Function at 0x140001970
Capabilities:
Acquire debug privileges
Check mutex on windows
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140035840]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor edi, edi
test eax, eax
je 0x140001a26
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x20]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140001a1b
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x38], 1
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001a2c
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001a26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.C:Program_Files__x86_XM2we_Configuration_Software_
call fcn.14000c9b0
lea rcx, str.taskkill__f__im_Config.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_Config_x64.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_crossfire.exe
call fcn.14000c23c
lea rcx, [0x14002f3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14002f440]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x14002f528]
lea rcx, [0x14002f530]
call fcn.14000c00c
mov rbx, rax
test rax, rax
je 0x140001ab3
mov r9, rax
lea rcx, [0x1408816a0]
mov edx, 1
mov r8d, 0x21be00
call fcn.14000c6f4
mov rcx, rbx
call fcn.14000c1a4
mov dword [rsp + 0x28], 0xa
lea r8, str.C:Program_Files__x86_XM2we_Configuration_SoftwareOemDrv_x64.exe
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r8, str.GlobalEndgame
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001dc1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [0x140a9f2a0]
mov qword [rsp + 0x20], rdi
mov rcx, rax
lea r8, [0x1400254a0]
mov edx, 0x800
call qword [sym.imp.DINPUT8.dll_DirectInput8Create]
mov rcx, qword [0x140a9f2a0]
lea r8, [0x140a9f2a8]
xor r9d, r9d
lea rdx, [0x1400254c0]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [0x140a9f2a8]
lea rdx, [0x140025480]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [0x140a9f2a8]
xor edx, edx
mov rax, qword [rcx]
lea r8d, [rdx + 0xa]
call qword [rax + 0x68]
mov rcx, qword [0x140a9f2a8]
mov rax, qword [rcx]
call qword [rax + 0x38]
nop dword [rax]
mov rcx, qword [0x140a9f2a8]
test rcx, rcx
je 0x140001d67
mov rax, qword [rcx]
lea r8, [0x140a9f1a0]
mov edx, 0x100
call qword [rax + 0x48]
test eax, eax
jne 0x140001d67
movzx eax, byte [0x140a9f1ca]
test al, al
jns 0x140001d67
test byte [0x140a9f1bd], 0x80
je 0x140001c7b
test byte [0x140a9f1cc], 0x80
je 0x140001c7b
lea rcx, str.taskkill__f__im_Config.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_Config_x64.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_crossfire.exe
call fcn.14000c23c
lea rcx, [0x14002f3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14002f440]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x14002f528]
lea rcx, str.C:Program_Files__x86_XM2we_Configuration_SoftwareConfig.exe
call fcn.14000c00c
mov rbx, rax
test rax, rax
je 0x140001c4e
mov r9, rax
lea rcx, [0x140036480]
mov edx, 1
mov r8d, 0x439210
call fcn.14000c6f4
mov rcx, rbx
call fcn.14000c1a4
mov dword [rsp + 0x28], 0xa
lea r8, [0x14002f3c0]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx eax, byte [0x140a9f1ca]
test al, al
jns 0x140001d67
test byte [0x140a9f1bd], 0x80
je 0x140001d51
test byte [0x140a9f1cd], 0x80
je 0x140001d51
lea rdx, str.START_1.90__n
call fcn.140001ed0
lea rcx, str.taskkill__f__im_Config.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_Config_x64.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_crossfire.exe
call fcn.14000c23c
lea rcx, [0x14002f3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14002f440]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x14002f528]
lea rcx, str.C:Program_Files__x86_XM2we_Configuration_SoftwareConfig_x64.exe
call fcn.14000c00c
mov rbx, rax
test rax, rax
je 0x140001d24
mov r9, rax
lea rcx, [0x14046f690]
mov edx, 1
mov r8d, 0x412010
call fcn.14000c6f4
mov rcx, rbx
call fcn.14000c1a4
mov dword [rsp + 0x28], 0xa
lea r8, [0x14002f440]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx eax, byte [0x140a9f1ca]
test al, al
jns 0x140001d67
test byte [0x140a9f1bd], 0x80
je 0x140001d67
test byte [0x140a9f1af], 0x80
jne 0x140001d77
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001b80
lea rdx, str.EXIT__n
call fcn.140001ed0
lea rcx, str.taskkill__f__im_Config.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_Config_x64.exe
call fcn.14000c23c
lea rcx, str.taskkill__f__im_crossfire.exe
call fcn.14000c23c
lea rcx, [0x14002f3c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14002f440]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005640
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret