Function at 0x10000c10c
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], r8d
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov eax, dword [rax + 0x30]
xor r13d, r13d
mov r15, r9
mov qword [rsp + 0x48], rax
mov r14, rdx
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x50], r13
lea r12d, [r13 + 2]
cmp r8d, r13d
je 0x10000c1a3
test r12b, al
je 0x10000c1a3
lea edi, [r13 + 0x57]
mov rcx, qword [0x10001d1e0]
lea rsi, [0x10001d1e0]
cmp rcx, rsi
je 0x10000d000
lea ebx, [rdi - 0x4f]
test byte [rcx + 0x1c], bl
je 0x10000cfd8
cmp byte [rcx + 0x19], r12b
jb 0x10000cfd8
lea edx, [rdi - 0x2e]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
call fcn.10000121c
jmp 0x10000cfb7
mov ebx, 8
test al, al
jns 0x10000c1e8
test bl, al
jne 0x10000c1b4
test al, 0x10
je 0x10000c1e8
mov edi, 0x57
mov rcx, qword [0x10001d1e0]
lea rsi, [0x10001d1e0]
cmp rcx, rsi
je 0x10000d000
test byte [rcx + 0x1c], bl
je 0x10000cfd8
cmp byte [rcx + 0x19], r12b
jb 0x10000cfd8
lea edx, [rdi - 0x2d]
jmp 0x10000c18e
lea rsi, [0x10001d1e0]
cmp r8d, r13d
jne 0x10000c567
cmp rdx, r13
jne 0x10000c23f
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000c230
test byte [rcx + 0x1c], bl
je 0x10000c230
cmp byte [rcx + 0x19], 4
jb 0x10000c230
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x2b
call fcn.10000121c
mov eax, dword [rsp + 0x188]
or eax, r12d
mov dword [rsp + 0x188], eax
jmp 0x10000c567
lea rdx, [rsp + 0x50]
call sub.WTSAPI32.dll_WTSQueryUserToken
cmp eax, r13d
jne 0x10000c2f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x10000c2ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x10001d1e0]
lea rsi, [0x10001d1e0]
cmp rcx, rsi
je 0x10000cfbe
test byte [rcx + 0x1c], bl
je 0x10000cfbe
cmp byte [rcx + 0x19], r12b
jb 0x10000cfbe
mov edx, 0x2c
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
call fcn.100001e70
jmp 0x10000cfb7
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000c523
test byte [rcx + 0x1c], bl
je 0x10000c523
cmp byte [rcx + 0x19], 4
jb 0x10000c523
mov r9d, dword [rsp + 0x160]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x2d
call fcn.100001e70
jmp 0x10000c523
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
lea rax, [rsp + 0x40]
lea edx, [r9 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov ebp, eax
cmp eax, 0xc0000023
je 0x10000c35c
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
mov rcx, qword [0x10001d1e0]
lea rsi, [0x10001d1e0]
cmp rcx, rsi
je 0x10000cfbe
test byte [rcx + 0x1c], bl
je 0x10000cfbe
cmp byte [rcx + 0x19], r12b
jb 0x10000cfbe
mov edx, 0x2e
mov r9d, ebp
jmp 0x10000c299
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x10001d210]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, r13
jne 0x10000c387
mov edi, 0xe
jmp 0x10000cf87
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov r8, rdi
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
cmp eax, r13d
mov ebp, eax
jge 0x10000c3fa
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cf8e
test byte [rcx + 0x1c], bl
je 0x10000cf8e
cmp byte [rcx + 0x19], r12b
jb 0x10000cf8e
mov edx, 0x2f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov r9d, ebp
call fcn.100001e70
jmp 0x10000cf87
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
mov ebp, eax
cmp eax, 0xc0000023
je 0x10000c454
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cf8e
test byte [rcx + 0x1c], bl
je 0x10000cf8e
cmp byte [rcx + 0x19], r12b
jb 0x10000cf8e
mov edx, 0x30
jmp 0x10000c3e2
mov r8d, dword [rsp + 0x40]
mov rcx, qword [0x10001d210]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
mov qword [rsp + 0x60], rax
cmp rax, r13
je 0x10000c37d
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov r8, r12
mov edx, 1
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
cmp eax, r13d
mov ebp, eax
jge 0x10000c4d7
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cf8e
test byte [rcx + 0x1c], bl
je 0x10000cf8e
cmp byte [rcx + 0x19], 2
jb 0x10000cf8e
mov edx, 0x31
jmp 0x10000c3e2
mov rdx, qword [rdi]
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, r13d
jne 0x10000c52d
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000c51d
test byte [rcx + 0x1c], bl
je 0x10000c51d
cmp byte [rcx + 0x19], 4
jb 0x10000c51d
mov r9d, dword [rsp + 0x160]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x32
call fcn.100001e70
mov r12d, 2
or dword [rsp + 0x188], r12d
jmp 0x10000c567
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000c561
test byte [rcx + 0x1c], bl
je 0x10000c561
cmp byte [rcx + 0x19], 4
jb 0x10000c561
mov r9d, dword [rsp + 0x160]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x33
call fcn.100001e70
mov r12d, 2
lea rcx, [0x10001dab0]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp eax, r13d
mov dword [rsp + 0x40], eax
jge 0x10000c58c
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
jmp 0x10000cf87
cmp dword [0x10001e058], r12d
jl 0x10000c59f
mov edi, 0x45b
jmp 0x10000cf7a
mov rcx, qword [0x10001dbd0]
cmp rcx, r13
je 0x10000c6da
lea rdx, [0x100016c20]
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
cmp al, r13b
je 0x10000c6da
lea r8, [0x100015c90]
cmp r15, r13
je 0x10000c5e0
cmp qword [r15 + 8], r13
je 0x10000c5e0
cmp word [r15], r13w
cmova r8, qword [r15 + 8]
or rcx, 0xffffffffffffffff
mov rdi, r8
lea rax, [rsp + 0x160]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x170]
mov dword [rsp + 0xc8], 4
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x180]
mov dword [rsp + 0xcc], r13d
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x188]
mov dword [rsp + 0xd8], 4
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0x190]
mov dword [rsp + 0xdc], r13d
mov qword [rsp + 0x100], rax
xor eax, eax
mov dword [rsp + 0xe8], 4
mov dword [rsp + 0xec], r13d
mov dword [rsp + 0xf8], 4
mov dword [rsp + 0xfc], r13d
mov dword [rsp + 0x108], 4
mov dword [rsp + 0x10c], r13d
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x110], r8
lea r9, [rsp + 0xc0]
lea eax, [rcx + rcx]
mov rcx, qword [0x10001dbd0]
lea rdx, [0x100016c20]
mov r8d, 6
mov dword [rsp + 0x118], eax
mov dword [rsp + 0x11c], r13d
call qword [sym.imp.ntdll.dll_EtwEventWrite]
mov ecx, dword [rsp + 0x188]
test cl, 1
jne 0x10000c740
mov ecx, dword [rsp + 0x160]
call fcn.10000df94
cmp eax, r13d
je 0x10000c739
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000c72f
test byte [rcx + 0x1c], bl
je 0x10000c72f
cmp byte [rcx + 0x19], 4
jb 0x10000c72f
mov r9d, dword [rsp + 0x160]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x34
mov dword [rsp + 0x20], eax
call fcn.10000a8d0
mov edi, 0x4a7
jmp 0x10000cf7a
mov ecx, dword [rsp + 0x188]
mov ebp, 3
cmp dword [rsp + 0x160], r13d
jne 0x10000c793
mov rdi, qword [0x10001d1e0]
cmp rdi, rsi
je 0x10000c787
test byte [rdi + 0x1c], bl
je 0x10000c787
cmp byte [rdi + 0x19], bpl
jb 0x10000c787
mov rcx, qword [rdi + 0x10]
lea edx, [rbp + 0x32]
lea r8, [0x1000155d0]
call fcn.10000121c
mov ecx, dword [rsp + 0x188]
mov rdi, qword [0x10001d1e0]
or ecx, r12d
mov dword [rsp + 0x188], ecx
jmp 0x10000c79a
mov rdi, qword [0x10001d1e0]
mov r9d, dword [rsp + 0x180]
cmp r9d, r13d
jbe 0x10000c7e4
cmp rdi, rsi
je 0x10000c7da
test byte [rdi + 0x1c], bl
je 0x10000c7da
cmp byte [rdi + 0x19], bpl
jb 0x10000c7da
mov rcx, qword [rdi + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x36
call fcn.100001e70
mov ecx, dword [rsp + 0x188]
mov rdi, qword [0x10001d1e0]
or ecx, r12d
mov dword [rsp + 0x188], ecx
mov eax, ecx
and eax, 0x1c
cmp al, r13b
jne 0x10000c7f7
or ecx, ebx
mov dword [rsp + 0x188], ecx
mov r12, qword [rsp + 0x1a0]
mov r13, qword [rsp + 0x198]
cmp rdi, rsi
je 0x10000c842
test byte [rdi + 0x1c], bl
je 0x10000c842
cmp byte [rdi + 0x19], 5
jb 0x10000c842
mov rcx, qword [rdi + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x37
mov r9, r13
mov qword [rsp + 0x20], r12
call fcn.10000b5a0
mov ecx, dword [rsp + 0x188]
mov rdi, qword [0x10001d1e0]
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x70], 0x30
mov dword [rsp + 0x74], ecx
mov dword [rsp + 0x7c], 1
mov dword [rsp + 0x78], eax
test r15, r15
je 0x10000c874
mov rax, qword [r15 + 8]
mov qword [rsp + 0x88], rax
jmp 0x10000c87d
and qword [rsp + 0x88], 0
mov qword [rsp + 0x98], r13
xor r13d, r13d
mov qword [rsp + 0x90], r12
test cl, 2
jne 0x10000cb12
cmp dword [rsp + 0x170], r13d
jne 0x10000cb12
bt ecx, 0x1f
jb 0x10000c8dc
test cl, 4
jne 0x10000c8b6
test bl, cl
je 0x10000c8dc
mov r9d, ecx
lea r8, [0x100018420]
lea rdx, [0x100016c30]
mov cl, 1
call fcn.10000e6f4
mov ecx, dword [rsp + 0x188]
mov rdi, qword [0x10001d1e0]
cmp rdi, rsi
je 0x10000c910
test byte [rdi + 0x1c], bl
je 0x10000c910
cmp byte [rdi + 0x19], 5
jb 0x10000c910
mov r9d, dword [rsp + 0x160]
mov rcx, qword [rdi + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x38
call fcn.100001e70
mov ecx, dword [rsp + 0x188]
test cl, 4
jne 0x10000c922
mov ebp, 1
test bl, cl
lea edx, [rbp + 8]
cmovne ebp, edx
test cl, cl
jns 0x10000c929
or ebp, 0x40
test cl, 0x40
je 0x10000c932
bts ebp, 0x14
mov rcx, qword [0x10001dbd0]
mov eax, dword [rsp + 0x160]
mov edi, ebp
bts edi, 0xd
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x48], edi
cmp rcx, r13
je 0x10000c9c7
lea rdx, [0x100016c10]
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
cmp al, r13b
je 0x10000c9c7
mov rcx, qword [0x10001dbd0]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x48]
lea rdx, [0x100016c10]
mov r8d, 2
mov dword [rsp + 0xa8], 4
mov dword [rsp + 0xac], r13d
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 4
mov dword [rsp + 0xbc], r13d
call qword [sym.imp.ntdll.dll_EtwEventWrite]
mov ecx, dword [rsp + 0x160]
lea r9, [rsp + 0x40]
mov r8d, edi
mov edx, 1
call fcn.100011d1c
mov edi, eax
cmp eax, r13d
jne 0x10000c9f2
mov eax, dword [rsp + 0x40]
cmp eax, r13d
je 0x10000ca3b
mov edi, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cf7a
test byte [rcx + 0x1c], bl
je 0x10000cf7a
cmp byte [rcx + 0x19], 2
jb 0x10000cf7a
mov r9d, dword [rsp + 0x160]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x3b
mov dword [rsp + 0x20], edi
call fcn.10000a8d0
jmp 0x10000cf7a
cmp r14, r13
je 0x10000ca9b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp eax, r13d
jne 0x10000ca9b
mov rax, qword [0x10001d1e0]
cmp rax, rsi
je 0x10000cf7a
test byte [rax + 0x1c], bl
je 0x10000cf7a
cmp byte [rax + 0x19], 2
jb 0x10000cf7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10001d1e0]
lea r8, [0x1000155d0]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x3a
call fcn.100001e70
jmp 0x10000cf7a
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x74], ebp
call qword [sym.imp.USER32.dll_RecordShutdownReason]
mov r11d, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cafe
test byte [rcx + 0x1c], bl
je 0x10000cafe
cmp byte [rcx + 0x19], 5
jb 0x10000cafe
mov rcx, qword [rcx + 0x10]
lea rax, str.succeeded
cmp r11d, r13d
lea r9, str.failed
lea r8, [0x1000155d0]
mov edx, 0x39
cmovne r9, rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], eax
call fcn.10000b760
cmp r14, r13
je 0x10000cf7a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x10000cf7a
cmp dword [0x10001e058], 1
jne 0x10000cbcc
test cl, 0x20
jne 0x10000cb2e
mov edi, 0x4a6
jmp 0x10000cf7a
mov rdx, qword [0x10001e048]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
cmp eax, 1
jne 0x10000cb76
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cb6f
test byte [rcx + 0x1c], bl
je 0x10000cb6f
cmp byte [rcx + 0x19], 5
jb 0x10000cb6f
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x3b]
lea r8, [0x1000155d0]
call fcn.10000121c
mov dword [0x10001e058], r13d
mov rdx, qword [0x10001e050]
cmp rdx, r13
je 0x10000cbc5
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
cmp eax, r13d
jne 0x10000cbbe
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cbbe
test byte [rcx + 0x1c], bl
je 0x10000cbbe
cmp byte [rcx + 0x19], 2
jb 0x10000cbbe
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x3d
call fcn.10000121c
mov qword [0x10001e050], r13
mov ecx, dword [rsp + 0x188]
bt ecx, 0x1f
jb 0x10000ccc7
cmp r14, r13
je 0x10000cc42
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
cmp eax, r13d
jne 0x10000cc3b
mov rax, qword [0x10001d1e0]
mov r14d, 2
cmp rax, rsi
je 0x10000cccd
test byte [rax + 0x1c], bl
je 0x10000cccd
cmp byte [rax + 0x19], r14b
jb 0x10000cccd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10001d1e0]
lea edx, [r14 + 0x3d]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov r9d, eax
call fcn.100001e70
jmp 0x10000cccd
mov ecx, dword [rsp + 0x188]
test cl, 4
je 0x10000cc4d
mov dword [rsp + 0x74], ebp
jmp 0x10000cc5e
mov eax, 1
test bl, cl
lea edx, [rax + 8]
cmovne eax, edx
mov dword [rsp + 0x74], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RecordShutdownReason]
mov edx, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000ccbc
test byte [rcx + 0x1c], bl
je 0x10000ccbc
cmp byte [rcx + 0x19], 5
jb 0x10000ccbc
mov rcx, qword [rcx + 0x10]
lea rax, str.succeeded
cmp edx, r13d
lea r9, str.failed
lea r8, [0x1000155d0]
mov edx, 0x3e
cmovne r9, rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x20], eax
call fcn.10000b760
cmp r14, r13
je 0x10000ccc7
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov r14d, 2
cmp dword [rsp + 0x180], r13d
jbe 0x10000cf6b
mov r12, qword [rsp + 0x48]
mov ebp, r13d
mov eax, dword [rsp + 0x180]
mov dword [rsp + 0x30], 0x10
lea r8, [fcn.10000d5bc]
lea rcx, [0x10001e048]
mov r9, r12
xor edx, edx
imul eax, eax, 0x3e8
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
cmp eax, r13d
jne 0x10000cd78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cd56
test byte [rcx + 0x1c], bl
je 0x10000cd56
cmp byte [rcx + 0x19], r14b
jb 0x10000cd56
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x40
mov r9d, eax
call fcn.100001e70
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0xa
jl 0x10000cce3
mov rcx, qword [0x10001d1e0]
jmp 0x10000cea8
mov r8d, dword [rsp + 0x180]
mov edi, 0xa
mov eax, 0x88888889
mul r8d
shr edx, 5
mov ecx, edx
cmp r14, rcx
sbb eax, eax
and eax, r14d
cmp rcx, rdi
cmova eax, edi
movsxd rdi, eax
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cdd7
test byte [rcx + 0x1c], bl
je 0x10000cdd7
cmp byte [rcx + 0x19], 4
jb 0x10000cdd7
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x41
call fcn.10000121c
mov r8d, dword [rsp + 0x180]
mov ecx, r8d
xor edx, edx
call fcn.10000d2e0
cmp rdi, r13
je 0x10000ce9e
mov ecx, dword [rsp + 0x180]
mov eax, edi
mov dword [rsp + 0x30], 0x10
imul eax, eax, 0x3c
sub ecx, eax
mov r9, rdi
mov dword [rsp + 0x28], r13d
lea r8, [fcn.10000d2e0]
xor edx, edx
imul ecx, ecx, 0x3e8
imul r9, r9, 0x3c
mov dword [rsp + 0x20], ecx
lea rcx, [0x10001e050]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
cmp eax, r13d
jne 0x10000ce6f
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cea5
test byte [rcx + 0x1c], bl
je 0x10000cea5
cmp byte [rcx + 0x19], r14b
jb 0x10000cea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x10001d1e0]
lea r8, [0x1000155d0]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x42
call fcn.100001e70
jmp 0x10000ce9e
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000cea5
test byte [rcx + 0x1c], bl
je 0x10000cea5
cmp byte [rcx + 0x19], 4
jb 0x10000cea5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x43
mov r9d, edi
call fcn.100001e70
mov rcx, qword [0x10001d1e0]
mov edi, r13d
cmp edi, r13d
je 0x10000cee3
cmp rcx, rsi
je 0x10000cf7a
test byte [rcx + 0x1c], bl
je 0x10000cf7a
cmp byte [rcx + 0x19], r14b
jb 0x10000cf7a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x44
call fcn.10000121c
jmp 0x10000cf7a
cmp rcx, rsi
je 0x10000cf0f
test byte [rcx + 0x1c], bl
je 0x10000cf0f
cmp byte [rcx + 0x19], 5
jb 0x10000cf0f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x45
call fcn.10000121c
mov rcx, qword [0x10001d1e0]
mov dword [0x10001e058], 1
cmp r15, r13
je 0x10000cf77
cmp qword [r15 + 8], r13
je 0x10000cf77
cmp rcx, rsi
je 0x10000cf49
test byte [rcx + 0x1c], bl
je 0x10000cf49
cmp byte [rcx + 0x19], 5
jb 0x10000cf49
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x46
call fcn.10000121c
mov r8, qword [r15 + 8]
mov edx, dword [rsp + 0x180]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov ecx, r14d
mov qword [rsp + 0x20], rax
call fcn.1000105ac
jmp 0x10000cf77
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.10000d5bc
mov edi, r13d
lea rcx, [0x10001dab0]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rcx, qword [0x10001d1e0]
cmp qword [rsp + 0x58], r13
je 0x10000cfa6
lea rcx, [rsp + 0x58]
call fcn.1000031b0
mov rcx, qword [0x10001d1e0]
cmp qword [rsp + 0x60], r13
je 0x10000cfbe
lea rcx, [rsp + 0x60]
call fcn.1000031b0
mov rcx, qword [0x10001d1e0]
mov rax, qword [rsp + 0x50]
cmp rax, r13
je 0x10000cfd8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x10001d1e0]
cmp rcx, rsi
je 0x10000d000
test byte [rcx + 0x1c], bl
je 0x10000d000
cmp byte [rcx + 0x19], 5
jb 0x10000d000
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000155d0]
mov edx, 0x47
mov r9d, edi
call fcn.100001e70
mov eax, edi
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret