Function at 0x180035630
Capabilities:
Check os version

Disassembly:
push rsi
push rdi
sub rsp, 0x368
mov qword [rsp + 0x2a8], rcx
mov ecx, 0x28
call sym.PackageCreate
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x2a8]
call sym.ParserGetInt32
mov dword [rsp + 0x29c], eax
mov rcx, qword [rsp + 0x2a0]
mov edx, dword [rsp + 0x29c]
call sym.PackageAddInt32
mov eax, dword [rsp + 0x29c]
mov dword [rsp + 0x6c], eax
movabs rax, 0xac2e9f0dc6832086
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
movabs rcx, 0x82313f28c2c1cd43
sub rax, rcx
je 0x18003723e
jmp 0x1800356b4
mov rax, qword [rsp + 0x58]
movabs rcx, 0x83ca7c9dbc587318
sub rax, rcx
je 0x180037428
jmp 0x1800356ce
mov rax, qword [rsp + 0x58]
movabs rcx, 0x8574cfb74487bd2f
sub rax, rcx
je 0x180036468
jmp 0x1800356e8
mov rax, qword [rsp + 0x58]
movabs rcx, 0x8cc54efd98395171
sub rax, rcx
je 0x1800361ea
jmp 0x180035702
mov rax, qword [rsp + 0x58]
movabs rcx, 0x958aeca5a0a9e5ac
sub rax, rcx
je 0x18003791a
jmp 0x18003571c
mov rax, qword [rsp + 0x58]
movabs rcx, 0x974ec88f0720b69c
sub rax, rcx
je 0x18003778c
jmp 0x180035736
mov rax, qword [rsp + 0x58]
movabs rcx, 0x97b266e61efc31a1
sub rax, rcx
je 0x180036de2
jmp 0x180035750
mov rax, qword [rsp + 0x58]
movabs rcx, 0x9b7b576e49ddf98a
sub rax, rcx
je 0x1800361c3
jmp 0x18003576a
mov rax, qword [rsp + 0x58]
movabs rcx, 0x9cca0143c4bacb98
sub rax, rcx
je 0x180037500
jmp 0x180035784
mov rax, qword [rsp + 0x58]
movabs rcx, 0x9f38ecded7473913
sub rax, rcx
je 0x1800366d2
jmp 0x18003579e
mov rax, qword [rsp + 0x58]
movabs rcx, 0xa07cd477735d0777
sub rax, rcx
je 0x1800364bb
jmp 0x1800357b8
mov rax, qword [rsp + 0x58]
movabs rcx, 0xa31e1ce8f20439fe
sub rax, rcx
je 0x180036ad1
jmp 0x1800357d2
mov rax, qword [rsp + 0x58]
movabs rcx, 0xa3717d35efc56199
sub rax, rcx
je 0x180036b0d
jmp 0x1800357ec
mov rax, qword [rsp + 0x58]
movabs rcx, 0xa69797c68966500b
sub rax, rcx
je 0x18003619c
jmp 0x180035806
mov rax, qword [rsp + 0x58]
movabs rcx, 0xa9b3f056daef8f45
sub rax, rcx
je 0x18003749a
jmp 0x180035820
mov rax, qword [rsp + 0x58]
movabs rcx, 0xac2e9f0dc6832086
sub rax, rcx
je 0x1800360c5
jmp 0x18003583a
mov rax, qword [rsp + 0x58]
movabs rcx, 0xad422aaae985f367
sub rax, rcx
je 0x180037177
jmp 0x180035854
mov rax, qword [rsp + 0x58]
movabs rcx, 0xad47c86035e85a55
sub rax, rcx
je 0x180036211
jmp 0x18003586e
mov rax, qword [rsp + 0x58]
movabs rcx, 0xaea78a361c73c00f
sub rax, rcx
je 0x1800363a1
jmp 0x180035888
mov rax, qword [rsp + 0x58]
movabs rcx, 0xaf5516eb1db12205
sub rax, rcx
je 0x18003714f
jmp 0x1800358a2
mov rax, qword [rsp + 0x58]
movabs rcx, 0xb0648a68d909b2fb
sub rax, rcx
je 0x180036286
jmp 0x1800358bc
mov rax, qword [rsp + 0x58]
movabs rcx, 0xb1c8ad495ff0301f
sub rax, rcx
je 0x1800367d8
jmp 0x1800358d6
mov rax, qword [rsp + 0x58]
movabs rcx, 0xb6e962329aebd888
sub rax, rcx
je 0x180037628
jmp 0x1800358f0
mov rax, qword [rsp + 0x58]
movabs rcx, 0xb88f0e0d8f3935bc
sub rax, rcx
je 0x1800367b0
jmp 0x18003590a
mov rax, qword [rsp + 0x58]
movabs rcx, 0xb9d06c955ed30321
sub rax, rcx
je 0x1800369a9
jmp 0x180035924
mov rax, qword [rsp + 0x58]
movabs rcx, 0xbe571020d7670016
sub rax, rcx
je 0x180036789
jmp 0x18003593e
mov rax, qword [rsp + 0x58]
movabs rcx, 0xc0a3eb2a1f0f538e
sub rax, rcx
je 0x180036df6
jmp 0x180035958
mov rax, qword [rsp + 0x58]
movabs rcx, 0xc1baf7a3f5a66e08
sub rax, rcx
je 0x180036750
jmp 0x180035972
mov rax, qword [rsp + 0x58]
movabs rcx, 0xc52494dbbf4b3305
sub rax, rcx
je 0x1800378da
jmp 0x18003598c
mov rax, qword [rsp + 0x58]
movabs rcx, 0xc73c4fd2f2393330
sub rax, rcx
je 0x18003743c
jmp 0x1800359a6
mov rax, qword [rsp + 0x58]
movabs rcx, 0xc8d6c5e544cc6bee
sub rax, rcx
je 0x180036e5a
jmp 0x1800359c0
mov rax, qword [rsp + 0x58]
movabs rcx, 0xca255777f1e4478e
sub rax, rcx
je 0x180037658
jmp 0x1800359da
mov rax, qword [rsp + 0x58]
movabs rcx, 0xca8fa654b900e36d
sub rax, rcx
je 0x180037909
jmp 0x1800359f4
mov rax, qword [rsp + 0x58]
movabs rcx, 0xce57d8a8ac1f9f70
sub rax, rcx
je 0x180037163
jmp 0x180035a0e
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd19eefe76a5d3b95
sub rax, rcx
je 0x18003783d
jmp 0x180035a28
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd261e632af9b0220
sub rax, rcx
je 0x1800377fe
jmp 0x180035a42
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd2f3743e592de8eb
sub rax, rcx
je 0x180037349
jmp 0x180035a5c
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd30a9fb0040735da
sub rax, rcx
je 0x180036c56
jmp 0x180035a76
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd4d355730f4215e8
sub rax, rcx
je 0x1800364a7
jmp 0x180035a90
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd511ddb19a2862c0
sub rax, rcx
je 0x1800377bf
jmp 0x180035aaa
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd85d2a7d431d9800
sub rax, rcx
je 0x180036948
jmp 0x180035ac4
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd932f7dcf54283ed
sub rax, rcx
je 0x180036a10
jmp 0x180035ade
mov rax, qword [rsp + 0x58]
movabs rcx, 0xe7991addf17c2288
sub rax, rcx
je 0x180037388
jmp 0x180035af8
mov rax, qword [rsp + 0x58]
movabs rcx, 0xe9276764e80ab2c7
sub rax, rcx
je 0x180036d66
jmp 0x180035b12
mov rax, qword [rsp + 0x58]
movabs rcx, 0xe9ee4eb50991c461
sub rax, rcx
je 0x180036aac
jmp 0x180035b2c
mov rax, qword [rsp + 0x58]
movabs rcx, 0xec44f7653ae0837e
sub rax, rcx
je 0x180037486
jmp 0x180035b46
mov rax, qword [rsp + 0x58]
movabs rcx, 0xec71adaca1e9f5a8
sub rax, rcx
je 0x180036af9
jmp 0x180035b60
mov rax, qword [rsp + 0x58]
movabs rcx, 0xf1206271628f4de1
sub rax, rcx
je 0x1800374c9
jmp 0x180035b7a
mov rax, qword [rsp + 0x58]
movabs rcx, 0xf122cfa0a8cc8776
sub rax, rcx
je 0x1800372ae
jmp 0x180035b94
mov rax, qword [rsp + 0x58]
movabs rcx, 0xf3787a8477448a07
sub rax, rcx
je 0x1800362f9
jmp 0x180035bae
mov rax, qword [rsp + 0x58]
movabs rcx, 0xf5c400705fd2e544
sub rax, rcx
je 0x180036188
jmp 0x180035bc8
mov rax, qword [rsp + 0x58]
movabs rcx, 0xf9e8d68fb417c40a
sub rax, rcx
je 0x180036bbd
jmp 0x180035be2
mov rax, qword [rsp + 0x58]
movabs rcx, 0x33609b5c94cc772
sub rax, rcx
je 0x180036da4
jmp 0x180035bfc
mov rax, qword [rsp + 0x58]
movabs rcx, 0x5001628968e02b8
sub rax, rcx
je 0x180036535
jmp 0x180035c16
mov rax, qword [rsp + 0x58]
movabs rcx, 0x9a375bcc6e966c3
sub rax, rcx
je 0x180036ba9
jmp 0x180035c30
mov rax, qword [rsp + 0x58]
movabs rcx, 0xa6f3e7374435b32
sub rax, rcx
je 0x180037614
jmp 0x180035c4a
mov rax, qword [rsp + 0x58]
movabs rcx, 0xd53c0b15a603d7b
sub rax, rcx
je 0x180037271
jmp 0x180035c64
mov rax, qword [rsp + 0x58]
movabs rcx, 0xda016732e441719
sub rax, rcx
je 0x180036d7a
jmp 0x180035c7e
mov rax, qword [rsp + 0x58]
movabs rcx, 0xdacbc9989169a07
sub rax, rcx
je 0x18003757a
jmp 0x180035c98
mov rax, qword [rsp + 0x58]
movabs rcx, 0x196e9b53a4db18ba
sub rax, rcx
je 0x180036ae5
jmp 0x180035cb2
mov rax, qword [rsp + 0x58]
movabs rcx, 0x19dcedf8cd631f8e
sub rax, rcx
je 0x18003625f
jmp 0x180035ccc
mov rax, qword [rsp + 0x58]
movabs rcx, 0x1af14db46cb26ce8
sub rax, rcx
je 0x180036238
jmp 0x180035ce6
mov rax, qword [rsp + 0x58]
movabs rcx, 0x1ebced2549cb3e98
sub rax, rcx
je 0x180036883
jmp 0x180035d00
mov rax, qword [rsp + 0x58]
movabs rcx, 0x2239571040611a5c
sub rax, rcx
je 0x180037374
jmp 0x180035d1a
mov rax, qword [rsp + 0x58]
movabs rcx, 0x237fee04810f6c1a
sub rax, rcx
je 0x1800372dd
movabs rax, 0x41ddc78c96a8ddce
movabs rcx, 0x9b7b576e49ddf98a
cmp dword [rsp + 0x6c], 6
cmovl rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xc73c4fd2f2393330
movabs rcx, 0xad422aaae985f367
cmp dword [rsp + 0x6c], 7
cmovl rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x8cc54efd98395171
movabs rcx, 0x1af14db46cb26ce8
cmp dword [rsp + 0x6c], 3
cmovl rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xad47c86035e85a55
movabs rcx, 0x790dc4c073974936
cmp dword [rsp + 0x6c], 4
cmovl rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xd30a9fb0040735da
movabs rcx, 0x614c37bf299ca4c2
cmp dword [rsp + 0x6c], 5
cmovl rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xaea78a361c73c00f
movabs rcx, 0x19dcedf8cd631f8e
cmp dword [rsp + 0x6c], 2
cmovl rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xb0648a68d909b2fb
movabs rcx, 0x2938228d6370c25c
cmp dword [rsp + 0x6c], 1
cmove rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x290]
call sym.ImpersonateTokenInStore
mov rcx, qword [rsp + 0x50]
mov edx, eax
call sym.PackageAddInt32
mov rcx, qword [rsp + 0x2a0]
mov rax, qword [rsp + 0x290]
mov rdx, qword [rax + 8]
call sym.PackageAddString
movabs rax, 0x4185484518bab7d3
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov dword [rsp + 0x28c], 0
mov qword [rsp + 0x280], 0
mov qword [rsp + 0x278], 0
lea rcx, [rsp + 0x268]
xor edx, edx
mov r8d, 0x10
call sym.memset
mov dword [rsp + 0x264], 0
mov rcx, qword [rsp + 0x2a8]
call sym.ParserGetInt32
mov dword [rsp + 0x28c], eax
mov rcx, qword [rsp + 0x2a8]
call sym.ParserGetInt32
cdqe
mov qword [rsp + 0x280], rax
mov ecx, dword [rsp + 0x28c]
mov rdx, qword [rsp + 0x280]
call sym.TokenSteal
mov rdx, rax
mov qword [rsp + 0x278], rdx
movabs rax, 0x556631bf7b1bbf52
movabs rcx, 0x8574cfb74487bd2f
cmp rdx, 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x278]
lea rdx, [rsp + 0x268]
xor r8d, r8d
call sym.TokenQueryOwner
mov edx, eax
movabs rax, 0xd4d355730f4215e8
movabs rcx, 0xa07cd477735d0777
cmp edx, 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xca8fa654b900e36d
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x268]
mov r9d, dword [rsp + 0x28c]
mov r8d, 1
