Function at 0x140059bb0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xdf0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x280
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe18]
mov rax, qword [0x1400a1080]
xor rax, rbp
mov qword [rbp + 0xdb0], rax
mov dword [rbp + 0xd54], 0
lea rcx, [0x1400b11be]
call fcn.14002b720
mov rax, qword [rbp + 0xde8]
add rax, 0x40
mov qword [rbp + 0xd68], rax
lea rdx, [rbp + 0x698]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0xd70], rax
mov eax, dword [rbp + 0xd54]
or eax, 1
mov dword [rbp + 0xd54], eax
lea rdx, str.uninstall
mov rcx, qword [rbp + 0xd70]
call fcn.14002a956
movzx eax, al
test eax, eax
je 0x140059c99
mov rax, qword [rbp + 0xde8]
add rax, 0xd0
mov qword [rbp + 0xd78], rax
mov rdx, qword [0x1400a2b50]
mov rcx, qword [rbp + 0xd78]
call fcn.14002b58b
movzx eax, al
test eax, eax
je 0x140059c99
mov dword [rbp + 0xd80], 1
jmp 0x140059ca3
mov dword [rbp + 0xd80], 0
movzx eax, byte [rbp + 0xd80]
mov byte [rbp + 0x674], al
mov eax, dword [rbp + 0xd54]
and eax, 1
test eax, eax
je 0x140059cd0
and dword [rbp + 0xd54], 0xfffffffe
lea rcx, [rbp + 0x698]
call fcn.14002a44c
movzx eax, byte [rbp + 0x674]
test eax, eax
je 0x14005a287
mov rax, qword [rbp + 0xde0]
cmp dword [rax], 0
je 0x14005a1ff
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x238]
call fcn.14002a79e
nop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rbp + 0x278], 0
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
lea r9, [0x140090a68]
mov r8d, 1
xor edx, edx
lea rcx, [0x140090cd8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rax, qword [rbp + 0x278]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0xd68], rax
lea rcx, [rbp + 0x708]
call fcn.14002a523
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
lea rax, [rbp + 0x6d8]
mov rdi, rax
mov rsi, qword [rbp + 0xd78]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x948]
lea rcx, [rbp + 0x6d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa08]
lea rcx, [rbp + 0x948]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa68]
lea rcx, [rbp + 0xa08]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xb28]
lea rcx, [rbp + 0xa68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x768]
call fcn.14002a523
mov qword [rbp + 0xd80], rax
mov rax, qword [rbp + 0xd80]
mov qword [rbp + 0xd88], rax
lea rax, [rbp + 0x738]
mov rdi, rax
mov rsi, qword [rbp + 0xd88]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x8e8]
lea rcx, [rbp + 0x738]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x9a8]
lea rcx, [rbp + 0x8e8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa38]
lea rcx, [rbp + 0x9a8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xaf8]
lea rcx, [rbp + 0xa38]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x7c8]
call fcn.14002a523
mov qword [rbp + 0xd90], rax
mov rax, qword [rbp + 0xd90]
mov qword [rbp + 0xd98], rax
lea rax, [rbp + 0x798]
mov rdi, rax
mov rsi, qword [rbp + 0xd98]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x888]
lea rcx, [rbp + 0x798]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x978]
lea rcx, [rbp + 0x888]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x9d8]
lea rcx, [rbp + 0x978]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xac8]
lea rcx, [rbp + 0x9d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x828]
call fcn.14002a523
mov qword [rbp + 0xda0], rax
mov rax, qword [rbp + 0xda0]
mov qword [rbp + 0xda8], rax
lea rax, [rbp + 0x7f8]
mov rdi, rax
mov rsi, qword [rbp + 0xda8]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x858]
lea rcx, [rbp + 0x7f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x8b8]
lea rcx, [rbp + 0x858]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x918]
lea rcx, [rbp + 0x8b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa98]
lea rcx, [rbp + 0x918]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd20]
lea rcx, [rbp + 0xb28]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xce0]
lea rcx, [rbp + 0xaf8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xca0]
lea rcx, [rbp + 0xac8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc60]
lea rcx, [rbp + 0xa98]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xce0]
lea r8, [rbp + 0xca0]
lea rdx, [rbp + 0xc60]
mov rcx, qword [rbp + 0x278]
call qword [rbp + 0xd68]
nop
lea rcx, [rbp + 0x828]
call fcn.14002b0cc
nop
lea rcx, [rbp + 0x7c8]
call fcn.14002b0cc
nop
lea rcx, [rbp + 0x768]
call fcn.14002b0cc
nop
lea rcx, [rbp + 0x708]
call fcn.14002b0cc
mov qword [rbp + 0x298], 0
mov rax, qword [rbp + 0x278]
mov rax, qword [rax]
mov rax, qword [rax + 0x38]
mov qword [rbp + 0xd68], rax
lea rdx, [0x14008e44c]
lea rcx, [rbp + 0xb58]
call fcn.14002b4f5
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
mov rcx, qword [rbp + 0xd78]
call fcn.14002b6df
mov qword [rbp + 0xd80], rax
lea r8, [rbp + 0x298]
mov rdx, qword [rbp + 0xd80]
mov rcx, qword [rbp + 0x278]
call qword [rbp + 0xd68]
nop
lea rcx, [rbp + 0xb58]
call fcn.14002b383
mov rax, qword [rbp + 0x298]
mov rax, qword [rax]
mov rax, qword [rax + 0x78]
mov qword [rbp + 0xd68], rax
lea rdx, [0x14008e450]
lea rcx, [rbp + 0xb78]
call fcn.14002b4f5
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
mov rcx, qword [rbp + 0xd78]
call fcn.14002b6df
mov qword [rbp + 0xd80], rax
xor r8d, r8d
mov rdx, qword [rbp + 0xd80]
mov rcx, qword [rbp + 0x298]
call qword [rbp + 0xd68]
nop
lea rcx, [rbp + 0xb78]
call fcn.14002b383
mov rax, qword [rbp + 0xde0]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [rbp + 0xde0]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x238]
call fcn.14002b3ab
jmp 0x14005a285
mov rax, qword [rbp + 0xde0]
cmp dword [rax], 0
jne 0x14005a285
lea rax, [rbp + 0xb98]
mov qword [rbp + 0xbf8], rax
mov rcx, qword [rbp + 0xbf8]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0xd68], rax
mov rax, qword [rbp + 0xd68]
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
lea rdx, str.you_are_not_admin_you_need_admin_to_run_this_command_run__getadmin
lea rcx, [rbp + 0xc18]
call fcn.14002aac3
nop
mov r8, qword [rbp + 0xd78]
lea rdx, [rbp + 0xc18]
mov rcx, qword [rbp + 0xde8]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0xc18]
call fcn.14002a44c
jmp 0x14005a29a
lea rdx, str.not_for_me_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002a2a8
lea rcx, [rbp - 0x30]
lea rdx, [0x140089880]
call fcn.14002b2e8
mov rcx, qword [rbp + 0xdb0]
xor rcx, rbp
call fcn.14002ab77
lea rsp, [rbp + 0xdc0]
pop rdi
pop rsi
pop rbp
ret