Function at 0x1400c6034
Capabilities:
Acquire debug privileges
Get common file path
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4d0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov r14, rcx
lea rcx, [rsp + 0x3b1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x3b0], 0
call fcn.1400e1fc0
lea rcx, [rsp + 0x3b0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x3b0]
call fcn.1400e1d50
lea rcx, [rsp + 0x3b0]
mov r13d, 1
sub rcx, r13
cmp byte [rax + rcx], 0x5c
je 0x1400c60ca
lea rdx, [0x140111ca8]
lea rcx, [rsp + 0x3b0]
call fcn.1400e2d80
lea rdx, str.services.exe
lea rcx, [rsp + 0x3b0]
call fcn.1400e2d80
lea rcx, [rsp + 0x3b0]
call fcn.1400fd1f0
lea rdx, [0x140111c64]
lea rcx, [rsp + 0x3b0]
call fcn.1400e48a4
mov rdi, rax
test rax, rax
je 0x1400c61e6
mov rcx, rax
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
mov word [rsp + 0x158], ax
call fcn.1400c5f98
xor ebx, ebx
mov rcx, rdi
call fcn.1400c5f98
mov word [rsp + rbx*2 + 0x15c], ax
add rbx, r13
cmp rbx, 4
jl 0x1400c6185
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
xor ebx, ebx
mov rcx, rdi
call fcn.1400c5f98
mov word [rsp + rbx*2 + 0x168], ax
add rbx, r13
cmp rbx, 0xa
jl 0x1400c61b0
mov rcx, rdi
call fcn.1400c5ffc
cmp word [rsp + 0x158], 0x40
mov rcx, rdi
mov esi, eax
je 0x1400c6214
call fcn.1400e46f4
xor eax, eax
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1400e2890
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
xor r8d, r8d
mov edx, eax
call fcn.1400e45b8
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
cmp eax, 0x4550
jne 0x1400c61e1
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
mov word [rsp + 0x36], ax
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
mov word [rsp + 0x44], ax
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f90
mov rcx, rdi
call fcn.1400c5f90
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
mov dword [rsp + 0x58], eax
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c5f98
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
call fcn.1400c602c
xor ebx, ebx
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
mov dword [rsp + rbx*8 + 0xb8], eax
call fcn.1400c602c
mov dword [rsp + rbx*8 + 0xbc], eax
add rbx, r13
cmp rbx, 0x10
jl 0x1400c635d
movzx eax, word [rsp + 0x44]
xor r8d, r8d
mov rcx, rdi
lea edx, [rax + rsi + 0x18]
call fcn.1400e45b8
movzx ecx, word [rsp + 0x36]
mov eax, 0x28
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cfdfc
movzx r12d, word [rsp + 0x36]
mov rbp, rax
test r12d, r12d
jle 0x1400c6460
lea rbx, [rax + 0xc]
mov r13, r12
xor esi, esi
mov rcx, rdi
call fcn.1400c5f90
inc rsi
cmp rsi, 8
mov byte [rsi + rbx - 0xd], al
jl 0x1400c63d3
mov rcx, rdi
call fcn.1400c602c
mov rcx, rdi
mov dword [rbx - 4], eax
call fcn.1400c602c
mov rcx, rdi
mov dword [rbx], eax
call fcn.1400c602c
mov rcx, rdi
mov dword [rbx + 4], eax
call fcn.1400c602c
mov rcx, rdi
mov dword [rbx + 8], eax
call fcn.1400c602c
mov rcx, rdi
mov dword [rbx + 0xc], eax
call fcn.1400c602c
mov rcx, rdi
mov dword [rbx + 0x10], eax
call fcn.1400c5f98
mov rcx, rdi
mov word [rbx + 0x14], ax
call fcn.1400c5f98
mov rcx, rdi
mov word [rbx + 0x16], ax
call fcn.1400c602c
add rbx, 0x28
sub r13, 1
mov dword [rbx - 0x10], eax
jne 0x1400c63d1
mov r13d, 1
xor edx, edx
test r12d, r12d
jle 0x1400c648e
lea r8, [rbp + 0xc]
mov ecx, dword [r8]
cmp ecx, dword [rsp + 0x58]
ja 0x1400c6482
add ecx, dword [r8 + 4]
cmp ecx, dword [rsp + 0x58]
ja 0x1400c656d
add edx, r13d
add r8, 0x28
cmp edx, r12d
jl 0x1400c646b
mov esi, dword [rsp + 0x3a0]
mov rcx, rbp
call fcn.1400cfe04
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call fcn.1400e45b8
xor eax, eax
xor ebp, ebp
mov rcx, rdi
mov byte [rsp + 0x3a0], bpl
mov dword [rsp + 0x3a1], eax
call fcn.1400e4190
test eax, eax
jne 0x1400c61e6
mov r12d, 0xfffffffe
test ebp, ebp
jne 0x1400c65f9
mov rcx, rdi
add esi, r13d
call fcn.1400c5f90
cmp al, 0x8b
jne 0x1400c65e1
mov rcx, rdi
call fcn.1400c5f90
mov rcx, rdi
mov bl, al
call fcn.1400c5f90
add esi, 2
cmp bl, 0x48
jne 0x1400c65ce
cmp al, 0x10
jne 0x1400c65ce
lea r8d, [rbp + 0x31]
lea rcx, [rsp + 0x141]
xor edx, edx
mov byte [rsp + 0x140], bpl
call fcn.1400e1fc0
lea edx, [rsi - 0x1c]
xor r8d, r8d
mov rcx, rdi
call fcn.1400e45b8
lea r8d, [rbp + 0x1e]
lea rcx, [rsp + 0x140]
mov r9, rdi
mov rdx, r13
call fcn.1400e44e4
xor r11d, r11d
cmp byte [rsp + r11 + 0x140], 0xa1
je 0x1400c657d
add r11, r13
cmp r11, 0x19
jl 0x1400c6557
jmp 0x1400c65bc
movsxd rax, edx
lea rcx, [rax + rax*4]
mov esi, dword [rbp + rcx*8 + 0x14]
jmp 0x1400c6495
mov al, byte [rsp + r11 + 0x141]
mov ebp, r13d
mov byte [rsp + 0x3a0], al
mov al, byte [rsp + r11 + 0x142]
mov byte [rsp + 0x3a1], al
mov al, byte [rsp + r11 + 0x143]
mov byte [rsp + 0x3a2], al
mov al, byte [rsp + r11 + 0x144]
mov byte [rsp + 0x3a3], al
add esi, r12d
xor r8d, r8d
mov rcx, rdi
mov edx, esi
call fcn.1400e45b8
jmp 0x1400c65e1
mov r8d, r13d
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.1400e45b8
add esi, r12d
mov rcx, rdi
call fcn.1400e4190
test eax, eax
je 0x1400c64d3
test ebp, ebp
je 0x1400c61e6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x20]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x20]
lea rdx, str.SeDebugPrivilege
mov r8d, r13d
call fcn.1400c5f28
test eax, eax
je 0x1400c61e6
xor ebx, ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400c669a
and dword [rsp + 0x180], 0
lea rcx, [rsp + 0x184]
xor edx, edx
mov r8d, 0x210
call fcn.1400e1fc0
lea rdx, [rsp + 0x180]
mov ecx, ebx
call fcn.1400c6748
lea rcx, [rsp + 0x288]
call fcn.1400fd1f0
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x288]
call fcn.1400e1f00
test eax, eax
je 0x1400c66b7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, 4
cmp ebx, 0xffff
jae 0x1400c61e6
jmp 0x1400c6630
mov edx, dword [rsp + 0x3a0]
mov r8, r14
mov rcx, rdi
call fcn.1400c5db4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
jmp 0x1400c61e8