Function at 0x140095a00
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400ba040]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov ebx, edi
mov qword [rbp - 9], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 9]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140095a78
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0x17]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x1f]
mov dword [rbp + 0x17], 4
mov edx, 0x14
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp + 0x1f]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140095a87
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140095ca5
mov ecx, 8
call fcn.140098ef0
lea rcx, [0x1400951b0]
mov r9, rax
lea r8, [0x140096030]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 7], rax
test rax, rax
je 0x140095c96
cmp dword [rbp + 0xf], edi
je 0x140095c8a
movaps xmm0, xmmword [rbp + 7]
lea rcx, [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140095c8a
xorps xmm0, xmm0
mov ecx, 8
movdqa xmmword [rbp + 7], xmm0
call fcn.140098ef0
lea rcx, [0x140094530]
mov r9, rax
lea r8, [0x140096030]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x2f]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x27], rax
test rax, rax
je 0x140095c7b
cmp dword [rbp + 0x2f], edi
je 0x140095c8a
movaps xmm0, xmmword [rbp + 0x27]
lea rcx, [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140095c8a
xorps xmm0, xmm0
mov ecx, 8
movdqa xmmword [rbp + 0x27], xmm0
call fcn.140098ef0
lea rcx, [0x140008360]
mov r9, rax
lea r8, [0x140096030]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x3f]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x37], rax
test rax, rax
je 0x140095c6c
cmp dword [rbp + 0x3f], edi
je 0x140095c8a
movaps xmm0, xmmword [rbp + 0x37]
lea rcx, [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140095c8a
cmp byte [0x14022eae0], dil
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x37], xmm0
jne 0x140095c4f
mov qword [rsp + 0xa0], rsi
movabs rbx, 0x7fffffffc46535ff
mov esi, 0xff
movabs rdi, 0x7fffffffffffffff
lea rcx, [rbp + 0x1f]
call fcn.1400056c0
mov rax, qword [rbp + 0x1f]
mov qword [rbp - 9], rax
cmp rax, rbx
je 0x140095c31
mov ecx, 1
cmovl ecx, esi
test cl, cl
jns 0x140095c31
add rax, 0x3b9aca00
mov qword [rbp - 9], rax
jmp 0x140095c35
mov qword [rbp - 9], rdi
lea rcx, [rbp - 9]
call fcn.14000b8f0
cmp byte [0x14022eae0], 0
je 0x140095c03
mov rsi, qword [rsp + 0xa0]
cmp dword [rbp + 0x3f], 0
jne 0x140095c65
cmp dword [rbp + 0x2f], 0
jne 0x140095c65
cmp dword [rbp + 0xf], 0
je 0x140095d79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp + 0x3f], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x2f], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0xf], edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movabs rdx, 0x1b336eaf113ac105
lea r8, [rbp + 7]
movabs rcx, 0x111a66ce1d12eea6
movabs rax, 0x7a4402ce634eb244
mov qword [rbp - 9], rax
xor r9d, r9d
mov rax, qword [rbp - 9]
mov qword [rbp + 7], rax
movabs rax, 0x111a66ce1d128bd4
mov qword [rbp - 9], rax
mov rax, qword [rbp - 9]
mov qword [rbp + 0xf], rax
mov qword [rbp - 9], rdx
mov rax, qword [rbp - 9]
mov qword [rbp + 0x27], rax
mov qword [rbp - 9], rcx
mov rax, qword [rbp - 9]
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x2f], rax
movabs rax, 0x7a131dce3154b477
xorps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp + 7], xmm0
mov qword [rbp - 9], rax
mov rax, qword [rbp - 9]
mov qword [rbp + 0x27], rax
movabs rax, 0x111a66ce737b83c2
mov qword [rbp - 9], rax
mov rax, qword [rbp - 9]
mov qword [rbp + 0x2f], rax
mov qword [rbp - 9], rdx
lea rdx, [rbp + 0x27]
mov rax, qword [rbp - 9]
mov qword [rbp + 0x37], rax
mov qword [rbp - 9], rcx
xor ecx, ecx
mov rax, qword [rbp - 9]
movdqa xmm0, xmmword [rbp + 0x27]
mov qword [rbp + 0x3f], rax
xorps xmm0, xmmword [rbp + 0x37]
movdqa xmmword [rbp + 0x27], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140098d20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret