Function at 0x14001a170
Capabilities:
Create thread
Get token membership
Terminate process

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor esi, esi
mov word [rbp - 0x4c], 0x500
lea rax, [rbp - 0x80]
mov dword [rbp - 0x40], esi
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x48], esi
mov r9d, 0x220
mov dword [rsp + 0x40], esi
lea r8d, [rsi + 0x20]
mov dword [rsp + 0x38], esi
mov dl, 2
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov dword [rbp - 0x50], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14001a200
mov rdx, qword [rbp - 0x80]
lea r8, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14001a1f6
mov dword [rbp - 0x40], esi
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x40], 1
je 0x14001a3b1
lea rdx, [rbp - 0x50]
call fcn.14001a8c0
mov r8, rax
lea rdx, [rsp + 0x60]
movzx ecx, byte [rax]
xor cl, 0x77
mov byte [rbp - 0x80], cl
movzx ecx, byte [rax + 1]
xor cl, 0x77
mov byte [rbp - 0x7f], cl
movzx ecx, byte [rax + 2]
xor cl, 0x77
mov byte [rbp - 0x7e], cl
movzx ecx, byte [rax + 3]
xor cl, 0x77
mov byte [rbp - 0x7d], cl
movzx ecx, byte [rax + 4]
movzx eax, byte [rax + 5]
xor cl, 0x77
xor al, 0x77
mov byte [rbp - 0x7c], cl
mov byte [rbp - 0x7b], al
movzx eax, byte [r8 + 6]
xor al, 0x77
mov byte [rbp - 0x7a], al
movzx eax, byte [r8 + 7]
xor al, 0x77
mov byte [rbp - 0x79], al
movzx eax, byte [r8 + 8]
movsd xmm0, qword [rbp - 0x80]
xor al, 0x77
movsd qword [r8], xmm0
mov byte [r8 + 8], al
call fcn.14001a880
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x77
mov byte [rbp - 0x80], cl
movzx ecx, byte [rax + 1]
xor cl, 0x77
mov byte [rbp - 0x7f], cl
movzx ecx, byte [rax + 2]
xor cl, 0x77
mov byte [rbp - 0x7e], cl
movzx ecx, byte [rax + 3]
xor cl, 0x77
mov byte [rbp - 0x7d], cl
movzx ecx, byte [rax + 4]
movzx eax, byte [rax + 5]
xor cl, 0x77
xor al, 0x77
mov byte [rbp - 0x7c], cl
mov byte [rbp - 0x7b], al
movzx eax, byte [rdx + 6]
xor al, 0x77
mov byte [rbp - 0x7a], al
movzx eax, byte [rdx + 7]
xor al, 0x77
mov byte [rbp - 0x79], al
movzx eax, byte [rdx + 8]
xor al, 0x77
mov byte [rbp - 0x78], al
movzx eax, byte [rdx + 9]
xor al, 0x77
mov byte [rbp - 0x77], al
movzx eax, byte [rdx + 0xa]
xor al, 0x77
mov byte [rbp - 0x76], al
movzx eax, byte [rdx + 0xb]
xor al, 0x77
mov byte [rbp - 0x75], al
movzx eax, byte [rdx + 0xc]
xor al, 0x77
mov byte [rbp - 0x74], al
movzx eax, byte [rdx + 0xd]
xor al, 0x77
mov byte [rbp - 0x73], al
movzx eax, byte [rdx + 0xe]
xor al, 0x77
mov byte [rbp - 0x72], al
movzx eax, byte [rdx + 0xf]
xor al, 0x77
xor r9d, r9d
mov byte [rbp - 0x71], al
xor ecx, ecx
movzx eax, byte [rdx + 0x10]
movups xmm0, xmmword [rbp - 0x80]
xor al, 0x77
mov byte [rbp - 0x70], al
movzx eax, byte [rdx + 0x11]
xor al, 0x77
mov byte [rbp - 0x6f], al
movzx eax, byte [rdx + 0x12]
xor al, 0x77
mov byte [rbp - 0x6e], al
movzx eax, byte [rdx + 0x13]
xor al, 0x77
mov byte [rbp - 0x6d], al
movzx eax, byte [rdx + 0x14]
xor al, 0x77
mov byte [rbp - 0x6c], al
movzx eax, byte [rdx + 0x15]
xor al, 0x77
mov byte [rbp - 0x6b], al
movzx eax, byte [rdx + 0x16]
xor al, 0x77
mov byte [rbp - 0x6a], al
movzx eax, byte [rdx + 0x17]
xor al, 0x77
mov byte [rbp - 0x69], al
movzx eax, byte [rdx + 0x18]
movsd xmm1, qword [rbp - 0x70]
xor al, 0x77
mov byte [rbp - 0x68], al
movzx eax, byte [rdx + 0x19]
xor al, 0x77
mov byte [rbp - 0x67], al
movzx eax, byte [rdx + 0x1a]
xor al, 0x77
mov byte [rbp - 0x66], al
movzx eax, byte [rdx + 0x1b]
xor al, 0x77
movups xmmword [rdx], xmm0
mov byte [rbp - 0x65], al
mov eax, dword [rbp - 0x68]
movsd qword [rdx + 0x10], xmm1
mov dword [rdx + 0x18], eax
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x300], rbx
