Function at 0x1400954f0
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
mov rax, qword [0x140303960]
xor rax, rsp
mov qword [rbp + 0x27], rax
cmp byte [0x1406c9eb9], 0
jne 0x14009575f
call fcn.1400953d0
xor edi, edi
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x140095592
lea rcx, [rax + 0x10]
mov r8d, edi
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x140095577
lea r9d, [rax + 2]
cmp edx, r9d
je 0x140095577
cmp edx, eax
je 0x14009557f
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x140095570
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x140095540
add eax, 5
cmp edx, eax
jne 0x140095585
xor dword [rcx], r9d
inc dword [r11]
jmp 0x140095540
lea eax, [r8 - 0x73]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x140095540
mov esi, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call fcn.140095340
mov r11, rax
cmp byte [rax + 9], dil
jne 0x140095630
mov r8d, edi
mov edx, dword [r11 + 4]
mov r9d, dword [r11]
lea ecx, [rdx + 1]
cmp r9d, ecx
jne 0x1400955ce
movsxd rax, r8d
inc dl
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x1400955b0
lea eax, [rdx + 2]
cmp r9d, eax
jne 0x1400955e6
movsxd rax, r8d
add dl, 2
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x1400955b0
cmp r9d, edx
je 0x14009561b
lea eax, [rdx + 4]
cmp r9d, eax
jne 0x140095603
movsxd rax, r8d
add dl, 3
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x1400955b0
lea eax, [rdx + 5]
cmp r9d, eax
jne 0x140095627
movsxd rax, r8d
add dl, 4
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x1400955b0
movsxd rcx, r8d
lea eax, [r8 - 0x73]
xor byte [rcx + r11 + 0xa], al
inc r8d
cmp r8d, 1
jb 0x1400955b0
mov byte [r11 + 9], 1
lea rbx, [r11 + 0xa]
call fcn.140094f40
mov r10, rax
cmp byte [rax + 9], dil
jne 0x1400956d0
mov r8d, edi
nop
mov edx, dword [r10 + 4]
mov r9d, dword [r10]
lea ecx, [rdx + 1]
cmp r9d, ecx
jne 0x14009566e
movsxd rax, r8d
inc dl
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x140095650
lea eax, [rdx + 2]
cmp r9d, eax
jne 0x140095686
movsxd rax, r8d
add dl, 2
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x140095650
cmp r9d, edx
je 0x1400956bb
lea eax, [rdx + 4]
cmp r9d, eax
jne 0x1400956a3
movsxd rax, r8d
add dl, 3
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x140095650
lea eax, [rdx + 5]
cmp r9d, eax
jne 0x1400956c7
movsxd rax, r8d
add dl, 4
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x140095650
movsxd rcx, r8d
lea eax, [r8 - 0x73]
xor byte [rcx + r10 + 0xa], al
inc r8d
cmp r8d, 0x1f
jb 0x140095650
lea rdx, [r10 + 0xa]
mov byte [r10 + 9], 1
mov r9d, esi
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140095460
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x14009574f
lea rcx, [rax + 0x10]
nop dword [rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x140095737
lea r8d, [rax + 2]
cmp edx, r8d
je 0x140095737
cmp edx, eax
je 0x14009573f
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x140095730
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x140095700
add eax, 5
cmp edx, eax
jne 0x140095744
xor dword [rcx], r8d
inc dword [r11]
jmp 0x140095700
lea eax, [rdi - 0x72]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x140095700
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14008df10
call fcn.14008e7e0
cmp byte [0x1406c9eb8], 0
je 0x1400957ff
cmp byte [0x1406c9dfa], 0
jne 0x140095c1d
call fcn.140095c30
mov r11, rax
cmp byte [rax + 0xc], 0
jne 0x1400957ef
lea rcx, [rax + 0x10]
xor edi, edi
nop word [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x1400957d7
lea r8d, [rax + 2]
cmp edx, r8d
je 0x1400957d7
cmp edx, eax
je 0x1400957df
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x1400957d0
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x1400957a0
add eax, 5
cmp edx, eax
jne 0x1400957e4
xor dword [rcx], r8d
inc dword [r11]
jmp 0x1400957a0
lea eax, [rdi - 0x72]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x1400957a0
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1406c72b8]
test rcx, rcx
jne 0x140095812
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
mov rax, qword [rcx]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xa0], r15
call qword [rax + reloc.WS2_32.dll_recv]
movabs rax, 0x2396764023922521
lea rcx, [rbp - 0x19]
mov qword [rbp - 0x19], rax
movabs r12, 0xa26b88dd1edff28c
mov qword [rbp - 0x11], r12
movabs r13, 0x239676345bf7510f
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 7], r13
mov qword [rbp + 0xf], r12
pxor xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
call fcn.1400933f0
xor edi, edi
xor r15b, r15b
mov qword [rbp - 0x19], rdi
mov dword [rbp - 0x29], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x19]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400959a2
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400959a2
mov r9d, dword [rbp - 0x29]
lea rax, [rbp - 0x29]
mov rcx, qword [rbp - 0x19]
lea edx, [rdi + 1]
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140095999
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140095999
mov rcx, qword [rbx]
mov qword [rsp + 0xe0], r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea r14d, [rax + 0x14]
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140095991
lea r8d, [rdi + 2]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x140095988
mov r9, qword [rbx]
lea edx, [rdi + 2]
mov r8d, 0x101001
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x140095988
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x30], rdi
lea edx, [rdi + 6]
mov rcx, rax
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 4]
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
sete r15b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0xe0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400959b1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
mov r15, qword [rsp + 0xa0]
jne 0x140095a4f
cmp byte [0x1406c9dfa], dil
jne 0x140095c17
call fcn.140095cc0
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x140095a3f
lea rcx, [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x140095a27
lea r8d, [rax + 2]
cmp edx, r8d
je 0x140095a27
cmp edx, eax
je 0x140095a2f
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x140095a20
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x1400959f0
add eax, 5
cmp edx, eax
jne 0x140095a34
xor dword [rcx], r8d
inc dword [r11]
jmp 0x1400959f0
lea eax, [rdi - 0x71]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x1400959f0
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x1406c9e90]
test rax, rax
jne 0x140095b6b
movabs rcx, 0x99394f3a7e00c241
mov qword [rbp + 7], r13
mov qword [rbp - 9], rcx
movabs rax, 0x5bee0e0b238f2977
mov qword [rbp - 0x19], rax
movabs rax, 0xda13f0e221e0cdf4
mov qword [rbp - 0x11], rax
movabs rax, 0x9c81b07390d1d036
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp - 1], rax
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x17], rcx
xor ecx, ecx
mov qword [rbp + 0xf], r12
pxor xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x1f], rax
xor eax, eax
pxor xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm1
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, Ordinal_26
lea r8, [rbp + 7]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov ebx, dword [rbp + 0xf]
mov r9d, edi
test ebx, ebx
je 0x140095b5d
mov r10, qword [rbp - 0x19]
mov r11, qword [rbp + 7]
nop dword [rax + rax]
lea rdx, [0x1402e1700]
test r10b, r10b
je 0x140095b4d
lea r8, [rbp - 0x19]
mov eax, r9d
sub rax, r8
lea rcx, [rbp - 0x19]
lea r8, [rax + r11]
movzx eax, r10b
cmp al, 0x78
jne 0x140095b3f
movzx eax, byte [rdx]
cmp byte [rcx + r8], al
jne 0x140095b55
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x140095b32
mov eax, r9d
add rax, r11
jmp 0x140095b60
inc r9d
cmp r9d, ebx
jb 0x140095b10
mov rax, rdi
add rax, 0xfffffffffffffffb
mov qword [0x1406c9e90], rax
cmp byte [rax], 0xe9
jne 0x140095bef
cmp byte [0x1406c9dfa], dil
jne 0x140095c17
call fcn.140095d50
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x140095bdf
lea rcx, [rax + 0x10]
nop
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x140095bc7
lea r8d, [rax + 2]
cmp edx, r8d
je 0x140095bc7
cmp edx, eax
je 0x140095bcf
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x140095bc0
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x140095b90
add eax, 5
cmp edx, eax
jne 0x140095bd4
xor dword [rcx], r8d
inc dword [r11]
jmp 0x140095b90
lea eax, [rdi - 0x71]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x140095b90
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402376c0
add rsp, 0xa8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14008ebd0
int3
call fcn.14008ebd0
int3