Function at 0x14007e9f0
Capabilities:
Acquire debug privileges
Create thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x240
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140153200]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x100]
lea edx, [rbx + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
movabs rsi, 0xbf30666b44127137
movabs rdi, 0x80e2053ebdca8994
movabs r14, 0xa1306f29802a2645
movabs r15, 0x4371f8acb9692dba
test eax, eax
je 0x14007eae5
lea r8, [rbp + 0xe4]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14007ead8
mov dword [rbp + 0xe0], 1
mov dword [rbp + 0xec], 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x10]
lea r8, [rbp + 0xe0]
xor edx, edx
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14007ead8
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007edcf
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xa1556f0980442604
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x4303f8c3b91b2dc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xbf536608447d7117
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x8087054cbdb889e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x6b45a0c19f0da22d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xc7b1ddb6b789671c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xe4d883a35b9695bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x97feceffd3503ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x4445833194fc81e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x7fe8b137a4bc08e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xb932e4f7b12cdc93
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x397f6437eea1f325
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x45e7e87371246bb0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rcx, 0xa1a0e170057dbe36
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0x6b30a0a59f2da249
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xc7d6ddd8b7e0676e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0xe4b983d75be5959b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0x90fec9afd4103c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0x4429836194dc81cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x7f8db144a4dd0882
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xb940e483b10cdcbf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x39186456ee81f35c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x45c9e81d714d6bd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xc0]
vxorps xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0x60]
mov ecx, 0xffffffff
vzeroupper
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
mov r13d, ebx
lea rsi, reloc.WS2_32.dll_accept
nop dword [rax]
mov r15d, dword [rsi + 4]
mov r12d, dword [rsi]
test dword [rsi - 4], 0xfffffffd
je 0x14007edf7
xor al, al
jmp 0x14007ee8e
xor r14b, r14b
xor al, al
mov rdi, rbx
lea rbx, [0x1401d2278]
lea rcx, [0x1401d2348]
nop dword [rax]
test rdi, rdi
je 0x14007ee27
cmp dword [rbx - 8], r12d
jne 0x14007ee27
mov r14b, 1
call qword [rbx]
lea rcx, [0x1401d2348]
inc rdi
add rbx, 0x10
cmp rbx, rcx
jl 0x14007ee10
test r14b, r14b
jne 0x14007ee3e
xor al, al
xor ebx, ebx
jmp 0x14007ee8e
test al, al
jne 0x14007ee46
xor ebx, ebx
jmp 0x14007ee8e
test r15d, r15d
jne 0x14007ee51
mov al, 1
xor ebx, ebx
jmp 0x14007ee8e
xor dil, dil
xor al, al
lea rbx, [0x1401d2278]
nop dword [rax]
cmp dword [rbx - 8], r15d
jne 0x14007ee77
mov dil, 1
call qword [rbx]
test al, al
sete al
lea rcx, [0x1401d2348]
add rbx, 0x10
cmp rbx, rcx
jl 0x14007ee60
movzx eax, al
test dil, dil
mov ebx, 0
cmove eax, ebx
mov byte [rsi + 9], al
mov rcx, qword [rsi - 0x14]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14007eea5
mov byte [rsi + 8], al
jmp 0x14007eebf
mov rdx, qword [rsi - 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi + 0xc], rax
test rax, rax
setne al
mov byte [rsi + 8], al
inc r13d
add rsi, 0x30
cmp r13d, 0x1f
jb 0x14007ede0
movabs rax, 0xc8421a4ae5794316
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x2f188ec5cb3954ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xbf30666b44771652
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rdi, 0x80e2053ebdca8994
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs r14, 0xa1306f29802a2645
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs r15, 0x4371f8acb9692dba
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rsi, 0xbf30666b44127137
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x100], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.14007d810
movabs rax, 0xf1571a4be56e4316
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x26169dc0d01f44c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x100], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x100]
mov rcx, rax
call fcn.14007d810
call fcn.14007de30
test al, al
jne 0x14007f4b6
call fcn.14007e330
test al, al
jne 0x14007f4b6
mov byte [0x1401d8199], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
lea rcx, [rbp + 0x120]
call fcn.14007dcf0
nop
mov r8, rbx
mov r9, qword [0x1401d81f0]
sub r9, qword [0x1401d81e8]
sar r9, 5
test r9, r9
je 0x14007f108
mov r10, qword [rbp + 0x120]
nop dword [rax]
mov rax, r8
shr rax, 5
lea rdx, [r10 + rax*4]
mov rcx, r8
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [rdx], eax
jne 0x14007f3d3
inc r8
cmp r8, r9
jb 0x14007f0e0
mov ecx, 1
call fcn.1400ed244
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0xe8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140080630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x14007f4a4
cmp dword [rbp + 0xe8], 0
je 0x14007f498
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x100], xmm0
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007f498
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
lea ecx, [rax + 1]
call fcn.1400ed244
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140080660]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14007f489
cmp dword [rbp + 0x58], 0
je 0x14007f47d
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007f47d
lea ecx, [rax + 1]
call fcn.1400ed244
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140080690]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14007f46e
cmp dword [rbp + 0x48], 0
je 0x14007f462
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007f462
lea ecx, [rax + 1]
call fcn.1400ed244
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400806c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x14007f453
cmp dword [rbp + 0x38], 0
je 0x14007f447
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007f447
lea ecx, [rax + 1]
call fcn.1400ed244
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400806f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14007f438
cmp dword [rbp + 0x28], 0
je 0x14007f42c
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007f42c
lea ecx, [rax + 1]
call fcn.1400ed244
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140080720]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14007f41d
cmp dword [rbp + 0x18], 0
je 0x14007f411
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14007f411
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x14007f3e1
mov rdx, qword [rbp + 0x130]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007f3dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007f3dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400ed4c0
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400ed9d0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x18], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x28], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x48], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x58], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0xe8], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov byte [0x1401d8199], 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3