Function at 0x140023840
Capabilities:
Print debug messages

Disassembly:
push r12
mov r9d, ecx
mov r12d, ecx
lea rdx, str.TokenRemove
push rdi
lea rcx, str._DEBUG::_s::_d__Token_Remove____d_n
mov r8d, 0x1dc
push rbx
sub rsp, 0x20
call sym.DbgPrint
mov ecx, r12d
call sym.TokenGet
mov rbx, qword [0x14002d650]
mov r12, rax
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
test rax, rax
je 0x140023bf0
test r12, r12
je 0x140023bf0
cmp r12, rax
lea rdx, str.TokenRemove
jne 0x140023a9e
lea r9, str.Its_first_item
mov r8d, 0x1e9
lea rcx, [0x14002b0d0]
call sym.printf.constprop.0
mov rax, qword [rbx]
mov rdx, qword [rax + 0x8ee]
cmp dword [rax + 0x8fe], 0
mov r12, qword [rdx + 0x30]
je 0x1400238eb
mov rax, qword [rax + 0x8f6]
mov rdi, qword [rdx]
cmp qword [rax], rdi
jne 0x1400238eb
xor ecx, ecx
call sym.TokenImpersonate
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov rcx, qword [rax]
test rcx, rcx
je 0x140023913
call sym.SysNtClose
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov qword [rax], 0
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140023967
call sym.StringLengthW
mov rdx, qword [rbx]
lea rcx, [rax + rax]
xor eax, eax
mov rdx, qword [rdx + 0x8ee]
mov rdi, qword [rdx + 8]
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rdx, qword [rax + 0x8ee]
mov rcx, qword [rdx + 8]
call qword [rax + 0x3b0]
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov qword [rax + 8], 0
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400239bb
call sym.StringLengthW
mov rdx, qword [rbx]
lea rcx, [rax + rax]
xor eax, eax
mov rdx, qword [rdx + 0x8ee]
mov rdi, qword [rdx + 0x18]
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rdx, qword [rax + 0x8ee]
mov rcx, qword [rdx + 0x18]
call qword [rax + 0x3b0]
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov qword [rax + 0x18], 0
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140023a0f
call sym.StringLengthW
mov rdx, qword [rbx]
lea rcx, [rax + rax]
xor eax, eax
mov rdx, qword [rdx + 0x8ee]
mov rdi, qword [rdx + 0x28]
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rdx, qword [rax + 0x8ee]
mov rcx, qword [rdx + 0x28]
call qword [rax + 0x3b0]
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov qword [rax + 0x28], 0
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140023a63
call sym.StringLengthW
mov rdx, qword [rbx]
lea rcx, [rax + rax]
xor eax, eax
mov rdx, qword [rdx + 0x8ee]
mov rdi, qword [rdx + 0x20]
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rdx, qword [rax + 0x8ee]
mov rcx, qword [rdx + 0x20]
call qword [rax + 0x3b0]
mov rax, qword [rbx]
mov rax, qword [rax + 0x8ee]
mov qword [rax + 0x20], 0
mov rax, qword [rbx]
mov ecx, 0x38
mov rdi, qword [rax + 0x8ee]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [rax + 0x8ee]
call qword [rax + 0x3b0]
mov rax, qword [rbx]
mov qword [rax + 0x8ee], r12
jmp 0x140023be9
test rax, rax
je 0x140023bf0
mov rdi, rax
mov rax, qword [rax + 0x30]
cmp rax, r12
jne 0x140023a95
lea r9, str.Found_TokenItem
mov r8d, 0x21f
lea rcx, [0x14002b0d0]
call sym.printf.constprop.0
mov rax, qword [r12 + 0x30]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx]
cmp dword [rax + 0x8fe], 0
je 0x140023aef
mov rax, qword [rax + 0x8f6]
mov rdi, qword [r12]
cmp qword [rax], rdi
jne 0x140023aef
xor ecx, ecx
call sym.TokenImpersonate
mov rcx, qword [r12]
test rcx, rcx
je 0x140023b05
call sym.SysNtClose
mov qword [r12], 0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x140023b38
call sym.StringLengthW
mov rdi, qword [r12 + 8]
lea rcx, [rax + rax]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [r12 + 8]
call qword [rax + 0x3b0]
mov qword [r12 + 8], 0
mov rcx, qword [r12 + 0x18]
test rcx, rcx
je 0x140023b6b
call sym.StringLengthW
mov rdi, qword [r12 + 0x18]
lea rcx, [rax + rax]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [r12 + 0x18]
call qword [rax + 0x3b0]
mov qword [r12 + 0x18], 0
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x140023b9e
call sym.StringLengthW
mov rdi, qword [r12 + 0x28]
lea rcx, [rax + rax]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [r12 + 0x28]
call qword [rax + 0x3b0]
mov qword [r12 + 0x28], 0
mov rcx, qword [r12 + 0x20]
test rcx, rcx
je 0x140023bd1
call sym.StringLengthW
mov rdi, qword [r12 + 0x20]
lea rcx, [rax + rax]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, qword [r12 + 0x20]
call qword [rax + 0x3b0]
mov qword [r12 + 0x20], 0
mov rdi, r12
mov ecx, 0x38
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rbx]
mov rcx, r12
call qword [rax + 0x3b0]
mov eax, 1
jmp 0x140023bf2
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop r12
ret