Function at 0x14004ca50
Capabilities:
Compare security identifiers
Enumerate process modules
Enumerate processes
Get token privileges

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
movaps xmmword [rsp + 0x560], xmm6
call fcn.14004c980
test al, al
jne 0x14004cbb4
xor r13d, r13d
mov ecx, 2
xor edx, edx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rsi, rax
lea rdi, [rsp + 0x250]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x250], 0x238
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x14004cbb4
lea rbx, [rsp + 0x27c]
lea r14, str.winlogon.exe
lea r15, str.lsass.exe
mov r12, qword [sym.imp.KERNEL32.DLL_GetLastError]
xor edi, edi
nop
mov rcx, rbx
mov rdx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14004caf6
mov edi, dword [rsp + 0x258]
mov rcx, rbx
mov rdx, r15
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14004cb0d
mov r13d, dword [rsp + 0x258]
test r13d, r13d
je 0x14004cb16
test edi, edi
jne 0x14004cb57
mov rcx, rsi
lea rdx, [rsp + 0x250]
call sub.KERNEL32.DLL_Process32NextW
mov ebp, eax
call r12
test ebp, ebp
jne 0x14004cae0
cmp eax, 0x12
jne 0x14004cae0
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp + 0x110], 0
test edi, edi
jne 0x14004cb6c
mov edi, r13d
test r13d, r13d
jne 0x14004cb6c
jmp 0x14004cbb4
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp + 0x110], 0
mov ecx, 0x400
xor edx, edx
mov r8d, edi
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
test rax, rax
je 0x14004cbb4
lea r8, [rsp + 0x110]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rax, qword [rsp + 0x110]
mov qword [0x140289800], rax
mov dword [rsp + 0x84], 0
nop
mov ecx, 0x320
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14004cbc0
mov rdi, rax
lea r8, [rsp + 0x84]
mov rcx, rax
mov edx, 0x320
call sub.PSAPI.DLL_EnumProcesses
mov r15d, dword [rsp + 0x84]
cmp r15d, 0x320
jae 0x14004cc25
mov rsi, rdi
movabs rdi, 0x1fffffffffffffff
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
cmp r15d, 4
jae 0x14004cc72
xor ebx, ebx
xor edi, edi
jmp 0x14004ce72
lea rbx, [rsp + 0x84]
jmp 0x14004cc51
mov rsi, rax
mov rcx, rax
mov edx, r14d
mov r8, rbx
call sub.PSAPI.DLL_EnumProcesses
mov r15d, dword [rsp + 0x84]
mov rdi, rsi
cmp r15d, r14d
jb 0x14004cbfb
lea r14d, [r15 + r15*2]
nop word cs:[rax + rax]
mov rcx, rdi
mov rdx, r14
call sub.msvcrt.dll_realloc
test rax, rax
je 0x14004cc60
jmp 0x14004cc30
shr r15d, 2
xor r14d, r14d
mov rbp, qword [sym.imp.KERNEL32.DLL_OpenProcess]
jmp 0x14004ccb0
mov rax, qword [rsp + 0x250]
mov qword [r8], rax
add r8, 8
mov qword [rsp + 0x48], r8
inc r14
cmp r14, r15
je 0x14004ce68
mov qword [rsp + 0x250], 0
mov r8d, dword [rsi + r14*4]
mov ecx, 0x400
xor edx, edx
call rbp
mov rcx, rax
mov edx, 0xf
lea r8, [rsp + 0x250]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test ebx, ebx
je 0x14004cca4
mov r8, qword [rsp + 0x48]
cmp r8, qword [rsp + 0x50]
jne 0x14004cc90
mov rcx, qword [rsp + 0x40]
mov rbx, r8
sub rbx, rcx
mov r13, rbx
sar r13, 3
lea rax, [r13 + 1]
cmp rax, rdi
ja 0x14004dc33
mov r12, rbx
shr r12, 2
cmp r12, rax
cmovbe r12, rax
movabs rax, 0x7ffffffffffffff8
cmp rbx, rax
cmovae r12, rdi
test r12, r12
je 0x14004cd5c
cmp r12, rdi
ja 0x14004dc42
lea rcx, [r12*8]
call fcn.14006fb50
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
jmp 0x14004cd5e
xor eax, eax
lea rdx, [rax + r13*8]
mov r9, qword [rsp + 0x250]
mov qword [rax + r13*8], r9
mov r10, r8
sub r10, rcx
je 0x14004ce3a
add r10, 0xfffffffffffffff8
cmp r10, 0x98
jae 0x14004cd8f
mov r9, r8
jmp 0x14004ce20
add rbx, rax
mov r9, r8
sub r9, rbx
cmp r9, 0x20
jae 0x14004cda3
mov r9, r8
jmp 0x14004ce20
shr r10, 3
inc r10
mov rbp, r10
and rbp, 0xfffffffffffffffc
lea r11, [rbp*8]
sub rdx, r11
mov r9, r8
sub r9, r11
lea rbx, [rax + r13*8]
add rbx, 0xfffffffffffffff0
mov r11, rbp
neg r11
xor edi, edi
nop word cs:[rax + rax]
movups xmm0, xmmword [r8 + rdi*8 - 0x20]
movups xmm1, xmmword [r8 + rdi*8 - 0x10]
movups xmmword [rbx + rdi*8], xmm1
movups xmmword [rbx + rdi*8 - 0x10], xmm0
add rdi, 0xfffffffffffffffc
cmp r11, rdi
jne 0x14004cde0
cmp r10, rbp
movabs rdi, 0x1fffffffffffffff
mov rbp, qword [sym.imp.KERNEL32.DLL_OpenProcess]
je 0x14004ce35
nop word cs:[rax + rax]
mov r8, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [rdx - 8], r8
add rdx, 0xfffffffffffffff8
cmp r9, rcx
jne 0x14004ce20
mov rcx, qword [rsp + 0x40]
lea r8, [rax + r12*8]
lea rax, [rax + r13*8]
add rax, 8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r8
test rcx, rcx
je 0x14004cca4
call fcn.14006fbd0
jmp 0x14004cca4
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rcx, rsi
call fcn.1401f47c0
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0xc0], 0
xor r14d, r14d
cmp rdi, rbx
je 0x14004d0db
lea rsi, [rsp + 0x250]
mov r15, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor r12d, r12d
jmp 0x14004cee7
mov rax, qword [rsp + 0x250]
mov qword [r14], rax
add r14, 8
mov qword [rsp + 0xb8], r14
inc r12d
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rcx, rax
sub rcx, rbx
sar rcx, 3
cmp rcx, r12
jbe 0x14004d0ce
mov dword [rsp + 0x110], 0
mov rcx, qword [rbx + r12*8]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov edx, 0x13
mov r8, rsi
mov r9d, 8
call r15
test eax, eax
je 0x14004cec7
cmp r14, qword [rsp + 0xc0]
jne 0x14004ceb0
mov rbp, qword [rsp + 0xb0]
mov rdi, r14
sub rdi, rbp
mov rbx, rdi
sar rbx, 3
lea rax, [rbx + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
ja 0x14004dc26
mov r13, rdi
shr r13, 2
cmp r13, rax
cmovbe r13, rax
movabs rax, 0x7ffffffffffffff8
cmp rdi, rax
cmovae r13, rcx
test r13, r13
je 0x14004cf8a
cmp r13, rcx
ja 0x14004dc3d
lea rcx, [r13*8]
call fcn.14006fb50
jmp 0x14004cf8c
xor eax, eax
lea rdx, [rax + rbx*8]
mov rcx, qword [rsp + 0x250]
mov qword [rax + rbx*8], rcx
mov rcx, r14
sub rcx, rbp
je 0x14004cfdf
add rcx, 0xfffffffffffffff8
cmp rcx, 0x228
jae 0x14004d019
mov r8, r14
nop word cs:[rax + rax]
mov rcx, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [rdx - 8], rcx
add rdx, 0xfffffffffffffff8
cmp r8, rbp
jne 0x14004cfc0
mov rcx, qword [rsp + 0xb0]
jmp 0x14004cfe2
mov rcx, r14
lea r8, [rax + r13*8]
lea r14, [rax + rbx*8]
add r14, 8
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xc0], r8
test rcx, rcx
je 0x14004cec7
call fcn.14006fbd0
jmp 0x14004cec7
lea r8, [r14 - 8]
mov r9, r8
sub r9, rbp
and r9, 0xfffffffffffffff8
lea r10, [rax + rdi]
add r10, 0xfffffffffffffff8
mov r11, r10
sub r11, r9
cmp r11, r10
ja 0x14004d064
mov r10, r8
sub r10, r9
cmp r10, r8
ja 0x14004d05c
add rdi, rax
mov r8, r14
sub r8, rdi
cmp r8, 0x20
jae 0x14004d06c
mov r8, r14
jmp 0x14004cfc0
mov r8, r14
jmp 0x14004cfc0
mov r8, r14
jmp 0x14004cfc0
shr rcx, 3
inc rcx
mov r9, rcx
and r9, 0xfffffffffffffffc
lea r10, [r9*8]
sub rdx, r10
mov r8, r14
sub r8, r10
lea r10, [rax + rbx*8]
add r10, 0xfffffffffffffff0
mov r11, r9
neg r11
xor edi, edi
nop dword [rax + rax]
movups xmm0, xmmword [r14 + rdi*8 - 0x20]
movups xmm1, xmmword [r14 + rdi*8 - 0x10]
movups xmmword [r10 + rdi*8], xmm1
movups xmmword [r10 + rdi*8 - 0x10], xmm0
add rdi, 0xfffffffffffffffc
cmp r11, rdi
jne 0x14004d0a0
cmp rcx, r9
jne 0x14004cfc0
jmp 0x14004cfd5
mov r8, qword [rsp + 0xb0]
mov rbx, rax
jmp 0x14004d0de
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r9, r14
call fcn.14004dd30
mov rbx, qword [rsp + 0x40]
cmp qword [rsp + 0x48], rbx
je 0x14004db30
lea r13, [rsp + 0xd0]
lea r14, [rsp + 0x110]
lea r15, [rsp + 0x78]
lea r12, [rsp + 0x80]
xor edi, edi
jmp 0x14004d131
cmp rax, rdi
lea r13, [rsp + 0xd0]
jbe 0x14004d35a
mov dword [rsp + 0x490], 0
mov dword [rsp + 0xd0], 0
mov r8d, 0x140
lea rsi, [rsp + 0x250]
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + rdi*8]
lea rax, [rsp + 0x490]
mov qword [rsp + 0x20], rax
mov edx, 1
mov r8, rsi
mov r9d, 0x140
mov rsi, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rsi
mov dword [rsp + 0x60], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rdi*8]
mov qword [rsp + 0x20], r13
mov edx, 0x14
lea r8, [rsp + 0x60]
mov r9d, 4
call rsi
mov dword [rsp + 0x90], 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rdi*8]
mov qword [rsp + 0x20], r13
mov edx, 0xc
lea r8, [rsp + 0x90]
mov r9d, 4
call rsi
inc edi
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rbx
sar rax, 3
mov rbp, rdi
mov esi, edi
cmp rax, rdi
ja 0x14004d252
jmp 0x14004d120
lea rcx, [rax + rbp*8]
lea rdx, [rax + rbp*8]
add rdx, 8
mov rbx, qword [rsp + 0x48]
mov r8, rbx
sub r8, rdx
call sub.msvcrt.dll_memmove
add rbx, 0xfffffffffffffff8
mov qword [rsp + 0x48], rbx
dec esi
nop dword [rax]
inc esi
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rbx
sar rax, 3
mov rbp, rsi
cmp rax, rsi
jbe 0x14004d120
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x88], 0
mov r8d, 0x140
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + rbp*8]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov edx, 1
mov r8, r14
mov r9d, 0x140
mov rbx, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rbx
mov dword [rsp + 0x78], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rbp*8]
lea r13, [rsp + 0x8c]
mov qword [rsp + 0x20], r13
mov edx, 0x14
mov r8, r15
mov r9d, 4
call rbx
mov dword [rsp + 0x80], 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rbp*8]
mov qword [rsp + 0x20], r13
mov edx, 0xc
mov r8, r12
mov r9d, 4
call rbx
mov rcx, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14004d230
mov eax, dword [rsp + 0x60]
cmp eax, dword [rsp + 0x78]
jne 0x14004d230
mov eax, dword [rsp + 0x90]
cmp eax, dword [rsp + 0x80]
jne 0x14004d230
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rbp*8]
cmp qword [rax + 8], rcx
je 0x14004d202
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [rsp + 0x40]
jmp 0x14004d202
xorps xmm6, xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0xa0], 0
cmp rcx, rbx
je 0x14004db55
lea r12, [rsp + 0xd9]
xor r14d, r14d
jmp 0x14004d3cc
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + r14*8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
inc r14d
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
sub rax, rbx
sar rax, 3
cmp rax, r14
jbe 0x14004db10
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x88], 0
mov r8d, 0x140
lea rsi, [rsp + 0x250]
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + r14*8]
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
mov edx, 1
mov r8, rsi
mov r9d, 0x140
mov rsi, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rsi
mov dword [rsp + 0x78], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + r14*8]
lea rdi, [rsp + 0x88]
mov qword [rsp + 0x20], rdi
mov edx, 0x14
lea r8, [rsp + 0x78]
mov r9d, 4
call rsi
mov dword [rsp + 0x80], 0xffffffff
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + r14*8]
mov qword [rsp + 0x20], rdi
mov edx, 0xc
lea r8, [rsp + 0x80]
mov r9d, 4
call rsi
mov dword [rsp + 0x108], 0xc8
mov dword [rsp + 0x104], 0xc8
mov rdx, qword [rsp + 0x250]
lea rax, [rsp + 0x10c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x104]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x490]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8, [rsp + 0x110]
lea r9, [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov rcx, qword [rsp + 0x250]
mov edx, 0x26
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
mov ecx, dword [rsp + 0x110]
cmp ecx, 0x44464d55
je 0x14004d3a0
cmp ecx, 0x2d4d5744
je 0x14004d3a0
test eax, eax
je 0x14004d54c
mov rcx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rsi, r13
sub rsi, rcx
mov rax, r13
sub rax, rcx
je 0x14004d568
mov rbp, qword [rcx]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + r14*8]
mov qword [rcx], rax
mov r13, qword [rsp + 0x68]
cmp r13, qword [rsp + 0x70]
je 0x14004d58e
mov qword [r13], rbp
jmp 0x14004d580
mov rbp, qword [rsp + 0x40]
mov r13, qword [rsp + 0x68]
cmp r13, qword [rsp + 0x70]
je 0x14004d5fa
mov rax, qword [rbp + r14*8]
jmp 0x14004d57c
mov rdi, qword [rsp + 0x40]
cmp r13, qword [rsp + 0x70]
je 0x14004d666
mov rax, qword [rdi + r14*8]
mov qword [r13], rax
add r13, 8
mov qword [rsp + 0x68], r13
jmp 0x14004d892
mov r15, qword [rsp + 0x60]
mov rdi, r13
sub rdi, r15
mov rsi, rdi
sar rsi, 3
lea rax, [rsi + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
ja 0x14004dc4c
mov rbx, rdi
shr rbx, 2
cmp rbx, rax
cmovbe rbx, rax
movabs rax, 0x7ffffffffffffff8
cmp rdi, rax
cmovae rbx, rcx
test rbx, rbx
je 0x14004d6e2
cmp rbx, rcx
ja 0x14004dc47
lea rcx, [rbx*8]
call fcn.14006fb50
jmp 0x14004d6e4
mov r15, qword [rsp + 0x60]
mov rdi, r13
sub rdi, r15
mov rsi, rdi
sar rsi, 3
lea rax, [rsi + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
ja 0x14004dc56
mov rbx, rdi
shr rbx, 2
cmp rbx, rax
cmovbe rbx, rax
movabs rax, 0x7ffffffffffffff8
cmp rdi, rax
cmovae rbx, rcx
test rbx, rbx
je 0x14004d70d
cmp rbx, rcx
ja 0x14004dc60
lea rcx, [rbx*8]
call fcn.14006fb50
jmp 0x14004d70f
sar rsi, 3
lea rcx, [rsi + 1]
mov rbx, rax
shr rbx, 2
cmp rbx, rcx
cmovbe rbx, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
movabs rax, 0x1fffffffffffffff
cmovae rbx, rax
cmp rbx, rax
ja 0x14004dc47
lea rcx, [rbx*8]
call fcn.14006fb50
lea rcx, [rax + rsi*8]
mov rdx, qword [rdi + r14*8]
mov qword [rax + rsi*8], rdx
lea rdx, [rax + rsi*8]
add rdx, 8
lea rax, [rax + rbx*8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
test r13, r13
jne 0x14004d88a
jmp 0x14004d892
xor eax, eax
lea rcx, [rax + rsi*8]
mov qword [rax + rsi*8], rbp
mov r8, r13
sub r8, r15
je 0x14004d86a
add r8, 0xfffffffffffffff8
cmp r8, 0x98
jae 0x14004d73d
mov rdx, r13
jmp 0x14004d7d0
xor eax, eax
lea rcx, [rax + rsi*8]
mov rdx, qword [rbp + r14*8]
mov qword [rax + rsi*8], rdx
mov r8, r13
sub r8, r15
je 0x14004d86a
add r8, 0xfffffffffffffff8
cmp r8, 0x98
jae 0x14004d751
mov rdx, r13
jmp 0x14004d850
add rdi, rax
mov rdx, r13
sub rdx, rdi
cmp rdx, 0x20
jae 0x14004d76c
mov rdx, r13
jmp 0x14004d7d0
add rdi, rax
mov rdx, r13
sub rdx, rdi
cmp rdx, 0x20
jae 0x14004d7e7
mov rdx, r13
jmp 0x14004d850
shr r8, 3
inc r8
mov r9, r8
and r9, 0xfffffffffffffffc
lea r10, [r9*8]
sub rcx, r10
mov rdx, r13
sub rdx, r10
lea r10, [rax + rsi*8]
add r10, 0xfffffffffffffff0
mov r11, r9
neg r11
xor edi, edi
nop dword [rax + rax]
movups xmm0, xmmword [r13 + rdi*8 - 0x20]
movups xmm1, xmmword [r13 + rdi*8 - 0x10]
movups xmmword [r10 + rdi*8], xmm1
movups xmmword [r10 + rdi*8 - 0x10], xmm0
add rdi, 0xfffffffffffffffc
cmp r11, rdi
jne 0x14004d7a0
cmp r8, r9
je 0x14004d865
nop dword [rax]
mov r8, qword [rdx - 8]
add rdx, 0xfffffffffffffff8
mov qword [rcx - 8], r8
add rcx, 0xfffffffffffffff8
cmp rdx, r15
jne 0x14004d7d0
jmp 0x14004d865
shr r8, 3
inc r8
mov r9, r8
and r9, 0xfffffffffffffffc
lea r10, [r9*8]
sub rcx, r10
mov rdx, r13
sub rdx, r10
lea r10, [rax + rsi*8]
add r10, 0xfffffffffffffff0
mov r11, r9
neg r11
xor edi, edi
nop word cs:[rax + rax]
movups xmm0, xmmword [r13 + rdi*8 - 0x20]
movups xmm1, xmmword [r13 + rdi*8 - 0x10]
movups xmmword [r10 + rdi*8], xmm1
movups xmmword [r10 + rdi*8 - 0x10], xmm0
add rdi, 0xfffffffffffffffc
cmp r11, rdi
jne 0x14004d820
cmp r8, r9
je 0x14004d865
nop word cs:[rax + rax]
mov r8, qword [rdx - 8]
add rdx, 0xfffffffffffffff8
mov qword [rcx - 8], r8
add rcx, 0xfffffffffffffff8
cmp rdx, r15
jne 0x14004d850
mov r13, qword [rsp + 0x60]
lea rdx, [rax + rbx*8]
lea rax, [rax + rsi*8]
add rax, 8
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdx
test r13, r13
je 0x14004d892
mov rcx, r13
call fcn.14006fbd0
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movabs rax, 0xffffffff00000000
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + r14*8]
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0xd8]
lea rdx, [rsp + 0x110]
call fcn.140071dc0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0xf4], eax
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov r15b, 1
cmp rsi, rbx
jne 0x14004d92d
jmp 0x14004da30
test eax, eax
jne 0x14004da2d
nop dword [rax + rax]
add rsi, 0x28
cmp rsi, rbx
je 0x14004da30
test byte [rsp + 0xd8], 1
mov rcx, r12
je 0x14004d942
mov rcx, qword [rsp + 0xe8]
test byte [rsi + 8], 1
je 0x14004d950
mov rdx, qword [rsi + 0x18]
jmp 0x14004d954
lea rdx, [rsi + 9]
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14004d920
mov eax, dword [rsp + 0xf4]
cmp eax, dword [rsi + 0x24]
jne 0x14004d920
mov eax, dword [rsi + 0x20]
mov ecx, dword [rsp + 0xf0]
cmp eax, ecx
je 0x14004da2d
test ecx, ecx
je 0x14004d910
test eax, eax
jne 0x14004d920
mov rdi, rsi
add rdi, 0x28
cmp rdi, rbx
jne 0x14004d9c8
mov rdi, rsi
cmp rbx, rdi
jne 0x14004da18
jmp 0x14004d9f5
mov rax, qword [rdi + 0x18]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rdi + 8]
movups xmmword [r13], xmm0
mov word [rdi + 8], 0
mov rax, qword [rdi + 0x20]
mov qword [rdi - 8], rax
add rdi, 0x28
cmp rdi, rbx
je 0x14004d9e4
mov rax, qword [rdi]
mov qword [rdi - 0x28], rax
lea r13, [rdi - 0x20]
test byte [rdi - 0x20], 1
je 0x14004d9a0
mov rcx, qword [rdi - 0x10]
call fcn.14006fbd0
jmp 0x14004d9a0
mov rbx, qword [rsp + 0x98]
add rdi, 0xffffffffffffffd8
cmp rbx, rdi
jne 0x14004da18
mov qword [rsp + 0x98], rdi
mov rbx, rdi
cmp rsi, rbx
jne 0x14004d92d
jmp 0x14004da30
mov rbx, r13
cmp r13, rdi
je 0x14004d9f5
lea r13, [rbx - 0x28]
test byte [rbx - 0x20], 1
je 0x14004da10
mov rcx, qword [rbx - 0x10]
call fcn.14006fbd0
jmp 0x14004da10
xor r15d, r15d
mov rcx, qword [rsp + 0x250]
mov edx, 0x16
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
mov r13d, eax
mov rcx, qword [rsp + 0x250]
mov edx, 0x18
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
mov ebp, eax
mov rcx, qword [rsp + 0x250]
mov edx, 0x17
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
test r15b, r15b
je 0x14004daf0
xor ecx, ecx
test r13d, r13d
setne cl
xor edx, edx
or ebp, ecx
setne dl
or eax, edx
jne 0x14004daf0
cmp dword [rsp + 0x110], 0x44464d55
je 0x14004daf0
mov rdi, qword [rsp + 0x98]
cmp rdi, qword [rsp + 0xa0]
je 0x14004dadb
mov rax, qword [rsp + 0xd0]
mov qword [rdi], rax
lea rcx, [rdi + 8]
lea rdx, [rsp + 0xd8]
call fcn.140071170
mov rax, qword [rsp + 0xf0]
mov qword [rdi + 0x20], rax
add rdi, 0x28
mov qword [rsp + 0x98], rdi
jmp 0x14004daf0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xd0]
call fcn.1400519c0
test byte [rsp + 0xd8], 1
je 0x14004d3af
mov rcx, qword [rsp + 0xe8]
call fcn.14006fbd0
jmp 0x14004d3af
mov rsi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
cmp r8, rsi
je 0x14004db57
lea rcx, [0x140288590]
mov rdx, rsi
call fcn.140051c30
jmp 0x14004db57
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
xor esi, esi
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
lea rcx, [0x140288578]
call fcn.140051e30
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x14004dbd2
mov rax, qword [rsp + 0x98]
mov rcx, rdi
cmp rax, rdi
jne 0x14004dba8
jmp 0x14004dbc5
mov rax, rbx
cmp rbx, rdi
je 0x14004dbbd
lea rbx, [rax - 0x28]
test byte [rax - 0x20], 1
je 0x14004dba0
mov rcx, qword [rax - 0x10]
call fcn.14006fbd0
jmp 0x14004dba0
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x98], rdi
call fcn.14006fbd0
test rsi, rsi
je 0x14004dbe4
mov qword [rsp + 0x68], rsi
mov rcx, rsi
call fcn.14006fbd0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14004dbf6
call fcn.14006fbd0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004dc0a
mov qword [rsp + 0x48], rcx
call fcn.14006fbd0
movaps xmm6, xmmword [rsp + 0x560]
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xb0]
call fcn.1400404e0
lea rcx, [rsp + 0x40]
call fcn.1400404e0
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
lea rcx, [rsp + 0x60]
call fcn.1400404e0
lea rcx, [rsp + 0x60]
call fcn.1400404e0
call fcn.140002f60
mov rsi, rax
mov qword [rsp + 0x98], rdi
jmp 0x14004dc93
test byte [rsp + 0xd8], 1
je 0x14004dcc4
mov rcx, qword [rsp + 0xe8]
call fcn.14006fbd0
jmp 0x14004dcc4
lea rcx, [rsp + 0x90]
call fcn.14004c8b0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14004dcf2
mov qword [rsp + 0x68], rcx
call fcn.14006fbd0
jmp 0x14004dcf2
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14004dd0c
mov qword [rsp + 0xb8], rcx
call fcn.14006fbd0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004dd20
mov qword [rsp + 0x48], rcx
call fcn.14006fbd0
mov rcx, rsi
call fcn.14009a110
int3