Function at 0x140034828
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rbx, rcx
mov edi, 1
mov dword [rsp + 0x34], edi
xor esi, esi
mov dword [rsp + 0x30], esi
mov dword [rax + 0x20], esi
mov dword [rsp + 0x38], esi
lea rcx, [rax - 0x58]
call fcn.140063500
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x3c], eax
mov byte [rsp + 0x20], dil
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0xa8]
mov rcx, rbx
call fcn.14006d870
mov r11, qword [rsp + 0x40]
mov qword [rsp + 0xa8], r11
mov r14b, sil
lea ebp, [rdi + 0x29]
lea ebx, [rdi + 8]
cmp bp, word [r11]
jne 0x140034a4c
mov r8d, 6
lea rdx, [rsp + 0xa8]
lea rcx, str.force
call fcn.140065780
cmp al, sil
je 0x1400348db
or r14b, dil
jmp 0x14003499c
mov r8d, 5
mov rdx, qword [rsp + 0xa8]
lea rcx, [0x140149450]
call fcn.14005c510
cmp al, sil
jne 0x1400349b2
mov r8d, 0xa
mov rdx, qword [rsp + 0xa8]
lea rcx, str.exitcode
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, esi
jne 0x140034971
mov dword [rsp + 0xb0], esi
mov rax, qword [rsp + 0xa8]
add rax, 0x14
mov qword [rsp + 0xa8], rax
movzx ecx, word [rax]
sub cx, 0x30
cmp cx, bx
setbe bl
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa8]
call fcn.140066e40
cmp bl, sil
je 0x140034997
mov ecx, dword [rsp + 0xb0]
mov dword [rsp + 0x30], ecx
mov ebx, 9
jmp 0x14003499c
mov r8d, ebx
lea rdx, [rsp + 0xa8]
lea rcx, str.explorer
call fcn.140065780
cmp al, sil
je 0x140034a4c
mov dword [rsp + 0x30], edi
jmp 0x14003499c
mov ebx, 9
mov rax, qword [rsp + 0xa8]
cmp bp, word [rax]
je 0x1400348b4
jmp 0x140034a4c
lea r12, [0x14019cf50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11b, byte [0x14019c661]
test r11b, 8
jne 0x1400349f2
or r11b, 8
mov byte [0x14019c661], r11b
mov edx, 2
lea rcx, str.SeShutdownPrivilege
call fcn.14002e788
mov r11b, byte [0x14019c661]
mov bl, sil
mov ebp, 4
test bpl, r11b
jne 0x140034a1b
mov bl, dil
or r11b, bpl
mov byte [0x14019c661], r11b
lea edx, [rbp - 2]
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
cmp bl, sil
je 0x140034a3d
and byte [0x14019c661], 0xfb
mov edx, ebp
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x140034ce6
lea r12, [0x14019cf50]
mov rbx, r12
mov qword [rsp + 0x48], rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r15d, 0x8000
mov dil, sil
mov byte [rsp + 0xb0], sil
mov ebp, 4
cmp r14b, sil
je 0x140034aab
test byte [0x14019c661], bpl
jne 0x140034aab
mov dil, 1
mov byte [rsp + 0xb0], dil
or byte [0x14019c661], bpl
lea edx, [rbp - 2]
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
nop
cmp dil, sil
jne 0x140034ac1
mov rbx, rsi
mov qword [rsp + 0x48], rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0xa8]
mov eax, 0x2a
cmp ax, word [rcx]
jne 0x140034b8d
add rcx, 2
mov qword [rsp + 0xa8], rcx
lea rcx, [rsp + 0xa8]
call fcn.140029d28
mov rcx, qword [rsp + 0xa8]
movzx eax, word [rcx]
sub ax, 0x30
mov edx, 9
cmp ax, dx
jbe 0x140034b3d
cmp dil, sil
je 0x140034b24
and byte [0x14019c661], 0xfb
mov edx, ebp
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
nop
cmp rbx, rsi
je 0x140034b33
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov esi, 0x80070057
jmp 0x140034ce6
cmp word [rcx], si
je 0x140034b5c
cmp word [rcx], 0x30
jb 0x140034b4e
cmp word [rcx], 0x39
jbe 0x140034b5c
add rcx, 2
mov qword [rsp + 0xa8], rcx
jmp 0x140034b3d
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xa8]
call fcn.140066e40
mov r11, rsi
mov qword [rsp + 0xa8], rsi
mov eax, dword [rsp + 0xb8]
mov r14d, dword [rsp + 0x30]
jmp 0x140034c18
call fcn.14002b47c
mov rcx, rax
call fcn.14002e004
mov r11, rax
mov qword [rsp + 0xa8], rax
cmp word [rax], si
jne 0x140034bde
cmp dil, sil
je 0x140034bc5
and byte [0x14019c661], 0xfb
mov edx, ebp
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
nop
cmp rbx, rsi
je 0x140034bd4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov esi, 0x80070057
jmp 0x140034ce6
mov eax, dword [rsp + 0xb8]
mov r14d, dword [rsp + 0x30]
cmp r11, rsi
je 0x140034c12
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov dl, 0x10
mov rcx, r11
call fcn.1400340bc
mov dword [rsp + 0xb8], eax
mov r11, qword [rsp + 0xa8]
cmp dword [rsp + 0x3c], eax
je 0x140034c74
cmp eax, esi
je 0x140034c74
mov r8d, eax
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
cmp rax, rsi
je 0x140034c65
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [rsp + 0x34]
cmp eax, esi
cmovne ecx, esi
mov dword [rsp + 0x34], ecx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0xa8]
mov eax, dword [rsp + 0xb8]
jmp 0x140034c74
mov r11, qword [rsp + 0xa8]
mov eax, dword [rsp + 0xb8]
cmp r11, rsi
je 0x140034cb8
cmp eax, esi
je 0x140034cb8
cmp dword [rsp + 0x38], eax
jne 0x140034ca4
mov edx, 1
mov rcx, qword [rsp + 0xa0]
call fcn.14002bb1c
mov r11, qword [rsp + 0xa8]
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x38], eax
cmp eax, esi
jle 0x140034cb8
dec r15d
cmp r15d, esi
jg 0x140034bea
cmp dil, sil
je 0x140034cd3
and byte [0x14019c661], 0xfb
mov edx, ebp
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
nop
cmp rbx, rsi
je 0x140034ce2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov esi, dword [rsp + 0x34]
lea rcx, [rsp + 0x40]
call fcn.14005b520
mov eax, esi
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret