Function at 0x1400aeea0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
and dword [rbp - 0x11], 0
mov rdi, rcx
mov esi, 0x2d
mov dword [rbp - 0x15], Ordinal_36
lea rcx, str.hid________eeRM2A0Qq1YX
mov dword [rbp - 0x19], esi
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
and dword [rbp - 1], 0
lea rcx, str.hid________gNKU199CAVJ6
mov dword [rbp - 9], esi
mov dword [rbp - 5], Ordinal_36
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rax, [rbp + 0x77]
mov rcx, rdi
lea r9d, [rsi + 0xb]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 7]
lea edx, [rsi - 0x23]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400af241
mov r8d, dword [rbp + 0xf]
lea rcx, str._x__08x
mov edx, dword [rbp + 0x13]
call fcn.14000b314
lea rax, [rbp + 0x77]
mov rcx, rdi
lea r9d, [rsi - 0x29]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x7f]
lea edx, [rsi - 0x21]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400aef5e
mov edx, dword [rbp + 0x7f]
lea rcx, [0x14010ea48]
call fcn.14000b314
jmp 0x1400aef67
lea rcx, [rbp - 0x19]
call fcn.14000b314
mov r9d, 4
lea rax, [rbp + 0x77]
lea r8, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 + 0xe]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400aefc0
mov eax, dword [rbp - 0x39]
mov edx, 0x3f
cmp eax, 3
lea ecx, [rdx + 0xd]
cmove edx, ecx
cmp eax, 2
mov ecx, Ordinal_73
cmove edx, ecx
cmp eax, 1
mov ecx, Ordinal_69
cmove edx, ecx
lea rcx, [0x14011ac90]
call fcn.14000b314
jmp 0x1400aefc9
lea rcx, [rbp - 9]
call fcn.14000b314
mov edx, dword [rbp + 7]
lea rcx, str.__10u_t
call fcn.14000b314
lea r9, [rbp - 0x21]
mov rcx, rdi
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x31]
call fcn.1400124f8
test eax, eax
je 0x1400af026
mov r9, qword [rbp - 0x21]
lea rcx, str._s_s_t_s
mov r8, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x29]
call fcn.14000b314
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movsxd r9, dword [rbp + 0x1f]
lea rsi, [0x140000000]
mov r8d, dword [rbp + 0x33]
lea rcx, str._t__02ug__02up__t_s
mov edx, dword [rbp + 0x2f]
mov r9, qword [rsi + r9*8 + 0xfa2c8]
call fcn.14000b314
cmp dword [rbp + 0x1f], 2
jne 0x1400af06a
movsxd rdx, dword [rbp + 0x23]
lea rcx, [0x140101888]
mov rdx, qword [rsi + rdx*8 + 0xfa428]
call fcn.14000b314
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
test ebx, ebx
je 0x1400af241
xor r9d, r9d
lea rax, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea esi, [r9 + 0xd]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400af241
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400af241
mov edx, dword [rbp + 0x77]
lea ecx, [rsi + 0x33]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400af241
mov r9d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400af238
mov r8, qword [rbx + 8]
mov cl, 0x47
mov edx, dword [rbx]
add r8, 0x10
dec edx
call fcn.1400aed30
mov r8, qword [rbx + 0x18]
mov cl, 0x52
mov edx, dword [rbx + 0x10]
call fcn.1400aed30
and dword [rbp + 0x7f], 0
cmp dword [rbx + 0x20], 0
jbe 0x1400af238
xor eax, eax
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x28]
mov edx, dword [rax + rcx*4 + 8]
mov ecx, edx
mov eax, edx
sar ecx, 0x1f
and ecx, 0x21
and al, 4
add ecx, 0x20
neg al
mov dword [rsp + 0x20], ecx
mov eax, edx
lea rcx, str.___P:__c_c_c_c_
sbb r9d, r9d
and al, 2
and r9d, 0x32
add r9d, 0x20
neg al
sbb r8d, r8d
and dl, 1
and r8d, 0x25
add r8d, 0x20
neg dl
sbb edx, edx
and edx, 0x24
add edx, 0x20
call fcn.14000b314
mov eax, dword [rbp + 0x7f]
lea r9, [rbp + 0x77]
and dword [rbp + 0x77], 0
xor r8d, r8d
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x28]
lea rdx, [rax + rcx*4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
jne 0x1400af1fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400af1fb
mov edx, dword [rbp + 0x77]
lea ecx, [rax - 0x3a]
inc edx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400af227
mov ecx, dword [rbp + 0x7f]
lea r9, [rbp + 0x77]
mov r8, rax
lea rdx, [rcx + rcx*2]
mov rcx, qword [rbx + 0x28]
lea rdx, [rcx + rdx*4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
je 0x1400af1f0
mov rdx, rdi
lea rcx, [0x1401096d8]
call fcn.14000b314
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400af227
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x521
jne 0x1400af227
mov eax, dword [rbp + 0x7f]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x28]
mov r8d, dword [rax + rcx*4]
mov edx, dword [rax + rcx*4 + 4]
lea rcx, str._x___08x_n
call fcn.14000b314
mov eax, dword [rbp + 0x7f]
inc eax
mov dword [rbp + 0x7f], eax
cmp eax, dword [rbx + 0x20]
jb 0x1400af11f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret