Function at 0x7ff788e27188
Capabilities:
Accept command line arguments
Acquire debug privileges
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xbb378]
mov eax, 0xbb450
call fcn.7ff788e27860
sub rsp, rax
call fcn.7ff788e24bbc
xor r13d, r13d
xor ecx, ecx
mov dword [rsp + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [0x7ff788f7e3b8]
mov rdi, rax
call qword [0x7ff788f7e4f0]
mov ebx, 0x1388
lea esi, [r13 + 4]
lea r15d, [r13 + 1]
lea r12d, [r13 + 2]
test eax, eax
jne 0x7ff788e275a8
mov ecx, dword [rsp + 0x30]
lea r8d, [r13 + 0xa]
lea rdx, [rbp + 0x1a0]
call fcn.7ff788e2a1d8
mov eax, dword [rsp + 0x30]
cmp eax, r12d
jg 0x7ff788e2747e
jne 0x7ff788e2723a
cmp qword [rdi + 8], r13
je 0x7ff788e2723a
mov ecx, ebx
call qword [0x7ff788f79de0]
mov rcx, qword [rdi + 8]
call qword [0x7ff788f79e40]
mov ebx, 0x3e8
lea rcx, [rbp + 0xae0]
mov r8d, ebx
xor edx, edx
call fcn.7ff788e27164
mov r8d, ebx
lea rcx, [rbp + 0x2e0]
xor edx, edx
call fcn.7ff788e27164
mov r8d, ebx
lea rcx, [rbp + 0xed0]
xor edx, edx
call fcn.7ff788e27164
mov r8d, ebx
lea rdx, [rbp + 0xae0]
xor ecx, ecx
call qword [0x7ff788f7e5e0]
lea rdx, [rbp + 0xae0]
lea rcx, [rbp + 0x2e0]
call fcn.7ff788e29d6c
lea rcx, [rbp + 0x2e0]
call fcn.7ff788e29d88
movsxd rcx, eax
test eax, eax
jle 0x7ff788e27302
cmp word [rbp + rcx*2 + 0x2e0], 0x5c
je 0x7ff788e272c2
sub eax, r15d
sub rcx, r15
test rcx, rcx
jg 0x7ff788e272aa
jmp 0x7ff788e27302
lea esi, [rax + 1]
lea rcx, [rbp + 0x2e0]
movsxd rbx, esi
call fcn.7ff788e29d88
cmp rbx, rax
jae 0x7ff788e27302
lea r14, [rbp + 0x2e0]
lea r14, [r14 + rbx*2]
mov word [r14], r13w
lea rcx, [rbp + 0x2e0]
add esi, r15d
add r14, r12
movsxd rbx, esi
call fcn.7ff788e29d88
cmp rbx, rax
jb 0x7ff788e272e4
mov r14, r12
xor edx, edx
lea rcx, [rbp + 0x6d0]
mov r8d, 0x410
call fcn.7ff788e27164
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x6d0]
call fcn.7ff788e29d6c
xor edx, edx
lea rcx, str.xhwNbTzGtlan.exe
mov r8d, 0x208
call fcn.7ff788e27164
call qword [0x7ff788f7e498]
mov ecx, eax
call fcn.7ff788e2a518
lea rbx, str.xhwNbTzGtlan.exe
call fcn.7ff788e2a4ec
mov esi, eax
mov eax, 0x10624dd3
mul esi
shr edx, 4
imul ecx, edx, 0xffffff06
add esi, ecx
mov ecx, esi
call fcn.7ff788e29914
test eax, eax
je 0x7ff788e27354
mov word [rbx], si
lea rax, [0x7ff788f7e192]
add rbx, r12
cmp rbx, rax
jl 0x7ff788e27354
lea rdx, [0x7ff788e333a8]
lea rcx, str.xhwNbTzGtlan.exe
call fcn.7ff788e29d08
lea rdx, str.xhwNbTzGtlan.exe
lea rcx, [rbp + 0x6d0]
call fcn.7ff788e29d08
xor r8d, r8d
lea rdx, [rbp + 0x6d0]
lea rcx, [rbp + 0xae0]
call qword [0x7ff788f79e18]
test eax, eax
je 0x7ff788e27403
mov edx, r12d
lea rcx, [rbp + 0x6d0]
call qword [0x7ff788f7e160]
lea rdx, [0x7ff788e333b8]
lea rcx, [rbp + 0xed0]
call fcn.7ff788e29d6c
lea rdx, [0x7ff788e333c0]
lea rcx, [rbp + 0xed0]
call fcn.7ff788e29d08
jmp 0x7ff788e27443
lea rcx, [rbp + 0x2e0]
call fcn.7ff788e29d88
mov ecx, 0x61
lea rdx, [rbp + 0x6d0]
xor r8d, r8d
mov word [rbp + rax*2 + 0x2d6], cx
lea rcx, [rbp + 0xae0]
call qword [0x7ff788f79e18]
mov edx, r12d
lea rcx, [rbp + 0x6d0]
call qword [0x7ff788f7e160]
mov dword [rsp + 0x28], r13d
lea r9, [rbp + 0xed0]
lea r8, [rbp + 0x6d0]
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
call qword [0x7ff788f7e4e0]
mov ecx, 0x1388
call qword [0x7ff788f79de0]
sub r14, r15
jne 0x7ff788e27305
jmp 0x7ff788e275a8
cmp eax, 3
jne 0x7ff788e27534
xor edx, edx
lea rcx, [rbp + 0x210]
mov r8d, 0xc8
call fcn.7ff788e27164
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp + 0x210]
call fcn.7ff788e29d6c
mov ecx, ebx
call qword [0x7ff788f79de0]
mov rax, qword [rdi + 8]
cmp word [rax], 0x38
jne 0x7ff788e274e5
mov rax, qword [rdi + 0x10]
cmp word [rax], 0x4c
jne 0x7ff788e274e5
mov ecx, 8
call fcn.7ff788e26018
mov ecx, 0x6acfc0
call qword [0x7ff788f79de0]
mov ecx, r15d
call qword [0x7ff788f7e520]
mov rcx, qword [rdi + 8]
lea rdx, [0x7ff788e333c8]
call fcn.7ff788e29d34
test eax, eax
je 0x7ff788e27511
mov rcx, qword [rdi + 8]
lea rdx, [0x7ff788e333d8]
call fcn.7ff788e29d34
test eax, eax
jne 0x7ff788e275a8
mov rcx, qword [rdi + 0x10]
cmp word [rcx + 2], r13w
jne 0x7ff788e2752e
mov eax, 0x3a
mov word [rcx + 2], ax
mov rax, qword [rdi + 0x10]
mov word [rax + 4], r13w
mov rdx, qword [rdi + 0x10]
jmp 0x7ff788e27577
cmp eax, esi
jne 0x7ff788e275a8
mov rcx, qword [rdi + 8]
call qword [0x7ff788f79e40]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x7ff788e333c8]
call fcn.7ff788e29d34
test eax, eax
jne 0x7ff788e275a8
mov rcx, qword [rdi + 0x18]
cmp word [rcx + 2], r13w
jne 0x7ff788e27573
mov eax, 0x3a
mov word [rcx + 2], ax
mov rax, qword [rdi + 0x18]
mov word [rax + 4], r13w
mov rdx, qword [rdi + 0x18]
lea rcx, [0x7ff788f79e50]
call fcn.7ff788e29d6c
mov ecx, esi
call fcn.7ff788e26018
mov ecx, 0xc350
call qword [0x7ff788f79de0]
mov ecx, r12d
call fcn.7ff788e26018
mov ecx, 0x7a120
call qword [0x7ff788f79de0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0x114
lea rcx, [rbp + 0x80]
mov r8d, ebx
xor edx, edx
call fcn.7ff788e27164
lea rcx, [rbp + 0x80]
mov dword [rbp + 0x80], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x84], 5
mov r12d, r13d
jne 0x7ff788e275eb
mov r12d, r15d
jmp 0x7ff788e27609
mov qword [rsp + 0x28], r13
lea r8, [0x7ff788e25938]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [0x7ff788f7e4b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rsp + 0x38]
mov rcx, rax
lea ebx, [r8 + 0x28]
mov edx, ebx
call qword [str.Pjn.]
