Function at 0x140003050
Capabilities:
Acquire debug privileges
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1400030c0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004eb0
nop
mov r8d, 0xc
lea rdx, str.edg3162.tmp
lea rcx, [rsp + 0x40]
call fcn.1400047b0
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x14000a9a8]
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x30], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x78], rax
mov byte [rbp - 0xc], 0
mov byte [rbp - 0x17], 0
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 8], rbx
mov rax, qword [0x1400df118]
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x20], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140004170
mov r8d, 0xd0600
lea rdx, [0x14000e0e0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x78]
call fcn.1400046f0
test rax, rax
jne 0x1400031ef
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140003463
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140003463
mov dword [rsp + 0x60], 1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x6c], 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9d, 0x10
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140003463
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000328a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002370
test al, al
jne 0x14000330c
lea rcx, [rsp + 0x70]
call fcn.1400034c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400032db
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034ae
call fcn.140005b40
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140005b20
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140002970
nop
test al, al
je 0x140003293
call fcn.140002c00
test al, al
je 0x140003293
xor edx, edx
lea rcx, str.UnityWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call fcn.140002ee0
mov rdi, rax
lea rdx, [0x14000a83c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov r9d, ebx
mov r8, rdi
mov rdx, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov r15, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8899
mov ecx, ebx
call qword [sym.imp.USER32.dll_PostThreadMessageW]
call fcn.140002ee0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rdi, rdi
je 0x1400033b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1400033be
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x1400033cc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400033d9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400033e7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400df128]
test rcx, rcx
je 0x1400033f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400df150]
test rcx, rcx
je 0x14000340b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003426
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003441
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, str.DarkNight
lea rdx, str.Injected
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0x70]
call fcn.1400034c0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400032db
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3