Function at 0x1400058c0
Capabilities:
Acquire debug privileges
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xb70]
sub rsp, 0xc70
mov rax, qword [0x140056fb0]
xor rax, rsp
mov qword [rbp + 0xb60], rax
mov rsi, rdx
mov dword [rsp + 0x20], ecx
mov r8, rdx
lea rdx, [rsp + 0x20]
lea rcx, str.AccessChk
xor edi, edi
mov ebx, edi
xor r14b, r14b
call fcn.140002160
lea rdx, [rsp + 0x20]
lea rcx, str.AccessChk
mov r8, rsi
call fcn.1400019c0
test eax, eax
jne 0x140005930
mov eax, 1
jmp 0x140005e19
mov ecx, dword [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rdx, rsi
call fcn.1400032f0
test al, al
je 0x140005926
lea rcx, str.Ntmarta.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.winspool.drv
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.dsrole.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.samlib.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140003b60
call fcn.140002880
call fcn.140004070
lea rcx, str.SeDebugPrivilege
call fcn.140002aa0
lea rcx, str.SeBackupPrivilege
call fcn.140002aa0
lea rcx, str.SeSecurityPrivilege
call fcn.140002aa0
mov r15d, 1
test eax, eax
je 0x1400059cd
movzx eax, byte [0x140058b2b]
cmp byte [0x140058b29], bl
cmovne eax, r15d
mov byte [0x140058b2b], al
lea rcx, [0x140058b40]
mov qword [rsp + 0xcb0], r12
call fcn.140002e80
lea rcx, str.OWNER_RIGHTS
call fcn.140003cd0
cmp byte [0x140058aca], bl
mov qword [0x140058b00], rax
je 0x140005b7a
mov rcx, rdi
movzx eax, word [rsp + rcx + 0x30]
lea rcx, [rcx + 2]
mov word [rbp + rcx + 0x33e], ax
test ax, ax
jne 0x140005a03
lea r12, str.HKLM
mov r14d, edi
or rbx, 0xffffffffffffffff
mov rsi, r12
nop word [rax + rax]
mov rcx, qword [rsi + 8]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], di
jne 0x140005a40
lea rdx, [rsp + 0x30]
call fcn.14000ca6c
test eax, eax
je 0x140005a9c
mov rcx, qword [rsi]
mov r8, rbx
nop
inc r8
cmp word [rcx + r8*2], di
jne 0x140005a60
lea rdx, [rsp + 0x30]
call fcn.14000ca6c
test eax, eax
je 0x140005a9c
inc r14d
add rsi, 0x20
movsxd rax, r14d
cmp rax, 4
jb 0x140005a30
lea rcx, str.Invalid_registry_path._n_n
call fcn.14000adf8
mov eax, r15d
jmp 0x140005e11
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.14000c904
lea rcx, [rsp + 0x30]
test rax, rax
je 0x140005ac5
mov edx, 0x5c
call fcn.14000c904
lea rsi, [rax + 2]
jmp 0x140005acf
xor edx, edx
call fcn.14000c904
mov rsi, rax
movsxd r8, r14d
lea rdx, str._s_s
lea rcx, [rbp + 0x340]
shl r8, 5
mov r9, rsi
mov r14, qword [r8 + r12 + 0x18]
mov r8, qword [r8 + r12]
call fcn.14000aecc
test rsi, rsi
jne 0x140005b0e
lea rcx, str.Invalid_registry_path._n_n
call fcn.14000adf8
mov eax, r15d
jmp 0x140005e11
mov rcx, rsi
call fcn.140005590
lea rcx, [rbp + 0x340]
mov rax, rbx
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x140005b20
cmp word [rbp + rax*2 + 0x33e], 0x22
jne 0x140005b3e
mov word [rbp + rax*2 + 0x33e], di
lea rax, [rbp + 0x340]
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x140005b45
cmp word [rbp + rbx*2 + 0x33e], 0x5c
jne 0x140005b63
mov word [rbp + rbx*2 + 0x33e], di
lea rdx, [rbp + 0x340]
mov r8, rsi
mov rcx, r14
call fcn.140007d20