test eax, eax
jne 0x7ff788e27661
call qword [0x7ff788f7e4f0]
cmp eax, 0x3f0
jne 0x7ff788e27661
lea ecx, [rbx - 0x26]
call qword [0x7ff788f7e3d8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [str.Pjn.]
mov rcx, qword [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
mov r8d, r15d
call fcn.7ff788e258a8
xor edx, edx
lea rcx, [rbp + 0x12c0]
mov r8d, 0xba090
call fcn.7ff788e27164
lea rcx, [rbp + 0x12c0]
call fcn.7ff788e22fa0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [0x7ff788f7e5e0]
lea rcx, [rsp + 0x40]
call fcn.7ff788e29d88
movsxd rcx, eax
test eax, eax
jle 0x7ff788e2771a
cmp word [rsp + rcx*2 + 0x40], 0x5c
je 0x7ff788e276ce
sub eax, r15d
sub rcx, r15
test rcx, rcx
jg 0x7ff788e276b9
jmp 0x7ff788e2771a
lea edi, [rax + 1]
lea rcx, [rsp + 0x40]
movsxd rbx, edi
call fcn.7ff788e29d88
add rax, r15
cmp rbx, rax
jae 0x7ff788e2771a
lea r14, [rsp + 0x40]
lea r14, [r14 + rbx*2]
lea rsi, [rbp + 0x10]
movzx eax, word [r14]
lea rcx, [rsp + 0x40]
mov word [rsi], ax
lea r14, [r14 + 2]
add edi, r15d
lea rsi, [rsi + 2]
movsxd rbx, edi
call fcn.7ff788e29d88
add rax, r15
cmp rbx, rax
jb 0x7ff788e276f3
mov r14d, r15d
mov rsi, r15
mov r15d, r13d
lea rbx, [rbp + 0x14b4]
movsxd rax, r15d
lea rdi, [rbp + 0x12c0]
imul rcx, rax, 0x1fc
add rdi, rcx
lea rcx, [rbp + 0x10]
mov rdx, rdi
call fcn.7ff788e29d34
test eax, eax
je 0x7ff788e277c2
mov rdx, rdi
lea rcx, str.xhwNbTzGtlan.exe
call fcn.7ff788e29d34
test eax, eax
je 0x7ff788e277c2
cmp dword [rbx + 4], r14d
jne 0x7ff788e277c2
lea rdx, [0x7ff788e333e0]
mov rcx, rdi
call fcn.7ff788e29d34
test eax, eax
je 0x7ff788e277c2
lea rdx, [0x7ff788e333f8]
mov rcx, rdi
call fcn.7ff788e29d34
test eax, eax
je 0x7ff788e277c2
lea rdx, [0x7ff788e33418]
mov rcx, rdi
call fcn.7ff788e29d34
test eax, eax
je 0x7ff788e277c2
test r12d, r12d
je 0x7ff788e277aa
test rsi, rsi
je 0x7ff788e277c7
cmp rsi, 1
je 0x7ff788e277c7
mov ecx, dword [rbx]
call fcn.7ff788e217c8
mov ecx, 0x1f4
call qword [0x7ff788f79de0]
cmp dword [rbx], r13d
je 0x7ff788e277db
inc r15d
add rbx, 0x1fc
cmp r15d, 0x64
jl 0x7ff788e2772a
inc r14d
inc rsi
cmp r14d, 4
jle 0x7ff788e27720
mov ecx, 0x1388
call qword [0x7ff788f79de0]
mov ecx, 2
call fcn.7ff788e26018
lea r11, [rsp + 0xbb450]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret