Function at 0x14004b940
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rbp + 0x27], rax
cmp byte [0x1401a7ecd], 0
jne 0x14004bbaf
call fcn.14004b820
xor edi, edi
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x14004b9e2
lea rcx, [rax + 0x10]
mov r8d, edi
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x14004b9c7
lea r9d, [rax + 2]
cmp edx, r9d
je 0x14004b9c7
cmp edx, eax
je 0x14004b9cf
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x14004b9c0
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14004b990
add eax, 5
cmp edx, eax
jne 0x14004b9d5
xor dword [rcx], r9d
inc dword [r11]
jmp 0x14004b990
lea eax, [r8 - 0x71]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x14004b990
mov esi, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call fcn.14004b790
mov r11, rax
cmp byte [rax + 9], dil
jne 0x14004ba80
mov r8d, edi
mov edx, dword [r11 + 4]
mov r9d, dword [r11]
lea ecx, [rdx + 1]
cmp r9d, ecx
jne 0x14004ba1e
movsxd rax, r8d
inc dl
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004ba00
lea eax, [rdx + 2]
cmp r9d, eax
jne 0x14004ba36
movsxd rax, r8d
add dl, 2
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004ba00
cmp r9d, edx
je 0x14004ba6b
lea eax, [rdx + 4]
cmp r9d, eax
jne 0x14004ba53
movsxd rax, r8d
add dl, 3
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004ba00
lea eax, [rdx + 5]
cmp r9d, eax
jne 0x14004ba77
movsxd rax, r8d
add dl, 4
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004ba00
movsxd rcx, r8d
lea eax, [r8 - 0x72]
xor byte [rcx + r11 + 0xa], al
inc r8d
cmp r8d, 1
jb 0x14004ba00
mov byte [r11 + 9], 1
lea rbx, [r11 + 0xa]
call fcn.14004b390
mov r10, rax
cmp byte [rax + 9], dil
jne 0x14004bb20
mov r8d, edi
nop
mov edx, dword [r10 + 4]
mov r9d, dword [r10]
lea ecx, [rdx + 1]
cmp r9d, ecx
jne 0x14004babe
movsxd rax, r8d
inc dl
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x14004baa0
lea eax, [rdx + 2]
cmp r9d, eax
jne 0x14004bad6
movsxd rax, r8d
add dl, 2
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x14004baa0
cmp r9d, edx
je 0x14004bb0b
lea eax, [rdx + 4]
cmp r9d, eax
jne 0x14004baf3
movsxd rax, r8d
add dl, 3
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x14004baa0
lea eax, [rdx + 5]
cmp r9d, eax
jne 0x14004bb17
movsxd rax, r8d
add dl, 4
xor byte [rax + r10 + 0xa], dl
inc dword [r10]
jmp 0x14004baa0
movsxd rcx, r8d
lea eax, [r8 - 0x72]
xor byte [rcx + r10 + 0xa], al
inc r8d
cmp r8d, 0x1f
jb 0x14004baa0
lea rdx, [r10 + 0xa]
mov byte [r10 + 9], 1
mov r9d, esi
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.14004b8b0
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x14004bb9f
lea rcx, [rax + 0x10]
nop dword [rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x14004bb87
lea r8d, [rax + 2]
cmp edx, r8d
je 0x14004bb87
cmp edx, eax
je 0x14004bb8f
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x14004bb80
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14004bb50
add eax, 5
cmp edx, eax
jne 0x14004bb94
xor dword [rcx], r8d
inc dword [r11]
jmp 0x14004bb50
lea eax, [rdi - 0x71]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x14004bb50
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400441e0
call fcn.140044ab0
cmp byte [0x1401a7ecc], 0
je 0x14004bc4f
cmp byte [0x1401a7e05], 0
jne 0x14004c06d
call fcn.14004c080
mov r11, rax
cmp byte [rax + 0xc], 0
jne 0x14004bc3f
lea rcx, [rax + 0x10]
xor edi, edi
nop word [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x14004bc27
lea r8d, [rax + 2]
cmp edx, r8d
je 0x14004bc27
cmp edx, eax
je 0x14004bc2f
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x14004bc20
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14004bbf0
add eax, 5
cmp edx, eax
jne 0x14004bc34
xor dword [rcx], r8d
inc dword [r11]
jmp 0x14004bbf0
lea eax, [rdi - 0x70]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x14004bbf0
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1401a6da8]
test rcx, rcx
jne 0x14004bc62
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
mov rax, qword [rcx]
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xa0], r15
call qword [rax + reloc.WS2_32.dll_recv]
movabs rax, 0x2ac9aa2121234fab
lea rcx, [rbp - 0x19]
mov qword [rbp - 0x19], rax
movabs r12, 0x86fc748c1e93f46e
mov qword [rbp - 0x11], r12
movabs r13, 0x2ac9aa5559463b85
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 7], r13
mov qword [rbp + 0xf], r12
pxor xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x19], xmm0
call fcn.14004a060
xor edi, edi
xor r15b, r15b
mov qword [rbp - 0x19], rdi
mov dword [rbp - 0x29], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x19]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004bdf2
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x29]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rdi + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14004bdf2
mov r9d, dword [rbp - 0x29]
lea rax, [rbp - 0x29]
mov rcx, qword [rbp - 0x19]
lea edx, [rdi + 1]
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14004bde9
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x14004bde9
mov rcx, qword [rbx]
mov qword [rsp + 0xe0], r14
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
lea r14d, [rax + 0x14]
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14004bde1
lea r8d, [rdi + 2]
mov edx, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x14004bdd8
mov r9, qword [rbx]
lea edx, [rdi + 2]
mov r8d, 0x101001
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x14004bdd8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x30], rdi
lea edx, [rdi + 6]
mov rcx, rax
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 4]
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
sete r15b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0xe0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14004be01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
mov r15, qword [rsp + 0xa0]
jne 0x14004be9f
cmp byte [0x1401a7e05], dil
jne 0x14004c067
call fcn.14004c110
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x14004be8f
lea rcx, [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x14004be77
lea r8d, [rax + 2]
cmp edx, r8d
je 0x14004be77
cmp edx, eax
je 0x14004be7f
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x14004be70
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14004be40
add eax, 5
cmp edx, eax
jne 0x14004be84
xor dword [rcx], r8d
inc dword [r11]
jmp 0x14004be40
lea eax, [rdi - 0x70]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x14004be40
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x1401a7e28]
test rax, rax
jne 0x14004bfbb
movabs rcx, 0x5ca51ad3a2bb8d5f
mov qword [rbp + 7], r13
mov qword [rbp - 9], rcx
movabs rax, 0x52b1d26a213e43fd
mov qword [rbp - 0x19], rax
movabs rax, 0xfe840cb321accb16
mov qword [rbp - 0x11], rax
movabs rax, 0x6bd5b4baf8789a30
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp - 1], rax
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x17], rcx
xor ecx, ecx
mov qword [rbp + 0xf], r12
pxor xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x1f], rax
xor eax, eax
pxor xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm1
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, Ordinal_27
lea r8, [rbp + 7]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov ebx, dword [rbp + 0xf]
mov r9d, edi
test ebx, ebx
je 0x14004bfad
mov r10, qword [rbp - 0x19]
mov r11, qword [rbp + 7]
nop dword [rax + rax]
lea rdx, [0x1400b0ed0]
test r10b, r10b
je 0x14004bf9d
lea r8, [rbp - 0x19]
mov eax, r9d
sub rax, r8
lea rcx, [rbp - 0x19]
lea r8, [rax + r11]
movzx eax, r10b
cmp al, 0x78
jne 0x14004bf8f
movzx eax, byte [rdx]
cmp byte [rcx + r8], al
jne 0x14004bfa5
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x14004bf82
mov eax, r9d
add rax, r11
jmp 0x14004bfb0
inc r9d
cmp r9d, ebx
jb 0x14004bf60
mov rax, rdi
add rax, 0xfffffffffffffffb
mov qword [0x1401a7e28], rax
cmp byte [rax], 0xe9
jne 0x14004c03f
cmp byte [0x1401a7e05], dil
jne 0x14004c067
call fcn.14004c1a0
mov r11, rax
cmp byte [rax + 0xc], dil
jne 0x14004c02f
lea rcx, [rax + 0x10]
nop
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x14004c017
lea r8d, [rax + 2]
cmp edx, r8d
je 0x14004c017
cmp edx, eax
je 0x14004c01f
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x14004c010
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14004bfe0
add eax, 5
cmp edx, eax
jne 0x14004c024
xor dword [rcx], r8d
inc dword [r11]
jmp 0x14004bfe0
lea eax, [rdi - 0x6f]
xor dword [rcx], eax
inc edi
add rcx, 4
cmp edi, 1
jb 0x14004bfe0
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r12, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140092b30
add rsp, 0xa8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140044ea0
int3
call fcn.140044ea0
int3