jmp 0x140005dfa
cmp byte [0x140058acd], bl
je 0x140005c45
cmp word [rsp + 0x30], bx
jne 0x140005bc4
lea rcx, [0x1400260e0]
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdi + rcx]
lea rdi, [rdi + 2]
mov word [rsp + rdi + 0x2e], ax
test ax, ax
jne 0x140005ba0
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140006730
jmp 0x140005dfa
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.14000c904
test rax, rax
je 0x140005c33
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.14000c9bc
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x140005c33
cmp byte [0x140058b11], bl
jne 0x140005c33
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.14000c9bc
cmp word [rax + 2], bx
je 0x140005c21
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.14000c9bc
lea rbx, [rax + 2]
lea rcx, [rsp + 0x30]
mov edx, 0x5c
call fcn.14000c9bc
mov word [rax], di
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140006730
jmp 0x140005dfa
cmp byte [0x140058af0], bl
je 0x140005c5c
lea rcx, [rsp + 0x30]
call fcn.140009c80
jmp 0x140005dfa
cmp byte [0x140058acc], bl
je 0x140005c73
lea rcx, [rsp + 0x30]
call fcn.140005e50
jmp 0x140005dfa
cmp byte [0x140058ace], bl
je 0x140005c91
movzx edx, byte [0x140058acf]
lea rcx, [rsp + 0x30]
call fcn.140008080
jmp 0x140005dfa
cmp byte [0x140058acb], bl
je 0x140005ca8
lea rcx, [rsp + 0x30]
call fcn.1400070c0
jmp 0x140005dfa
cmp byte [0x140058af1], bl
je 0x140005cbf
lea rcx, [rsp + 0x30]
call fcn.14000a0f0
jmp 0x140005dfa
cmp word [rsp + 0x30], bx
je 0x140005dd1
mov rcx, rdi
nop dword [rax]
movzx eax, word [rsp + rcx + 0x30]
lea rcx, [rcx + 2]
mov word [rbp + rcx + 0x33e], ax
test ax, ax
jne 0x140005cd0
lea rcx, [rbp + 0x340]
call fcn.14000ce1c
lea rdx, str.PIPE_
lea rcx, [rbp + 0x340]
mov r8d, 6
call fcn.14000c990
test eax, eax
jne 0x140005d46
mov rcx, rdi
movzx eax, word [rsp + rcx + 0x30]
lea rcx, [rcx + 2]
mov word [rbp + rcx + 0x33e], ax
test ax, ax
jne 0x140005d12
lea r8, [rsp + 0x3c]
lea rdx, str..Pipe_s
lea rcx, [rbp + 0x340]
call fcn.14000aecc
movzx r14d, r15b
jmp 0x140005d93
lea rdx, [rbp + 0x340]
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
movzx eax, word [rbp + rcx + 0x340]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x2e], ax
test ax, ax
jne 0x140005d61
lea r9, [rsp + 0x28]
lea r8, [rbp + 0x340]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rax, [rbp + 0x340]
or rbx, 0xffffffffffffffff
nop
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x140005da0
cmp word [rbp + rbx*2 + 0x33e], 0x5c
jne 0x140005de3
lea rbx, [rbx*2 - 2]
cmp rbx, 0x410
jae 0x140005e3f
mov word [rbp + rbx + 0x340], di
jmp 0x140005de3
lea rdx, [rbp + 0x340]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x750]
lea rdx, [rbp + 0x340]
movzx ecx, r14b
call fcn.1400073a0
cmp dword [0x140058b14], 0
jne 0x140005e0f
lea rcx, str.No_matching_objects_found._n_n
call fcn.14000adf8
xor eax, eax
mov r12, qword [rsp + 0xcb0]
mov rcx, qword [rbp + 0xb60]
xor rcx, rsp
call fcn.14000b260
mov rbx, qword [rsp + 0xcb8]
add rsp, 0xc70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14000c66c
int3