Function at 0x140001000
Capabilities:
Accept command line arguments
Acquire debug privileges

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x2b0
mov rax, qword [0x14001b008]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov ebx, 0xfffffffe
lea ecx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea edx, [rbx + 0x2a]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400010b0
lea r8, [rsp + 0x70]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400010a5
mov rax, qword [rsp + 0x70]
lea r9d, [rbx + 0x12]
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x7c], rax
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x84], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
test rax, rax
je 0x140001275
cmp dword [rsp + 0x60], 4
jne 0x14000126c
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000126c
mov rcx, qword [rbp + 0x10]
xor edx, edx
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], rdi
mov qword [rsp + 0x2d0], r14
mov r14, qword [rbp + 8]
lea r8d, [rdx + 0xa]
call fcn.140005ce8
mov rcx, qword [rbp + 0x18]
xor edx, edx
mov esi, eax
lea r8d, [rdx + 0xa]
call fcn.140005ce8
mov edi, eax
test eax, eax
je 0x140001254
test esi, esi
je 0x1400011fd
lea rcx, str.USER32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, r14
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400011f6
test rsi, rsi
je 0x1400011f6
lea rdx, str.dummy_debug_proc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400011f6
movabs r8, 0xead293602fcf9778
lea rdx, str._bsfbkmwuKfmfOvI
mov rcx, rsi
call fcn.1400014c0
mov r9d, edi
mov r8, rbx
mov rdx, r14
mov ecx, 3
call rax
mov rsi, rax
test rax, rax
jne 0x1400011cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140001254
mov ebx, 8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9, rsi
xor r8d, r8d
mov edx, 0x5b0
mov ecx, edi
call qword [sym.imp.USER32.dll_PostThreadMessageW]
sub rbx, 1
jne 0x1400011d0
jmp 0x140001254
mov ebx, 0xfffffffc
jmp 0x140001254
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs r8, 0xc82efdf78201df87
lea rdx, str.HxjcQrmkb
mov rcx, rax
call fcn.1400014c0
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rdi, rax
test rax, rax
je 0x14000124f
mov rdx, r14
mov rcx, rax
call fcn.1400012a0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001254
mov ebx, 0xfffffffd
mov rdi, qword [rsp + 0x2c8]
mov rsi, qword [rsp + 0x2c0]
mov r14, qword [rsp + 0x2d0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140001590
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2b0
pop rbp
ret