Function at 0x7ff74af8470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rax, [0x7ff74b48980]
jmp 0x7ff74af856d
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x258
movaps xmmword [r11 - 0x58], xmm6
mov rax, qword [0x7ff74b58340]
xor rax, rsp
mov qword [rsp + 0x230], rax
movdqu xmm6, xmmword [0x7ff74b497c8]
mov rax, qword [rsp + 0x2d8]
xor r14d, r14d
mov rdi, rdx
mov qword [rsp + 0xc0], rdx
mov rdx, qword [rsp + 0x2e8]
movaps xmmword [rsp + 0x190], xmm6
mov r13, r8
mov r8, qword [rsp + 0x2f0]
mov dword [rsp + 0x88], r9d
lea r9d, [r14 + 1]
mov qword [rdx], r14
mov rbp, rcx
mov dword [r8], r14d
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xd0], r8
mov dword [rsp + 0x64], r9d
mov qword [r11 - 0x218], r14
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x78], r14d
mov qword [r11 - 0x208], r14
mov dword [rsp + 0x7c], r14d
cmp rdi, r14
je 0x7ff74b203dc
mov rsi, r14
mov qword [rsp + 0x70], r14
mov r12, r14
mov qword [rsp + 0xb8], r14
mov dword [rsp + 0x100], 0x68
mov qword [rsp + 0x108], r14
cmp dword [rsp + 0x2c0], r14d
jne 0x7ff74af669a
cmp dword [rsp + 0x2d0], r14d
jne 0x7ff74af669a
cmp byte [rcx + 0x24], 3
mov qword [rsp + 0x110], rax
je 0x7ff74b203e6
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x118], rax
mov eax, 0x28
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x128], 0x50
mov dword [rsp + 0x13c], r14d
mov word [rsp + 0x140], r9w
mov word [rsp + 0x142], r14w
mov dword [rsp + 0x120], eax
mov dword [rsp + 0x124], eax
mov dword [rsp + 0x12c], eax
mov qword [rsp + 0x148], r14
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0x98], r14
mov dword [rsp + 0xa8], r14d
call fcn.7ff74af7ed0
mov ebx, eax
cmp eax, r14d
jne 0x7ff74af88d2
mov rax, qword [rbp + 0x10]
mov r15d, 0x10
cmp rax, r14
je 0x7ff74b0ac68
mov ecx, dword [rax + 0x3c]
jmp 0x7ff74af861a
test cl, 2
jne 0x7ff74af9bbf
lea rax, [rdi + 0x58]
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x90]
lea r14, [0x7ff74b497c8]
mov qword [rsp + 0x1a8], rax
cmp dword [0x7ff74b593c4], esi
je 0x7ff74af8668
cmp qword [rbp + 0x50], rsi
jne 0x7ff74b2040f
mov rdi, qword [rdi + 0x30]
and dword [rsp + 0x64], esi
mov eax, 1
mov qword [rsp + 0x68], rdi
cmp dword [rbp + 0x48], esi
jne 0x7ff74b20457
test byte [rsp + 0x2c8], al
jne 0x7ff74b20457
test r13, r13
je 0x7ff74af86b6
mov rsi, r13
mov qword [rsp + 0x70], r13
cmp byte [rbp + 0x24], al
je 0x7ff74afde6f
xor ebx, ebx
jmp 0x7ff74af86aa
mov eax, 0x410
test rsi, rsi
cmovne r15d, eax
mov rcx, rdi
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x7ff74b2049e
mov r12d, dword [rsp + 0x7c]
mov ecx, 0x1fffff
mov dword [rsp + 0x28], 0x100000
mov eax, r12d
mov dword [rsp + 0x20], 0x100001
neg eax
mov eax, r12d
sbb r9d, r9d
not r9d
and r9d, ecx
neg eax
mov eax, r12d
sbb r8d, r8d
and r8d, ecx
neg eax
lea rcx, [rsp + 0x1a0]
sbb edx, edx
and edx, 3
call fcn.7ff74af7c00
xor r13d, r13d
cmp rax, r13
je 0x7ff74b20527
mov dword [rsp + 0xe0], 0x18
mov qword [rsp + 0xe8], rax
mov dword [rsp + 0xf0], r13d
mov qword [rsp + 0xb0], r13
cmp rdi, r13
je 0x7ff74b20546
mov r8d, r12d
mov r12, qword [rsp + 0xc0]
lea r9, [rsp + 0xb0]
lea rdx, [r12 + 0x58]
mov rcx, rdi
call fcn.7ff74af8904
cmp eax, r13d
je 0x7ff74af87e4
cmp dword [rsp + 0x64], r13d
jne 0x7ff74b20537
mov rdi, qword [rsp + 0xb0]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rbp + 0x40]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0xe0]
mov rcx, rdi
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x64], 1
mov qword [rsp + 0x20], r13
call qword [0x7ff74b58028]
mov dword [rsp + 0x60], eax
jmp 0x7ff74af87e4
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_RevertToSelf]
mov r13d, dword [rsp + 0x60]
test r13d, r13d
je 0x7ff74b20553
mov rdx, qword [r14]
lea rcx, [rsp + 0x190]
cmp rdx, qword [rcx]
jne 0x7ff74b20585
mov rdx, qword [r14 + 8]
cmp rdx, qword [rcx + 8]
jne 0x7ff74b20585
xor eax, eax
jmp 0x7ff74af881e
test eax, eax
jne 0x7ff74b2058f
mov rax, qword [rsp + 0x90]
test rax, rax
jne 0x7ff74af9d14
cmp dword [rsp + 0x78], 0
jne 0x7ff74b0ac70
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x7ff74af8855
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x7ff74af886b
test r13d, r13d
je 0x7ff74b204e6
test rdi, rdi
je 0x7ff74af8888
cmp dword [rsp + 0x64], 0
je 0x7ff74af8888
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x80]
xor edx, edx
mov qword [rcx], rax
mov rcx, qword [rsp + 0xd0]
mov eax, dword [rsp + 0xa8]
mov dword [rcx], eax
mov rcx, qword [0x7ff74b584e0]
call qword [case.0x7ff74b3e5fd.0]
test ebx, ebx
js 0x7ff74b204fe
lea rcx, [rsp + 0x1a0]
call fcn.7ff74af7fb0
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.7ff74ae3090
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rdi + 0x30]
lea rdx, [rsp + 0x90]
call fcn.7ff74af9bf0
cmp eax, r14d
mov ebx, eax
jl 0x7ff74b203f3
mov dword [rsp + 0x7c], 1
jmp 0x7ff74af8623
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x7ff74af8837
mov r8d, dword [rsp + 0x88]
lea r9, [rsp + 0x70]
mov rdx, r13
mov rcx, rbp
call fcn.7ff74afdeb4
mov rsi, qword [rsp + 0x70]
mov ebx, eax
test eax, eax
jne 0x7ff74b2044f
cmp r13, rsi
je 0x7ff74af86aa
mov dword [rsp + 0x78], 1
jmp 0x7ff74af86aa
mov ecx, r14d
jmp 0x7ff74af861a
mov rcx, qword [0x7ff74b584e0]
mov r8, rsi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
nop
jmp 0x7ff74af8842
mov eax, 0x80070005
jmp 0x7ff74af88d2
mov qword [rsp + 0x118], r14
jmp 0x7ff74af858b
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
jmp 0x7ff74af88d0
lea r8, [rsp + 0x68]
mov rdx, rdi
mov rcx, rbp
call fcn.7ff74b3b524
mov rdi, qword [rsp + 0x68]
mov ebx, eax
test eax, eax
js 0x7ff74b20447
mov eax, 1
cmp ebx, eax
jne 0x7ff74b2043e
and dword [rsp + 0x64], esi
xor ebx, ebx
jmp 0x7ff74af867a
mov dword [rsp + 0x64], eax
jmp 0x7ff74af867a
mov r13d, esi
jmp 0x7ff74af8826
mov r13d, r12d
jmp 0x7ff74af8826
test rdi, rdi
je 0x7ff74b20488
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x190]
mov rcx, rdi
call fcn.7ff74b3fb4c
mov r12, qword [rsp + 0xb8]
movaps xmm6, xmmword [rsp + 0x190]
mov ebx, eax
jmp 0x7ff74b2048d
mov ebx, 0x80070057
test ebx, ebx
js 0x7ff74b20447
mov rsi, r12
mov qword [rsp + 0x70], r12
jmp 0x7ff74af86aa
mov ebx, 0x80070005
cmp dword [0x7ff74b582c8], eax
je 0x7ff74b204dc
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b204dc
test byte [rcx + 0x1c], 1
je 0x7ff74b204dc
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51720]
mov edx, 0xb
mov r9d, ebx
call fcn.7ff74b25ec4
mov r13d, dword [rsp + 0x60]
jmp 0x7ff74af8826
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0x98], rax
jmp 0x7ff74af886b
mov rcx, qword [r14]
lea rax, [rsp + 0x190]
cmp rcx, qword [rax]
jne 0x7ff74b20600
mov rcx, qword [r14 + 8]
cmp rcx, qword [rax + 8]
jne 0x7ff74b20600
xor eax, eax
jmp 0x7ff74b20605
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_RevertToSelf]
mov ebx, 0x8007000e
jmp 0x7ff74af8826
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x7ff74af8779
mov r12, qword [rsp + 0xc0]
jmp 0x7ff74af87e4
call sub.KERNEL32.dll_GetLastError
mov r9, qword [rsp + 0x80]
mov edx, dword [rsp + 0x2e0]
movzx ebx, ax
mov r8, r12
mov rcx, rbp
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
call fcn.7ff74b3d924
jmp 0x7ff74af8826
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x7ff74af881e
mov rdx, qword [rsp + 0x98]
lea r8, [rsp + 0xc0]
lea rcx, [0x7ff74b586c0]
movdqa xmmword [rsp + 0xc0], xmm6
call fcn.7ff74b40020
test eax, eax
jns 0x7ff74af8826
lea rdx, [rsp + 0x170]
lea rcx, [0x7ff74b586c0]
movdqa xmmword [rsp + 0x170], xmm6
call fcn.7ff74b3ff6c
lock add dword [0x7ff74b5a038], 1
movdqu xmm6, xmmword [0x7ff74b497c8]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
movaps xmmword [rsp + 0x190], xmm6
jmp 0x7ff74af8826
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x7ff74af88c3
lea rdx, [rsp + 0x180]
lea rcx, [0x7ff74b586c0]
movdqa xmmword [rsp + 0x180], xmm6
call fcn.7ff74b3ff6c
nop
jmp 0x7ff74af88c3