Function at 0x1400235a0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
test rcx, rcx
je 0x1400237a6
mov rsi, rdx
test rdx, rdx
je 0x1400237a6
lea rdi, [rsp + 0x40]
mov ebx, r8d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, 1
mov r12, rcx
call sym.SysNtQueryInformationToken
test eax, eax
jns 0x140023786
mov ecx, dword [rsp + 0x40]
call sym.MmHeapAlloc
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0x40]
mov rcx, r12
mov r8, rax
mov edx, 1
mov r13, rax
call sym.SysNtQueryInformationToken
test eax, eax
js 0x1400237ab
lea rbp, [rsp + 0x44]
lea rdi, [rsp + 0x4c]
xor r8d, r8d
xor ecx, ecx
mov rax, qword [0x14002d650]
lea r14, [rsp + 0x48]
mov r9, rbp
mov rax, qword [rax]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
mov rdx, qword [r13]
call qword [rax + 0x618]
test eax, eax
jne 0x140023764
mov dword [rsp + 0x4c], 0
cmp ebx, 1
jne 0x140023697
mov eax, dword [rsp + 0x44]
lea ecx, [rax + rax]
jmp 0x1400236a6
mov ecx, dword [rsp + 0x48]
cmp ebx, 2
je 0x1400236a4
add ecx, dword [rsp + 0x44]
add ecx, ecx
mov dword [rsi + 8], ecx
call sym.MmHeapAlloc
mov r12d, dword [rsp + 0x48]
mov qword [rsi], rax
mov r15, rax
cmp ebx, 1
jne 0x1400236cf
lea ecx, [r12 + r12]
call sym.MmHeapAlloc
mov r12, qword [rsi]
mov r15, rax
jmp 0x1400236eb
cmp ebx, 2
je 0x1400236dc
add r12, r12
add r12, rax
jmp 0x1400236eb
mov eax, dword [rsp + 0x44]
lea ecx, [rax + rax]
call sym.MmHeapAlloc
mov r12, rax
mov rax, qword [0x14002d650]
mov r9, rbp
mov r8, r12
xor ecx, ecx
mov rax, qword [rax]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r15
mov rdx, qword [r13]
call qword [rax + 0x618]
mov r14d, eax
test eax, eax
jne 0x14002374d
mov rax, qword [0x14002d650]
mov r8d, 0xa2
lea rdx, str.TokenQueryOwner
lea rcx, str._DEBUG::_s::_d__LookupAccountSidW_Error____d_n
mov rax, qword [rax]
mov rax, qword [rax + 0x8c2]
mov r9d, dword [rax + 0x68]
call sym.DbgPrint
jmp 0x1400237b9
mov r14d, 1
test ebx, ebx
jne 0x1400237b9
mov edx, dword [rsp + 0x48]
mov rax, qword [rsi]
mov byte [rax + rdx*2], 0x5c
jmp 0x1400237b9
lea r9, str.Unexpected_successful_call_to_LookupAccountSidW._n
mov r8d, 0xae
lea rdx, str.TokenQueryOwner
lea rcx, [0x14002b0d0]
call sym.printf.constprop.0
jmp 0x1400237b0
lea r9, str.Unexpected_successful_call_to_NtQueryInformationToken._n
mov r8d, 0xb1
lea rdx, str.TokenQueryOwner
lea rcx, [0x14002b0d0]
call sym.printf.constprop.0
xor r14d, r14d
jmp 0x140023823
test r13, r13
je 0x14002381c
xor r12d, r12d
xor r15d, r15d
xor r14d, r14d
xor esi, esi
mov ecx, dword [rsp + 0x40]
mov rdi, r13
mov eax, esi
rep stosb byte [rdi], al
mov rbp, qword [0x14002d650]
mov rcx, r13
mov rax, qword [rbp]
call qword [rax + 0x3b0]
cmp ebx, 1
jne 0x1400237f8
test r15, r15
je 0x140023823
mov ecx, dword [rsp + 0x48]
mov rdi, r15
mov eax, esi
rep stosb byte [rdi], al
mov rax, qword [rbp]
mov rcx, r15
jmp 0x140023814
cmp ebx, 2
jne 0x140023823
test r12, r12
je 0x140023823
mov ecx, dword [rsp + 0x44]
mov rdi, r12
mov eax, esi
rep stosb byte [rdi], al
mov rax, qword [rbp]
mov rcx, r12
call qword [rax + 0x3b0]
jmp 0x140023823
xor r14d, r14d
dec ebx
jne 0x1400237a6
add rsp, 0x58
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret