Function at 0x140001fc0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, rdx
mov edi, ecx
call sym.IsRunAsAdmin__
test al, al
je 0x140002087
mov ecx, 0x60
call sym..weak._Znwy.default.__clang_call_terminate
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], 0x31
mov qword [rsp + 0x68], 0x2b
movabs rcx, 0x2e04300440043e
mov qword [rax + 0x4e], rcx
movups xmm0, xmmword [0x1400833b8]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x1400833a8]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x140083398]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x140083388]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x140083378]
movups xmmword [rax], xmm0
mov word [rax + 0x56], 0
lea rcx, section..data
lea rdx, [rsp + 0x60]
call method.Logger.Debug_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x60], 1
je 0x140002072
mov rcx, qword [rsp + 0x70]
call sym..weak._ZdlPv.default.__clang_call_terminate
nop
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400020a5
xor ecx, ecx
call sym.exit
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
cmp edi, 1
jle 0x14000225f
lea r13d, [rdi - 1]
mov ebp, edi
mov r12d, 1
mov edi, 0xa
jmp 0x140002114
lea rax, [0x140083374]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
mov r8d, 1
lea rcx, [rsp + 0x40]
mov r9, rdx
call method.std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t___.__grow_by_and_replace_unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_long_long__wchar_t_con
inc r12
cmp rbp, r12
je 0x140002258
mov r14, qword [rsi + r12*8]
mov rcx, r14
call sym.wcslen
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
and rdx, 0xfffffffffffffffe
dec rdx
test byte [rsp + 0x40], 1
mov r15, rax
cmove rdx, rdi
test cl, 1
je 0x140002187
mov rbx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rbx
cmp rax, r15
jb 0x140002199
test r15, r15
je 0x1400021c7
lea rdi, [rsp + 0x42]
test cl, 1
je 0x140002164
mov rdi, qword [rsp + 0x50]
lea rcx, [rdi + rbx*2]
lea r8, [r15 + r15]
mov rdx, r14
call sym.memmove
add rbx, r15
test byte [rsp + 0x40], 1
jne 0x1400021d2
lea eax, [rbx + rbx]
mov byte [rsp + 0x40], al
jmp 0x1400021d7
mov ebx, ecx
shr ebx, 1
and ebx, 0x7f
mov rax, rdx
sub rax, rbx
cmp rax, r15
jae 0x140002150
mov r8, r15
sub r8, rdx
add r8, rbx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov r9, rbx
call method.std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t___.__grow_by_and_replace_unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_long_long__unsigned_long_long__wchar_t_con
cmp r12, r13
jae 0x140002108
jmp 0x1400021eb
mov qword [rsp + 0x48], rbx
mov word [rdi + rbx*2], 0
mov edi, 0xa
cmp r12, r13
jae 0x140002108
mov rcx, qword [rsp + 0x40]
mov rdx, rcx
and rdx, 0xfffffffffffffffe
dec rdx
test byte [rsp + 0x40], 1
cmove rdx, rdi
test cl, 1
je 0x14000220f
mov rax, qword [rsp + 0x48]
jmp 0x140002216
mov eax, ecx
shr eax, 1
and eax, 0x7f
cmp rdx, rax
je 0x1400020d2
lea rdx, [rsp + 0x42]
test cl, 1
je 0x14000222e
mov rdx, qword [rsp + 0x50]
mov word [rdx + rax*2], 0x20
lea rcx, [rax + 1]
test byte [rsp + 0x40], 1
jne 0x140002247
add cl, cl
mov byte [rsp + 0x40], cl
jmp 0x14000224c
mov qword [rsp + 0x48], rcx
mov word [rdx + rax*2 + 2], 0
jmp 0x140002108
test byte [rsp + 0x40], 1
jne 0x14000228a
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x60]
call sym.ExecuteWithAdminPrivileges_wchar_t__wchar_t_const_
test byte [rsp + 0x40], 1
je 0x14000209e
mov rcx, qword [rsp + 0x50]
call sym..weak._ZdlPv.default.__clang_call_terminate
xor ecx, ecx
call sym.exit
mov rdx, qword [rsp + 0x50]
jmp 0x140002264