Function at 0x7ff74b09bf4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rbp, rcx
xor ecx, ecx
xor eax, eax
mov rsi, rdx
mov qword [r11 - 0xf8], rcx
mov qword [r11 - 0xe0], rcx
mov dword [rsp + 0x78], ecx
mov r12, rcx
mov r13, rcx
mov qword [rsp + 0x60], rcx
mov r14d, ecx
lea rdx, [r11 - 0xf8]
mov rcx, rbp
mov edi, r8d
mov qword [r11 - 0xd8], rax
mov qword [r11 - 0xd0], rax
call fcn.7ff74af7ed0
mov r15, qword [rsp + 0x1c0]
xor edx, edx
mov ebx, eax
cmp eax, edx
jne 0x7ff74b09fdd
mov rax, qword [rsp + 0x1b0]
mov dword [rsp + 0xd0], 0x68
mov qword [rsp + 0xd8], rdx
mov qword [rax], rdx
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0xe0], rdx
mov dword [rax], edx
cmp byte [rbp + 0x24], 3
je 0x7ff74b206d4
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0xe8], rax
mov rcx, qword [rbp + 0x10]
mov dword [rsp + 0x10c], edx
mov word [rsp + 0x112], dx
mov qword [rsp + 0x118], rdx
cmp rcx, rdx
je 0x7ff74b206e1
mov rcx, qword [rcx + 0xb8]
lea rdx, [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x50]
xor edx, edx
cmp eax, edx
jl 0x7ff74b2075a
cmp dword [rsp + 0x88], 1
mov eax, edx
sete al
jmp 0x7ff74b09d0b
cmp eax, edx
je 0x7ff74b2075a
cmp edi, edx
jne 0x7ff74b20737
xor edi, edi
cmp rsi, rdi
je 0x7ff74b206e8
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_ImpersonateLoggedOnUser]
cmp eax, edi
je 0x7ff74b206e8
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_RevertToSelf]
jmp 0x7ff74b09d40
mov ecx, dword [rsp + 0x198]
call fcn.7ff74aee580
mov rsi, rax
cmp rax, rdi
je 0x7ff74b09d71
mov rdx, qword [rsp + 0x188]
mov r8, rax
mov rcx, rbp
call fcn.7ff74b0a55c
cmp eax, edi
mov ebx, eax
jl 0x7ff74b2098c
mov rax, qword [rbp + 0x10]
cmp rax, rdi
je 0x7ff74b2073e
mov ecx, dword [rax + 0x3c]
jmp 0x7ff74b09d83
test cl, 1
jne 0x7ff74b20745
cmp rsi, rdi
je 0x7ff74b2094e
mov rcx, rsi
call fcn.7ff74b0a480
mov rdi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x7ff74b208b3
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x7ff74b2082f
mov ecx, dword [rax + 0x3c]
jmp 0x7ff74b09dc0
test cl, 2
jne 0x7ff74b20836
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
mov r8d, 0x90
call qword [0x7ff74b58358]
mov r12, rax
test rax, rax
je 0x7ff74b2089e
and qword [rax + 0x10], 0
and qword [rax + 0x18], 0
mov qword [rax], rdi
mov qword [rax + 8], r13
jmp 0x7ff74b09dfd
test r12, r12
je 0x7ff74b208a6
mov eax, r14d
mov ecx, 0x1fffff
mov dword [rsp + 0x28], 0x100000
neg eax
mov eax, r14d
mov dword [rsp + 0x20], 0x100001
sbb r9d, r9d
not r9d
and r9d, ecx
neg eax
sbb r8d, r8d
and r8d, ecx
neg r14d
mov rcx, r12
sbb edx, edx
and edx, 3
call fcn.7ff74af7c00
xor r14d, r14d
cmp rax, r14
je 0x7ff74b208b3
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov rdx, rsi
mov dword [rsp + 0xb0], 0x18
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xc0], r14d
mov qword [rsp + 0x70], r14
call fcn.7ff74b0a618
mov qword [rsp + 0x60], r14
mov edi, eax
cmp eax, r14d
je 0x7ff74b09e99
mov rcx, qword [rbp + 0x50]
cmp rcx, r14
jne 0x7ff74b208bd
mov rcx, rsi
mov qword [rsp + 0x60], rcx
cmp edi, r14d
je 0x7ff74b09f45
cmp dword [rsp + 0x198], r14d
je 0x7ff74b09ed3
mov r9d, 4
lea r8, [rsp + 0x198]
lea edx, [r9 + 8]
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_SetTokenInformation]
mov rcx, qword [rsp + 0x60]
mov edi, eax
cmp edi, r14d
je 0x7ff74b09f45
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_ImpersonateLoggedOnUser]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x98]
lea r9, [rsp + 0xb0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x410
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [0x7ff74b58028]
mov edi, eax
call qword [sym.imp.API_MS_Win_Security_Base_L1_1_0.dll_RevertToSelf]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
cmp rax, r14
je 0x7ff74b09f5c
mov rcx, rax
call fcn.7ff74b0a470
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x7ff74b09f6b
cmp qword [rbp + 0x50], r14
jne 0x7ff74b208df
cmp edi, r14d
je 0x7ff74b208eb
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x1b0]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x1b8]
mov eax, dword [rsp + 0xa8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x7ff74b09fa8
mov rdi, qword [rsp + 0x68]
jmp 0x7ff74b09faf
cmp rsi, r14
je 0x7ff74b09fbd
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
cmp rdi, r14
je 0x7ff74b09fd4
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp r13, r14
jne 0x7ff74b20994
mov rdi, qword [rsp + 0x80]
cmp rdi, r14
je 0x7ff74b09ffc
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp dword [rsp + 0x78], r14d
jne 0x7ff74b209a3
mov qword [r15], r14
cmp r12, r14
je 0x7ff74b0a029
mov rcx, r12
call fcn.7ff74af7fb0
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov eax, ebx
mov rbx, qword [rsp + 0x180]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0xe8], rdx
jmp 0x7ff74b09cb9
mov eax, edx
jmp 0x7ff74b09d0b
mov ebx, 0x80070005
cmp dword [0x7ff74b582c8], edi
je 0x7ff74b09fdd
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b09fdd
test byte [rcx + 0x1c], 1
je 0x7ff74b09fdd
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51720]
mov edx, 0xd
mov r9d, ebx
call fcn.7ff74b25ec4
jmp 0x7ff74b09fdd
xor edi, edi
jmp 0x7ff74b09d40
mov ecx, edi
jmp 0x7ff74b09d83
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xe0], rax
jmp 0x7ff74b09d8c
mov rax, qword [rbp + 0x10]
xor edi, edi
mov r10, rdi
cmp rax, rdi
je 0x7ff74b2076d
mov ecx, dword [rax + 0x3c]
jmp 0x7ff74b2076f
mov ecx, edi
test cl, 2
je 0x7ff74b2077b
mov r10, qword [rax + 0xc0]
cmp rax, rdi
je 0x7ff74b20786
mov r9, qword [rax + 0x18]
jmp 0x7ff74b20789
mov r9, rdi
cmp rax, rdi
je 0x7ff74b20794
mov r8, qword [rax + 0x20]
jmp 0x7ff74b20797
mov r8, rdi
lea rdx, [rax + 0x54]
cmp rax, rdi
jne 0x7ff74b207a3
mov rdx, rdi
mov ecx, dword [rsp + 0x1a0]
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], 1
call fcn.7ff74b38034
mov rsi, rax
mov qword [rsp + 0x70], rax
cmp rax, rdi
je 0x7ff74b2094e
cmp dword [0x7ff74b5832c], edi
je 0x7ff74b09d8c
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x70]
mov ecx, 7
mov qword [rsp + 0x90], rdi
mov qword [r15], rdi
call fcn.7ff74b3a5e0
cmp eax, edi
mov ebx, eax
jl 0x7ff74b20814
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax + 0x48]
mov rax, qword [rcx + 8]
mov qword [r15], rax
cmp ebx, edi
mov rsi, qword [rsp + 0x70]
jl 0x7ff74b2082a
mov dword [rsp + 0x78], 1
jmp 0x7ff74b09d8c
jmp 0x7ff74b09faf
xor ecx, ecx
jmp 0x7ff74b09dc0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.7ff74af9bf0
cmp eax, r14d
mov ebx, eax
jge 0x7ff74b2088e
cmp dword [0x7ff74b582c8], r14d
je 0x7ff74b20884
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b20884
test byte [rcx + 0x1c], 1
je 0x7ff74b20884
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51720]
mov edx, 0xf
mov r9d, ebx
call fcn.7ff74b25ec4
mov r13, qword [rsp + 0x60]
jmp 0x7ff74b09faf
mov r13, qword [rsp + 0x60]
mov r14d, 1
jmp 0x7ff74b09dc9
xor r12d, r12d
jmp 0x7ff74b09dfd
mov ebx, 0x8007000e
xor r14d, r14d
jmp 0x7ff74b09faf
mov ebx, 0x8007000e
jmp 0x7ff74b09faf
lea r8, [rsp + 0x60]
xor r9d, r9d
mov rdx, rsi
mov qword [rsp + 0x20], r14
call qword [0x7ff74b58078]
mov rcx, qword [rsp + 0x60]
mov edi, eax
jmp 0x7ff74b09ea1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x7ff74b09f6b
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov rax, qword [rbp + 0x10]
cmp rax, r14
je 0x7ff74b2090e
mov rdx, qword [rax + 0x20]
jmp 0x7ff74b20911
mov rdx, r14
cmp rax, r14
je 0x7ff74b2091c
mov rcx, qword [rax + 0x18]
jmp 0x7ff74b2091f
mov rcx, r14
mov r9, qword [rsp + 0x80]
mov r8, qword [rsp + 0x188]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0x1a0]
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call fcn.7ff74b3db00
nop
jmp 0x7ff74b09fa8
mov ebx, 0x8000401a
cmp dword [0x7ff74b582c8], edi
je 0x7ff74b2098c
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b2098c
test byte [rcx + 0x1c], 1
je 0x7ff74b2098c
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51720]
mov edx, 0xe
mov r9d, ebx
call fcn.7ff74b25ec4
mov rdi, r12
jmp 0x7ff74b09faf
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x7ff74b09fdd
cmp ebx, r14d
jge 0x7ff74b0a00a
mov rdx, qword [r15]
xor ecx, ecx
call fcn.7ff74b3ad74
nop
jmp 0x7ff74b0a007