Function at 0x14010af10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xe8
mov rax, qword [0x140236800]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea r8, [rbp - 0x39]
mov qword [rbp - 0x39], 0
mov edx, 0xf01ff
mov r15, rcx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14010bc92
movzx r10d, byte [rbp - 0x49]
xorps xmm0, xmm0
mov qword [rsp + 0x118], rsi
xor eax, eax
mov rsi, qword [0x14023d100]
mov qword [rsp + 0x120], r12
movabs r12, 0x4903a4ddaf21b332
mov qword [rsp + 0x128], r13
movabs r13, 0xd2b707d9cb6320ea
mov qword [rsp + 0xe0], r14
mov r14, qword [0x14023d108]
mov dword [rbp - 0x11], 0x26462053
mov dword [rbp - 0xd], 0x473d3426
mov dword [rbp - 9], 0x3a283c2a
mov dword [rbp - 5], 0x32353c24
mov byte [rbp - 1], 0x9c
movups xmmword [rbp], xmm0
mov word [rbp + 0x20], ax
movups xmmword [rbp + 0x10], xmm0
nop word [rax + rax]
mov rax, r14
mov r9, rsi
nop word [rax + rax]
xor edi, edi
cmp rdi, 0x33
jae 0x14010bb09
movzx ebx, byte [rbp + rdi - 0x11]
mov r11d, ebx
cmp rax, rdi
ja 0x14010bb00
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x14010b022
lea rdx, [rdi + r13]
movzx ecx, r11b
and cl, dl
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x66
add r10b, dl
jmp 0x14010b050
je 0x14010ba8a
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14010ba08
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14010b9df
lea rcx, [r9 + 9]
cmp rax, rcx
je 0x14010b997
nop
cmp r9, rdi
ja 0x14010baf7
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jae 0x14010b081
lea rdx, [rdi + r12]
movzx ecx, r11b
and cl, dl
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x5e
add r10b, dl
jmp 0x14010b0c2
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14010b97c
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14010b94c
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x14010b936
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14010b916
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x14010b8e8
lea rcx, [r9 + rax]
cmp rcx, rdi
jbe 0x14010b5e2
nop
lea rcx, [r9 + 0x200]
cmp rax, rcx
je 0x14010b5d0
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14010b5c2
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x14010b5a3
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x14010b585
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x14010b56c
lea rcx, [r9 + 0x42]
cmp rax, rcx
je 0x14010b54c
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x14010b52c
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x14010b513
lea rcx, [r9 + 0x400]
cmp rax, rcx
je 0x14010b4ec
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x14010b0d0
lea rax, [r9 + 1]
lea r9, [rax + 0x1000]
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x14010badb
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
jb 0x14010babb
lea rcx, [r9 + 6]
cmp rax, rcx
jb 0x14010b2c7
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x14010b2a8
lea rcx, [r9 + 0x41]
cmp rax, rcx
jb 0x14010b28d
lea rcx, [r9 + 0x20]
cmp rax, rcx
jb 0x14010b4a4
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x14010b461
lea rcx, [r9 + 3]
cmp rax, rcx
jb 0x14010b420
lea rcx, [r9 + 0x80]
cmp rax, rcx
jb 0x14010b3f8
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x14010b0d0
lea rax, [r9 + 0x42]
lea r9, [rax + 9]
lea rcx, [r9 + 2]
cmp rax, rcx
ja 0x14010b3ca
lea rcx, [r9 + 6]
cmp rax, rcx
ja 0x14010b3b1
lea rcx, [r9 + 0x400]
cmp rax, rcx
ja 0x14010b398
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x14010b378
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x14010b358
lea rcx, [r9 + 0x5a]
cmp rax, rcx
ja 0x14010b33a
lea rcx, [r9 + 0x28]
cmp rax, rcx
ja 0x14010b31b
lea rcx, [r9 + 0x80]
cmp rax, rcx
ja 0x14010b2f9
lea rcx, [r9 + 4]
cmp rax, rcx
ja 0x14010b2e7
lea rcx, [r9 + 0x200]
cmp rax, rcx
ja 0x14010b0d0
lea rax, [r9 + 2]
lea r9, [rax + 0x61]
jmp 0x14010b0d0
lea r10d, [rdi + 0xe]
movzx ecx, r10b
and cl, bl
add cl, cl
sub r10b, cl
sub r10b, 0x62
add r10b, bl
jmp 0x14010b0c2
lea edx, [rdi + 0x3a]
mov r10d, gethostname
movzx ecx, dl
and cl, bl
sub r10b, cl
add r10b, r10b
add r10b, dl
add r10b, bl
jmp 0x14010b050
lea r8d, [rdi + 0x66]
mov edx, reloc.WLDAP32.dll_Ordinal_27
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010aff4
lea r8d, [rdi - 0x70]
mov edx, 8
movzx r11d, dil
jmp 0x14010b9a4
lea edx, [rdi - 0x44]
inc r9
movzx ecx, dl
dec rdi
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x24
inc rdi
jmp 0x14010afe2
lea edx, [rdi - 0x18]
dec rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x58
inc rdi
jmp 0x14010afe2
mov edx, Ordinal_60
lea r8d, [rdi + 0x14]
movzx ecx, r8b
movzx r11d, dil
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
jmp 0x14010b8a1
lea r8d, [rdi + 0x40]
mov edx, reloc.WLDAP32.dll_Ordinal_32
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010b960
lea r8d, [rdi + 0x6c]
mov edx, 6
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010b963
lea edx, [rdi - 0x68]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x28
jmp 0x14010ba2a
lea edx, [rdi - 0x3c]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x5c
jmp 0x14010ba52
lea r8d, [rdi - 0x10]
mov edx, gethostname
movzx ecx, r8b
and cl, bl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc rdi
jmp 0x14010afe2
lea r8d, [rdi + 0x5e]
mov edx, gethostname
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
mov byte [rbp + rdi - 0x11], r10b
inc rdi
jmp 0x14010afe2
lea r8d, [rdi - 0x76]
mov edx, Ordinal_30
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
cmp r9, 9
jb 0x14010b413
movzx r11d, dil
lea edx, [r11 + 0x3c]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
add dl, bl
lea r10d, [rdx*2 - 0x48]
jmp 0x14010b9b6
lea r8d, [rdi - 0x4a]
mov edx, 3
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
cmp rax, 0x20
jae 0x14010b884
lea rdx, [r9 + 5]
cmp rax, rdx
jbe 0x14010b7be
lea r8d, [rdi - 0xc]
mov edx, Ordinal_45
movzx ecx, r8b
and cl, bl
jmp 0x14010b42f
lea edx, [rdi - 0x1e]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x2e
lea rcx, [r9 + rax]
cmp rcx, 0x41
je 0x14010b8cb
lea rcx, [r9 + 0x200]
cmp rax, rcx
jbe 0x14010b6e4
lea edx, [rdi - 0x3e]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x4e
jmp 0x14010b47c
lea edx, [rdi + 0x2c]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
lea r10d, [rbx + rdx]
sub r10b, 0x34
inc rdi
jmp 0x14010afe2
lea edx, [rdi + 0x58]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x68
jmp 0x14010ba52
lea r8d, [rdi - 0x7c]
mov edx, reloc.WLDAP32.dll_Ordinal_50
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010ba2a
lea r8d, [rdi - 0x50]
mov edx, Ordinal_26
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010b963
lea edx, [rdi - 0x24]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 4
jmp 0x14010b960
movzx r11d, dil
lea edx, [r11 + 8]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x38
jmp 0x14010b8a7
lea edx, [rdi + 0x34]
dec rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x6c
inc rdi
jmp 0x14010afe2
lea r8d, [rdi + 0x60]
mov edx, Ordinal_50
jmp 0x14010b9e8
movzx r11d, dil
mov edx, reloc.WLDAP32.dll_Ordinal_22
lea r8d, [r11 - 0x74]
jmp 0x14010b9a4
lea rcx, [r9 + 0x42]
cmp rax, rcx
jae 0x14010b604
lea edx, [rdi - 0x16]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x66
jmp 0x14010b4b8
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14010b63b
lea r8d, [rdi + 0x64]
mov edx, Ordinal_35
movzx ecx, r8b
and cl, bl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc rdi
jmp 0x14010afe2
inc rcx
cmp rax, rcx
jne 0x14010b663
lea r8d, [rdi + 0x38]
mov edx, reloc.WLDAP32.dll_Ordinal_60
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010ba52
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x14010b68a
mov edx, 0x24
movzx r11d, dil
lea r8d, [r11 - 0x78]
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
jmp 0x14010b8a1
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x14010b6b9
lea r8d, [rdi + 0x5c]
mov edx, 0x3e
movzx ecx, r8b
dec rdi
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc rdi
jmp 0x14010afe2
lea rcx, [r9 + 8]
cmp rax, rcx
jne 0x14010b4b8
movzx r11d, dil
lea edx, [r11 + 4]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x1c
jmp 0x14010b9b6
lea rdx, [r9 + 1]
cmp rax, rdx
jne 0x14010b70b
movzx r11d, dil
lea edx, [r11 - 0x6a]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x1a
jmp 0x14010b9b6
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14010b73a
lea r8d, [rdi + 0x3e]
mov edx, Ordinal_41
movzx ecx, r8b
dec rdi
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc rdi
jmp 0x14010afe2
lea rcx, [rdx + 1]
cmp rax, rcx
jne 0x14010b761
movzx r11d, dil
lea edx, [r11 + 0x12]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x7e
jmp 0x14010b8a7
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x14010b78a
lea r8d, [rdi - 0x72]
mov edx, reloc.WS2_32.dll_ntohs
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010ba2a
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x14010b47c
lea edx, [rdi + 0x36]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
lea r10d, [rbx + rdx]
sub r10b, 0x7a
inc rdi
jmp 0x14010afe2
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14010b7ee
lea edx, [rdi - 0x38]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
lea r10d, [rbx + rdx]
sub r10b, 0x78
inc rdi
jmp 0x14010afe2
inc rcx
cmp rax, rcx
jne 0x14010b80f
lea edx, [rdi + 0x70]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x10
jmp 0x14010ba2a
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14010b838
lea r8d, [rdi + 0x18]
mov edx, Ordinal_45
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010b960
cmp rax, rdx
jne 0x14010b858
movzx r11d, dil
lea edx, [r11 - 0x14]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x74
jmp 0x14010b8a7
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x14010b43b
lea edx, [rdi - 0x40]
dec rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x40
inc rdi
jmp 0x14010afe2
movzx r10d, byte [rbp + rdi - 0x11]
movzx r11d, dil
lea r8d, [r11 + 0x10]
movzx ecx, r8b
and cl, bl
add cl, cl
sub r10b, cl
sub r10b, 0x70
add r10b, r8b
add r10b, bl
sub r11b, 6
mov edx, reloc.WS2_32.dll_setsockopt
movzx ecx, r11b
and cl, bl
sub dl, cl
add dl, dl
add dl, r11b
add dl, bl
add dl, r10b
mov byte [rbp + rdi - 0x11], dl
jmp 0x14010b960
lea edx, [rdi - 0x1c]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
sub dl, byte [rbp + rdi - 0x11]
lea r10d, [rbx + rdx]
sub r10b, 0x3c
jmp 0x14010ba2a
lea r8d, [rdi - 0x5a]
mov edx, Ordinal_60
movzx ecx, r8b
and cl, bl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc rdi
jmp 0x14010afe2
lea r8d, [rdi - 2]
mov edx, 7
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14010ba2a
lea edx, [rdi + 0x2a]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x26
jmp 0x14010b963
lea edx, [rdi + 0x56]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x5a
add rax, r9
movzx ecx, r10b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x14010afe2
movzx r11d, dil
lea edx, [r11 + 6]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x2a
jmp 0x14010b9b6
movzx r11d, dil
mov edx, gethostname
lea r8d, [r11 + 0x5e]
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
add r11b, 0x26
inc r9
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
sub r11b, 0xa
add r11b, bl
mov byte [rbp + rdi - 0x11], r11b
dec rdi
inc rdi
jmp 0x14010afe2
lea r8d, [rdi - 0x76]
mov edx, Ordinal_30
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc r9
dec rdi
inc rdi
jmp 0x14010afe2
mov ecx, reloc.WLDAP32.dll_Ordinal_27
movabs rdx, 0xc30136f48fb5e666
add rdx, rdi
and r11b, dl
sub cl, r11b
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
lea r8d, [rdi - 0x32]
inc r9
movzx ecx, r8b
mov edx, Ordinal_50
and cl, bl
sub dl, cl
add dl, dl
add dl, r8b
add dl, bl
movzx ecx, dl
mov byte [rbp + rdi - 0x11], cl
add rcx, r9
sub rdi, rcx
lea edx, [rdi - 0x48]
inc rax
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
mov rcx, 0xffffffffffffffff
sub rcx, rax
sub dl, 8
add dl, bl
mov byte [rbp + rdi - 0x11], dl
add rdi, rcx
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x14010afe2
movabs rcx, 0x7825178d622962be
add rcx, rdi
and r11b, cl
add r11b, r11b
sub bl, r11b
lea r10d, [rcx + rbx]
sub r10b, 0x32
movzx ecx, byte [rbp + rdi - 0x11]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x14010afe2
sub dil, 0x6e
mov edx, 1
movzx ecx, dil
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, dil
add r10b, bl
jmp 0x14010afe0
sub dil, 0x42
movzx eax, dil
and al, bl
add al, al
sub dil, al
lea r10d, [rbx + rdi]
sub r10b, 0x32
jmp 0x14010afd0
lea rdx, [rbp + 0x15a1d27]
jmp 0x14010bb0d
lea rdx, [rbp + 0x17d3e11]
jmp 0x14010bb0d
lea rdx, [rbp - 0x11]
lea r8, [rbp - 0x29]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov r14, qword [rsp + 0xe0]
mov r13, qword [rsp + 0x128]
mov r12, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x118]
test eax, eax
je 0x14010bc92
mov rax, qword [rbp - 0x29]
lea r8, [rbp - 0x21]
mov rcx, qword [rbp - 0x39]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rbp - 0x1d], rax
mov dword [rbp - 0x21], 1
mov dword [rbp - 0x15], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14010bc92
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14010bc92
xor eax, eax
mov word [rbp - 0x2d], 0x100
xorps xmm0, xmm0
mov qword [rbp + 0xf], rax
lea rcx, [rbp - 0x11]
mov dword [rbp - 0x31], eax
movups xmmword [rbp - 0x11], xmm0
lea edx, [rax + 1]
mov qword [rbp - 0x41], rax
movups xmmword [rbp - 1], xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea rax, [rbp - 0x41]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x31]
mov dword [rsp + 0x48], 0
xor r8d, r8d
mov dword [rsp + 0x40], 0
mov dl, 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, 0x40
lea ebx, [rax + 0x10]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8d, 2
mov edx, ebx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov r9, qword [rbp - 0x41]
mov edx, 2
mov r8d, 0x1fffff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_AddAccessDeniedAce]
xor r9d, r9d
lea rcx, [rbp - 0x11]
mov r8, rdi
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea r8, [rbp - 0x11]
mov edx, 4
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x14010bc94
xor al, al
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140198db0
add rsp, 0xe8
pop r15
pop rdi
pop rbx
pop rbp
ret