Function at 0x140001330
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rsi
sub rsp, 0x50
mov edx, 0x68
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000137b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, str._ERROR__Wrong_TokenLock_allocation
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xorps xmm0, xmm0
mov qword [rsp + 0x40], rdi
movups xmmword [rsi], xmm0
xor eax, eax
mov edx, 0x68
movups xmmword [rsi + 0x10], xmm0
mov rcx, rsi
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
mov qword [rsi + 0x60], rax
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov edx, 0x4dc
mov qword [rsi], rsi
xor ecx, ecx
mov qword [rsi + 8], rsi
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1400013f6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, str._ERROR__Worng_client_token_allocation
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x78], rbx
mov edx, 0x4dc
mov rcx, rdi
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov qword [rdi], 1
lea rbx, [rdi + 0x4dc]
mov edx, 8
mov dword [rbx + 8], 6
mov ecx, 0x40
mov qword [rbx], rbx
mov byte [rbx + 0x10], 1
add rdi, 0x30
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x14000172f
mov edx, 8
mov qword [rsp + 0x20], r15
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x14000172a
lea ecx, [rbp + 8]
mov qword [rsp + 0x30], r13
mov byte [rax], cl
mov edx, 0xc0
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
test rax, rax
je 0x140001725
mov edx, 0x30
mov qword [rsp + 0x38], r12
mov ecx, 0x40
mov qword [rax + 0x18], 1
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
je 0x140001720
mov qword [rsp + 0x28], r14
mov edx, 0x20
xor r14d, r14d
mov ecx, 0x40
mov dword [rax], r14d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x68], rax
mov rcx, rax
test rax, rax
je 0x14000171b
mov qword [rax + 8], 1
mov edx, 0x48
mov eax, ebp
mov qword [rdi + 0x468], rcx
mov ecx, 0x40
mov qword [rdi + 0x490], rax
mov qword [rdi + 0x30], rsi
mov dword [rdi + 0xd0], 0xffffffff
mov qword [rdi + 0x18], 0x3e6
mov dword [rdi + 0xc0], 2
mov dword [rdi + 0xc4], 2
mov dword [rdi + 0xd4], r14d
mov dword [rdi + 0x84], 0x11c
mov dword [rdi + 0x7c], r14d
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0xb8], rbp
mov qword [rdi + 0xa8], r15
mov qword [rdi + 0xd8], r13
mov qword [rdi + 0x308], r12
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x14000171b
mov edx, 0x78004
mov word [rax + 0x19], 0
mov ecx, 0x40
mov byte [rax + 0x18], 0
mov dword [rax], 0xc
mov word [rax + 8], 1
mov dword [rax + 4], 2
mov qword [rax + 0x10], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x70], rax
mov rbx, rax
test rax, rax
je 0x14000171b
lea rcx, [rax + 0x34]
mov dword [rax], 0x58585858
mov edx, 0x58
mov r8d, 0x77fd0
call sub.VCRUNTIME140.dll_memset
lea eax, [rbx + 4]
mov dword [rbx + 0x1c], r14d
mov dword [rbx + 4], eax
lea rcx, [rbx + 4]
shr rcx, 0x20
mov edx, 0x78004
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], ecx
xor ecx, ecx
mov dword [rbx + 0xc], eax
mov rax, r14
mov qword [rbx + 0x14], rcx
mov qword [rbx + 0x24], rcx
mov ecx, 0x40
shr rax, 0x20
mov dword [rbx + 0x20], eax
mov qword [rbx + 0x2c], 0x77fd0
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edx, edx
mov r8d, 0x78004
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov edx, 0xd
mov byte [rbx + 4], 1
mov ecx, 0x40
mov byte [rbx + 8], 0x10
mov byte [rbx + 0xa], 2
mov byte [rbx + 0xe], 0x7f
mov byte [rbx + 0x11], 1
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x60]
mov edx, 0x30
mov qword [rcx + 0x10], rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x60]
mov edx, 0x1000
mov qword [rcx + 0x20], rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x60]
mov edx, 0xd
mov qword [rcx + 0x90], rax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x60]
mov edx, 0x40
mov qword [rcx + 0x28], rax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x60]
mov edx, 0x1000
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x30], r12
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x98], rax
mov rax, qword [rsp + 0x68]
mov qword [rcx + 0x60], rax
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
mov qword [rcx + 0x70], r13
mov qword [rcx + 0x68], r14
mov qword [rcx + 0x78], rdi
mov dword [rcx + 0x58], 0x4dc
mov qword [rcx + 0x38], rbp
mov qword [rcx + 0x50], r15
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x40], rbp
mov qword [rcx + 8], rbx
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x48]
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x40]
add rsp, 0x50
pop rsi
ret