Function at 0x140095e48
Capabilities:
Acquire debug privileges
Get common file path
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], r15
push rbp
lea rbp, [rax - 0x828]
sub rsp, 0x920
mov rax, qword [0x140198190]
xor rax, rsp
mov qword [rbp + 0x810], rax
xor esi, esi
xor eax, eax
lea r14d, [rsi + 1]
lock cmpxchg dword [0x14019ea14], r14d
jne 0x1400961f9
call fcn.140095bf4
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r8d, [rsi + 0x10]
lea rdx, str.SeDebugPrivilege
lea rcx, [rsp + 0x70]
call fcn.1400099b0
lea rcx, [rsp + 0x70]
call fcn.14009623c
mov r15d, 0x1000
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140095f09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140095f04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009622e
call fcn.14010f640
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rsp + 0x70]
call fcn.1400099b0
lea rcx, [rsp + 0x70]
call fcn.14009623c
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140095f77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140095f72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140096234
call fcn.14010f640
call fcn.14009634c
mov bl, sil
mov byte [rsp + 0x20], bl
mov byte [rsp + 0x21], sil
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 0x70], si
jne 0x140095fb0
mov bl, r14b
mov byte [rsp + 0x20], bl
jmp 0x140095fd1
mov dword [rsp + 0x68], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x68], esi
setne byte [rsp + 0x21]
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp - 0x40]
call fcn.140112010
lea rcx, [rbp - 0x40]
call fcn.140085108
nop
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0x150]
call fcn.140112010
lea rcx, [rbp + 0x150]
call fcn.140085108
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x600]
call fcn.140112010
mov edx, 0x104
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rax, [rbp + 0x600]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14009604e
lea rdx, [rbp + 0x600]
lea rcx, [rsp + 0x70]
call fcn.1400099b0
nop
lea r8, str.System32_ntdll.dll
lea rdx, [rsp + 0x70]
test bl, bl
je 0x14009609a
lea rcx, [rbp - 0x70]
call fcn.14004d550
nop
mov r8b, r14b
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140085358
nop
lea rcx, [rbp - 0x70]
jmp 0x1400960ee
lea rcx, [rsp + 0x28]
call fcn.14004d550
nop
mov r8b, r14b
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.140085358
nop
lea rcx, [rsp + 0x28]
call fcn.1400089c0
lea r8, str.SysWOW64_ntdll.dll
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14004d550
nop
mov r8b, r14b
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140085358
nop
lea rcx, [rsp + 0x48]
call fcn.1400089c0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x2e0]
call fcn.1400a36b4
nop
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x470]
call fcn.1400a36b4
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140096156
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140096150
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140096228
call fcn.14010f640
nop
lea rcx, [rbp + 0x150]
call fcn.1400852c0
nop
lea rcx, [rbp - 0x40]
call fcn.1400852c0
nop
lea r8, [rbp + 0x470]
lea rdx, [rbp + 0x2e0]
lea rcx, [rsp + 0x20]
call fcn.1400a31ac
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x2e0]
call fcn.1400a8328
nop
lea rcx, [rbp + 0x470]
call fcn.1400852c0
lea rcx, [rbp + 0x2e0]
call fcn.1400852c0
call fcn.140086a20
mov ecx, dword [0x14019ecfc]
test ecx, ecx
je 0x1400961f9
cmp ecx, 9
ja 0x1400961f1
cmp ecx, 6
ja 0x1400961e7
jb 0x1400961f9
mov rcx, qword [0x14019ed00]
cmp ecx, 3
jae 0x1400961e7
cmp ecx, r14d
jb 0x1400961f9
mov rcx, rax
call fcn.1400883f8
jmp 0x1400961f9
mov rcx, rax
call fcn.1400881d0
jmp 0x1400961f9
mov rcx, rax
call fcn.140087f8c
mov al, r14b
mov rcx, qword [rbp + 0x810]
xor rcx, rsp
call fcn.14010f620
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140118cb4
nop
call fcn.140118cb4
int3
call fcn.140118cb4
int3