xor eax, eax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sym.TokenAdd
mov dword [rsp + 0x264], eax
mov ecx, dword [rsp + 0x264]
call sym.ImpersonateTokenFromVault
mov edx, eax
movabs rax, 0x5001628968e02b8
movabs rcx, 0x379e531c1c17050e
cmp edx, 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xca8fa654b900e36d
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x90e]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x258]
cmp rax, qword [rcx]
sete al
and al, 1
mov byte [rsp + 0x7b], al
mov al, byte [rsp + 0x7b]
and al, 1
mov byte [rsp + 0x6b], al
movabs rax, 0x5e7147ee088e05f7
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xb1c8ad495ff0301f
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov dl, 1
movabs rax, 0xb88f0e0d8f3935bc
movabs rcx, 0x78fb1da444547fe8
test dl, 1
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xb1c8ad495ff0301f
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
call sym.TokenCurrentHandle
mov qword [rsp + 0x238], rax
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x560]
mov rcx, qword [rsp + 0x238]
mov r8, qword [rsp + 0x248]
mov edx, 3
xor r9d, r9d
lea r10, [rsp + 0x244]
mov qword [rsp + 0x20], r10
call rax
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x3a0]
mov ecx, dword [rsp + 0x244]
add ecx, 1
mov ecx, ecx
mov edx, ecx
shl rdx, 4
mov ecx, 0x40
call rax
mov qword [rsp + 0x248], rax
lea rcx, [rsp + 0x120]
xor edx, edx
mov r8d, 0x104
call sym.memset
movabs rax, 0x64945d5235c33cd5
movabs rcx, 0xd85d2a7d431d9800
cmp qword [rsp + 0x248], 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x560]
mov rcx, qword [rsp + 0x238]
mov r8, qword [rsp + 0x248]
mov r9d, dword [rsp + 0x244]
mov edx, 3
lea r10, [rsp + 0x244]
mov qword [rsp + 0x20], r10
call rax
mov edx, eax
movabs rax, 0xb9d06c955ed30321
movabs rcx, 0x2b4bb315155fd252
cmp edx, 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x196e9b53a4db18ba
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov dword [rsp + 0x240], 0x104
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x638]
mov rdx, qword [rsp + 0x248]
add rdx, 4
movsxd rcx, dword [rsp + 0x11c]
imul rcx, rcx, 0xc
add rdx, rcx
lea r8, [rsp + 0x120]
xor ecx, ecx
lea r9, [rsp + 0x240]
call rax
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rsp + 0x120]
call sym.PackageAddString
mov rcx, qword [rsp + 0x2a0]
mov rax, qword [rsp + 0x248]
add rax, 4
movsxd rdx, dword [rsp + 0x11c]
imul rdx, rdx, 0xc
add rax, rdx
mov edx, dword [rax + 8]
call sym.PackageAddInt32
movabs rax, 0xe9ee4eb50991c461
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov eax, dword [rsp + 0x11c]
add eax, 1
mov dword [rsp + 0x11c], eax
movabs rax, 0x7414035da05fb450
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x196e9b53a4db18ba
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xec71adaca1e9f5a8
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x2be58388e8d2db43
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x2a8]
lea rdx, [rsp + 0x22c]
call sym.ParserGetString
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x230]
mov edx, 1
call sym.TokenSetPrivilege
mov rcx, qword [rsp + 0x48]
mov edx, eax
call sym.PackageAddInt32
mov rcx, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x230]
call sym.PackageAddString
movabs rax, 0x2be58388e8d2db43
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x6e8d321e187cc705
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x308], rax
mov byte [rsp + 0x307], 0
mov qword [rsp + 0x2f8], 0x10
mov rdi, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x2f8]
mov al, byte [rsp + 0x307]
rep stosb byte [rdi], al
mov qword [rsp + 0x308], rdi
mov qword [rsp + 0x2f8], rcx
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x3a8]
mov rcx, qword [rsp + 0x248]
call rax
mov qword [rsp + 0x248], 0
movabs rax, 0x6e8d321e187cc705
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov dword [rsp + 0x118], 0
mov dword [rsp + 0x114], 0
mov dword [rsp + 0x110], 0
mov rcx, qword [rsp + 0x2a8]
lea rdx, [rsp + 0x110]
call sym.ParserGetWString
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x2a8]
lea rdx, [rsp + 0x118]
call sym.ParserGetWString
mov qword [rsp + 0x100], rax
mov rcx, qword [rsp + 0x2a8]
lea rdx, [rsp + 0x114]
call sym.ParserGetWString
mov qword [rsp + 0xf8], rax
mov ax, word [0x18007003b]
mov word [rsp + 0xf6], ax
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xc8], 0
mov eax, dword [rsp + 0x118]
add eax, dword [rsp + 0x110]
add eax, 1
mov dword [rsp + 0xc4], eax
mov dword [rsp + 0xc0], 0
movabs rax, 0xe9276764e80ab2c7
movabs rcx, 0xda016732e441719
cmp dword [rsp + 0x118], 0
cmova rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xce57d8a8ac1f9f70
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x33609b5c94cc772
movabs rcx, 0x4ad4ed92854152e7
cmp dword [rsp + 0x114], 0
cmova rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xce57d8a8ac1f9f70
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xce57d8a8ac1f9f70
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x108]
call sym.TokenMake
mov qword [rsp + 0xe8], rax
movabs rax, 0x716bcaf3f13b24e6
movabs rcx, 0xc8d6c5e544cc6bee
cmp qword [rsp + 0xe8], 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x3a0]
mov ecx, dword [rsp + 0xc4]
mov edx, ecx
mov ecx, 0x40
call rax
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xe0]
mov eax, dword [rsp + 0xc4]
mov qword [rsp + 0x2f0], rcx
mov byte [rsp + 0x2ef], 0
mov qword [rsp + 0x2e0], rax
mov rdi, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x2e0]
mov al, byte [rsp + 0x2ef]
rep stosb byte [rdi], al
mov qword [rsp + 0x2f0], rdi
mov qword [rsp + 0x2e0], rcx
mov rcx, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0x108]
call sym.StringConcatW
mov rcx, qword [rsp + 0xe0]
lea rdx, [rsp + 0xf6]
call sym.StringConcatW
mov rcx, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0x100]
call sym.StringConcatW
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x3a0]
mov ecx, dword [rsp + 0x118]
mov edx, ecx
mov ecx, 0x40
call rax
mov qword [rsp + 0xd8], rax
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x3a0]
mov ecx, dword [rsp + 0x114]
mov edx, ecx
mov ecx, 0x40
call rax
mov qword [rsp + 0xd0], rax
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x3a0]
mov ecx, dword [rsp + 0x110]
mov edx, ecx
mov ecx, 0x40
call rax
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x100]
mov eax, dword [rsp + 0x118]
mov qword [rsp + 0x350], rdx
mov qword [rsp + 0x348], rcx
mov qword [rsp + 0x340], rax
mov rdi, qword [rsp + 0x350]
mov rsi, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x340]
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x350], rdi
mov qword [rsp + 0x348], rsi
mov qword [rsp + 0x340], rcx
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xf8]
mov eax, dword [rsp + 0x114]
mov qword [rsp + 0x338], rdx
mov qword [rsp + 0x330], rcx
mov qword [rsp + 0x328], rax
mov rdi, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x328]
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x338], rdi
mov qword [rsp + 0x330], rsi
mov qword [rsp + 0x328], rcx
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x108]
mov eax, dword [rsp + 0x110]
mov qword [rsp + 0x320], rdx
mov qword [rsp + 0x318], rcx
mov qword [rsp + 0x310], rax
mov rdi, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x318]
mov rcx, qword [rsp + 0x310]
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x320], rdi
mov qword [rsp + 0x318], rsi
mov qword [rsp + 0x310], rcx
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
mov dword [rsp + 0x364], 0x30
mov eax, dword [rsp + 0x364]
mov rax, qword gs:[rax]
mov qword [rsp + 0x358], rax
mov rax, qword [rsp + 0x358]
mov rax, qword [rax + 0x40]
mov r9d, eax
mov r11, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xd0]
mov r8d, 2
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], rax
call sym.TokenAdd
mov dword [rsp + 0xc0], eax
mov ecx, dword [rsp + 0xc0]
call sym.ImpersonateTokenFromVault
mov rcx, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0xe0]
call sym.PackageAddWString
movabs rax, 0xaf5516eb1db12205
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xce57d8a8ac1f9f70
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x10
call sym.memset
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xa4], 0
call sym.TokenCurrentHandle
mov rdx, rax
mov qword [rsp + 0xa8], rdx
movabs rax, 0xf122cfa0a8cc8776
movabs rcx, 0x4fbe5dec3226b1fb
cmp rdx, 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0xb0]
mov eax, dword [rsp + 0xb8]
mov r8d, eax
call sym.PackageAddBytes
movabs rax, 0x6704d1b6b6f80256
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x2a0]
xor eax, eax
mov r8d, eax
mov rdx, r8
call sym.PackageAddBytes
movabs rax, 0x6704d1b6b6f80256
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x8da]
mov edx, dword [rax + 0x68]
mov ecx, 1
call sym.PackageTransmitError
movabs rax, 0x237fee04810f6c1a
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x2239571040611a5c
movabs rcx, 0xe7991addf17c2288
cmp qword [rsp + 0xb0], 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x83ca7c9dbc587318
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0xb0]
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x2d8], rcx
mov byte [rsp + 0x2d7], 0
mov qword [rsp + 0x2c8], rax
mov rdi, qword [rsp + 0x2d8]
mov rcx, qword [rsp + 0x2c8]
mov al, byte [rsp + 0x2d7]
rep stosb byte [rdi], al
mov qword [rsp + 0x2d8], rdi
mov qword [rsp + 0x2c8], rcx
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x148]
mov rcx, qword [0x180070030]
mov rcx, qword [rcx + 0x8da]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
mov r8, qword [rsp + 0xb0]
xor edx, edx
call rax
mov qword [rsp + 0xb0], 0
movabs rax, 0x83ca7c9dbc587318
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
call sym.TokenRevSelf
mov dword [rsp + 0xa0], eax
mov rcx, qword [rsp + 0x2a0]
mov edx, dword [rsp + 0xa0]
call sym.PackageAddInt32
movabs rax, 0xa9b3f056daef8f45
movabs rcx, 0xec44f7653ae0837e
cmp dword [rsp + 0xa0], 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xf1206271628f4de1
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x8da]
mov edx, dword [rax + 0x68]
mov ecx, 1
call sym.PackageTransmitError
movabs rax, 0xf1206271628f4de1
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rax, qword [0x180070030]
mov qword [rax + 0x90e], 0
mov rax, qword [0x180070030]
mov dword [rax + 0x916], 0
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x2a8]
call sym.ParserGetInt32
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x9c]
call sym.TokenRemove
mov rcx, qword [rsp + 0x38]
mov edx, eax
call sym.PackageAddInt32
mov rcx, qword [rsp + 0x2a0]
mov edx, dword [rsp + 0x9c]
call sym.PackageAddInt32
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x84], 0
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x7c], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x8c]
call sym.ListTokens
mov dword [rsp + 0x88], eax
mov rcx, qword [rsp + 0x2a0]
mov edx, dword [rsp + 0x88]
call sym.PackageAddInt32
movabs rax, 0xa6f3e7374435b32
movabs rcx, 0xb6e962329aebd888
cmp dword [rsp + 0x88], 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0xd511ddb19a2862c0
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x2a0]
mov edx, dword [rsp + 0x8c]
call sym.PackageAddInt32
mov dword [rsp + 0x7c], 0
movabs rax, 0xca255777f1e4478e
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov edx, dword [rsp + 0x7c]
movabs rax, 0x2c02215a8966cff0
movabs rcx, 0x48ad14f5a313b312
cmp edx, dword [rsp + 0x8c]
cmovb rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
movabs rax, 0xca255777f1e4478e
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x2a4a3344338a9f8e
movabs rcx, 0xd261e632af9b0220
cmp qword [rsp + 0x90], 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x60e7406a7455bc2f
movabs rcx, 0xd19eefe76a5d3b95
cmp qword [rsp + 0x90], 0
cmovne rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x180037915
mov rcx, qword [rsp + 0x90]
mov eax, dword [rsp + 0x8c]
imul rax, rax, 0x420
mov qword [rsp + 0x2c0], rcx
mov byte [rsp + 0x2bf], 0
mov qword [rsp + 0x2b0], rax
mov rdi, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2b0]
mov al, byte [rsp + 0x2bf]
rep stosb byte [rdi], al
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2b0], rcx
mov rax, qword [0x180070030]
mov rax, qword [rax + 0x3a8]
mov rcx, qword [rsp + 0x90]
call rax
mov qword [rsp + 0x90], 0
movabs rax, 0x3cfa6a763f838c53
mov qword [rsp + 0x60], rax
jmp 0x180037915
movabs rax, 0x6f929352ed595e49
mov qword [rsp + 0x60], rax
jmp 0x180037915
add rsp, 0x368
pop rdi
pop rsi
ret
jmp 0x180035695
sub rsp, 0x4c7f86
movabs rax, 0x958aeca5a0a9e5ac
mov qword [rsp + 0x60], rax
jmp 0x180037915