [rsp + 0x20], rax
call sym.ntdll.dll_NtQueryInformationToken
mov rcx, qword [rbp - 0x40]
mov ebx, eax
call sym.ntdll.dll_NtClose
test ebx, ebx
jns 0x1800c204a
mov r8, rdi
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078a4c
mov ebx, 0xc0000017
jmp 0x180078a4c
mov r8, qword [rdi]
lea rax, [rsp + 0x5a]
mov dl, byte [rbp - 0x77]
lea r9, [rbp + 0x18]
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1800e15f0
mov r8, rdi
xor edx, edx
mov rcx, r13
mov ebx, eax
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
test ebx, ebx
js 0x180078a4c
mov r14, qword [rbp + 0x18]
jmp 0x180078842
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
test byte [rax + 2], dl
je 0x1800c20ae
cmp word [rax + 2], r10w
jge 0x1800c20b6
cmp dword [rax + 0x10], r10d
je 0x1800c20ae
mov r14d, dword [rax + 0x10]
add r14, rax
jmp 0x180078842
mov r14, r10
jmp 0x180078842
mov r14, qword [rax + 0x20]
jmp 0x180078842
mov ebx, r10d
jmp 0x180078883
mov r12d, r10d
jmp 0x180078898
mov eax, 0x800
or esi, eax
jmp 0x1800788e9
mov al, byte [rax + 1]
or cx, dx
mov byte [rdi + 1], al
mov word [rdi + 2], cx
jmp 0x18007890a
mov dword [rdi + 0xc], r10d
jmp 0x18007895a
mov r8d, ebx
lea rax, [rdi + 0x14]
sub r8d, ecx
xor edx, edx
add rcx, rax
call sym.ntdll.dll_memset
nop
jmp 0x18007894d
mov dword [rdi + 0x10], r10d
jmp 0x1800789be
mov r8d, r12d
xor edx, edx
sub r8d, ecx
add rcx, r15
call sym.ntdll.dll_memset
nop
jmp 0x1800789b5
mov rax, qword [rsi]
movzx ecx, word [rax + 2]
mov eax, 0x140c
and cx, ax
or word [rdi + 2], cx
cmp byte [rbp - 0x24], r10b
je 0x1800789d5
and dword [rbp - 0x58], 0
lea rdx, [rbp - 0x58]
mov r8b, r12b
mov word [rbp - 0x54], 0x300
lea rcx, [rbp + 0x70]
call sym.ntdll.dll_RtlInitializeSid
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x180078a4c
mov dword [rbp + 0x78], r14d
mov dword [rsp + 0x60], r10d
test byte [rdi + 2], r14b
je 0x1800c2197
cmp word [rdi + 2], r10w
jge 0x1800c219c
cmp dword [rdi + 0x10], r10d
je 0x1800c2197
mov ecx, dword [rdi + 0x10]
add rcx, rdi
jmp 0x1800c21a0
mov rcx, r10
jmp 0x1800c21a0
mov rcx, qword [rdi + 0x20]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x70]
call fcn.1800e2ad8
xor r10d, r10d
test rax, rax
je 0x1800789d5
mov cl, byte [rax + 1]
and cl, 0xfc
or cl, 8
add dword [rsp + 0x60], r12d
mov byte [rax + 1], cl
jmp 0x1800c217c
mov rdi, qword [rbp - 0x30]
mov ebx, 0xc000005b
jmp 0x180078a51
mov r8, qword [rbp + 0x10]
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078a61
cmp byte [rsp + 0x54], r10b
je 0x180078a6a
mov r8, r14
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078a6a
cmp byte [rsp + 0x55], r10b
je 0x180078a73
mov r8, rdi
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078a73
cmp byte [rsp + 0x56], r10b
je 0x180078a80
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078a80
cmp byte [rsp + 0x57], r10b
je 0x180078a8d
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078a8d
cmp byte [rsp + 0x58], r10b
je 0x180078a9a
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078a9a
mov r8, rax
xor edx, edx
mov rcx, r13
call sym.ntdll.dll_RtlFreeHeap
xor r10d, r10d
jmp 0x180078aae