Function at 0x1400966f0
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400bb010]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor edi, edi
mov ebx, edi
mov qword [rbp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x40]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14009676e
mov rcx, qword [rbp + 0x40]
lea rax, [rbp + 0x50]
lea r9d, [rdi + 4]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x54]
mov dword [rbp + 0x50], 4
lea edx, [rdi + 0x14]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp + 0x54]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14009677d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400969e5
mov ecx, 8
call fcn.1400998c0
lea rcx, [0x140095e60]
mov r9, rax
lea r8, [0x140097030]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x80], rax
test rax, rax
je 0x1400969d3
cmp dword [rbp + 0x88], edi
je 0x1400969c7
movaps xmm0, xmmword [rbp + 0x80]
lea rcx, [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400967fc
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
mov ecx, 8
movdqa xmmword [rbp + 0x80], xmm0
call fcn.1400998c0
lea rcx, [0x140095170]
mov r9, rax
lea r8, [0x140097030]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0xa8]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x1400969b5
cmp dword [rbp + 0xa8], edi
je 0x1400969c7
movaps xmm0, xmmword [rbp + 0xa0]
lea rcx, [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14009687e
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
mov ecx, 8
movdqa xmmword [rbp + 0xa0], xmm0
call fcn.1400998c0
lea rcx, [0x140008590]
mov r9, rax
lea r8, [0x140097030]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x60], rax
test rax, rax
je 0x1400969a6
cmp dword [rbp + 0x68], edi
je 0x1400969c7
movaps xmm0, xmmword [rbp + 0x60]
lea rcx, [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400968f4
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
cmp byte [0x14022fae0], dil
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
jne 0x140096983
movabs rsi, 0x7fffffffc46535fe
movabs rdi, 0x7fffffffffffffff
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14009693e
imul rax, rax, 0x64
jmp 0x14009695c
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rsi
jg 0x14009696d
add rax, 0x3b9aca00
mov qword [rbp + 0x40], rax
jmp 0x140096971
mov qword [rbp + 0x40], rdi
lea rcx, [rbp + 0x40]
call fcn.14000b3e0
cmp byte [0x14022fae0], 0
je 0x140096920
cmp dword [rbp + 0x68], 0
jne 0x14009699f
cmp dword [rbp + 0xa8], 0
jne 0x14009699f
cmp dword [rbp + 0x88], 0
je 0x140096bdf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp + 0x68], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0xa8], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x88], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movabs r10, 0xd4420c379262bb07
movabs r9, 0x10249472b6a47110
movabs rax, 0x291550578b3bb609
movabs r8, 0x5b703439ee4dd745
mov qword [rbp + 0x40], rax
movabs rdx, 0x651b131c129acd0e
mov rax, qword [rbp + 0x40]
movabs rcx, 0x69e6bef8339b3d02
mov qword [rbp + 0x80], rax
movabs rax, 0x86e7a7177e89d2e
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x40], r10
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x40], r9
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x40], r8
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0x40], rdx
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x40], r10
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x40], r9
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xb8], rax
movabs rax, 0x2b505a5c8839a209
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp], rax
movabs rax, 0x45727e7d60fda27c
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 8], rax
movabs rax, 0xbd216543f70cd47e
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x10], rax
movabs rax, 0x304ff500d7c81e30
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x18], rax
movabs rax, 0x8293281c3429ed28
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x40], r8
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0x40], rdx
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0x40], r10
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0x40], r9
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xd8], rax
movabs rax, 0x82bd52755a408e49
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa xmm2, xmmword [rbp + 0x20]
mov qword [rbp + 0xe8], rax
vpxor xmm2, xmm2, xmmword [rbp + 0xe0]
vmovdqa ymmword [rbp], ymm1
vmovdqa xmmword [rbp + 0x20], xmm2
lea r8, [rbp + 0x80]
xor r9d, r9d
lea rdx, [rbp]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1400996f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret