Function at 0x140003250
Capabilities:
Acquire debug privileges
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x14000f010]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
xor edi, edi
mov dword [rsp + 0x60], edi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r8d, [rdi + 8]
lea rdx, str.edg2.tmp
lea rcx, [rsp + 0x70]
call fcn.140004d20
nop
lea rdx, [rbp + 0xb0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.140004a90
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x14000335b
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000332a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003325
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003394
call fcn.140005dd0
movdqa xmm0, xmmword [0x14000ba20]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], di
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400033a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000339b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000339b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005dd0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x14000b998]
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x60], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x60], rax
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x64], edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x58], rax
mov byte [rbp + 0x24], 0
mov byte [rbp + 0x19], 0
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x28], rdi
mov rax, qword [0x140097ed8]
mov qword [rbp + 0x1c], rax
mov qword [rbp + 0x10], rdi
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
mov edx, 0x22
lea r8d, [rdx + 0x1e]
call qword [sym.imp.MSVCP140.dll_struct__iobuf____ptr64___cdecl_std::_Fiopen_wchar_t_const____ptr64__int__int_]
mov rbx, rax
test rax, rax
je 0x14000355f
mov byte [rbp + 0x24], 1
mov byte [rbp + 0x19], 0
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rsp + 0x68], rdi
mov qword [rbp - 0x70], rdi
mov qword [rsp + 0x60], rdi
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_stream_buffer_pointers]
mov r9, qword [rsp + 0x60]
mov qword [rsp + 0x30], r9
mov r8, qword [rbp - 0x70]
mov qword [rsp + 0x28], r8
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_char____ptr64____ptr64__char____ptr64____ptr64__int____ptr64__char____ptr64____ptr64__char____ptr64____ptr64__int____ptr64____ptr64]
mov qword [rbp + 0x28], rbx
mov rax, qword [0x140097ed8]
mov qword [rbp + 0x1c], rax
mov qword [rbp + 0x10], rdi
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_public:_class_std::locale___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::getloc_void____ptr64]
nop
mov rcx, rax
call fcn.140004c10
mov rbx, rax
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::codecvt_base::always_noconv_void_const___ptr64]
test al, al
je 0x14000350e
mov qword [rbp + 0x10], rdi
jmp 0x14000351d
mov qword [rbp + 0x10], rbx
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003543
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140003543
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x14000357b
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8d, 0x88400
lea rdx, [0x14000f070]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x58]
call fcn.140004800
test rax, rax
jne 0x1400035bc
mov rax, qword [rbp - 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x60]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140003730
mov qword [rsp + 0x68], rdi
lea r8, [rsp + 0x68]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140003730
mov dword [rbp - 0x70], 1
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x6c], rax
mov dword [rbp - 0x64], 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140003730
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140003653
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x14000366d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002350
test al, al
jne 0x1400036ea
lea rcx, [rbp - 0x60]
call fcn.140003790
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400036c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000377e
call fcn.140005dd0
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.140005db0
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.140002910
nop
test al, al
je 0x140003676
call fcn.140002be0
test al, al
je 0x140003676
call fcn.140003080
test al, al
je 0x140003676
xor r9d, r9d
lea r8, str.DarkNight
lea rdx, str.Injected
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rbp - 0x60]
call fcn.140003790
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400036c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3