mov qword [rsp + 0x308], rdi
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov qword [0x140081f18], rax
call qword [sym.imp.USER32.dll_GetWindowDC]
mov qword [0x140081f20], rax
call fcn.1400129d0
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001a4be
mov ecx, 0x32
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x14001a4b8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov r9d, 0x32
mov r8, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov word [rbx + 0x30], ax
lea edx, [r9 - 0x2f]
mov dword [rbx + 0x10], 0x1a
movups xmm0, xmmword [str.:DiaGuard.WTF]
movups xmmword [rbx + 0x14], xmm0
movsd xmm0, qword [0x140076300]
movsd qword [rbx + 0x24], xmm0
movzx eax, word [0x140076308]
mov word [rbx + 0x2c], ax
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov rcx, rbx
test eax, eax
jne 0x14001a765
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
int 0x29
mov ecx, 8
call fcn.140022228
lea rcx, [0x140013360]
mov r9, rax
lea r8, [0x14001e1b0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rdi, qword [rsp + 0x308]
mov rbx, qword [rsp + 0x300]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001a86f
cmp dword [rbp - 0x78], esi
je 0x14001a863
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001a863
xorps xmm0, xmm0
lea ecx, [rax + 8]
movdqa xmmword [rbp - 0x80], xmm0
call fcn.140022228
lea rcx, [0x1400138a0]
mov r9, rax
lea r8, [0x14001e1b0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001a854
cmp dword [rbp - 0x78], esi
je 0x14001a848
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001a848
xorps xmm0, xmm0
lea ecx, [rax + 8]
movdqa xmmword [rbp - 0x80], xmm0
call fcn.140022228
lea rcx, [0x1400141a0]
mov r9, rax
lea r8, [0x14001e1b0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001a839
cmp dword [rbp - 0x78], esi
je 0x14001a82d
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001a82d
xorps xmm0, xmm0
lea ecx, [rax + 8]
movdqa xmmword [rbp - 0x80], xmm0
call fcn.140022228
lea rcx, [0x1400145b0]
mov r9, rax
lea r8, [0x14001e1b0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001a81e
cmp dword [rbp - 0x78], esi
je 0x14001a812
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001a812
xorps xmm0, xmm0
lea ecx, [rax + 8]
movdqa xmmword [rbp - 0x80], xmm0
call fcn.140022228
lea rcx, [0x140019970]
mov r9, rax
lea r8, [0x14001e1b0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001a803
cmp dword [rbp - 0x78], esi
je 0x14001a7f7
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001a7f7
xorps xmm0, xmm0
lea ecx, [rax + 8]
movdqa xmmword [rbp - 0x80], xmm0
call fcn.140022228
lea rcx, [0x140019710]
mov r9, rax
lea r8, [0x14001e1b0]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001a7e8
cmp dword [rbp - 0x78], esi
je 0x14001a7dc
movaps xmm0, xmmword [rbp - 0x80]
lea rcx, [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001a7dc
call fcn.140014f10
call fcn.140013dc0
call fcn.140012b80
jmp 0x14001a754
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001a4be
mov r9d, 1
mov byte [rbp - 0x60], 1
lea r8, [rbp - 0x60]
mov rcx, rax
lea edx, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov rcx, rbx
test eax, eax
je 0x14001a4b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001a4c2
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x78], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x78], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x78], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x78], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x78], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x78], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3