Function at 0x1401365a0
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x1b0]
xorps xmm0, xmm0
mov rdi, rcx
mov qword [rbp - 8], r9
xor esi, esi
mov qword [rbp - 0x10], r8
mov ecx, edx
mov qword [rbp], rax
and ecx, 0x3000
mov qword [rbp - 0x78], rsi
xor r12b, r12b
mov dword [rbp + 0xb0], 0x68
mov r14d, edx
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
cmp ecx, 0x3000
jne 0x14013663b
mov eax, 0xc00000f0
jmp 0x1401371d4
nop dword [rax + rax]
cmp qword [rdi], rsi
jne 0x140136655
cmp qword [rdi + 8], rsi
jne 0x140136655
mov eax, 0xc0000030
jmp 0x1401371d4
mov qword [rsp + 0x258], rbx
mov eax, 1
mov dword [rbp + 0xec], eax
mov word [rbp + 0xf0], ax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x250], r13
mov qword [rsp + 0x248], r15
mov r15, 0xffffffffffffffff
mov qword [rbp + 0xc0], rax
bt r14d, 0x12
jae 0x1401368ae
test ecx, ecx
mov r13d, esi
sete al
bt r14d, 0x10
movzx ecx, al
cmovae r13d, ecx
bt r14d, 0x11
jae 0x1401366ed
lea r9d, [r15 + 5]
mov qword [rsp + 0x20], rsi
lea r8, [rbp + 0x12c]
mov rcx, r15
lea edx, [r15 + 0x19]
mov ebx, 0xffffffff
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
movzx r13d, r13b
cmovns ebx, dword [rbp + 0x12c]
cmp dword [rdi + 0x28], ebx
cmovne r13d, esi
mov eax, dword [rdi + 0x48]
test eax, eax
je 0x1401366fd
cmp eax, 2
jne 0x1401368ae
nop dword [rax]
test r13b, r13b
je 0x1401368ae
mov rcx, qword ds:[rdi + 8]
xor eax, eax
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
mov rbx, rsi
movups xmmword [rbp - 0x58], xmm0
test rcx, rcx
je 0x14013672d
call sym.SystemInformer.exe_PhCreateString
mov rbx, rax
mov r8, qword [rdi + 0x18]
test r8, r8
jne 0x140136740
or r14d, 2
nop word [rax + rax]
mov ecx, r14d
shr ecx, 5
and ecx, 1
mov edx, ecx
or edx, 2
test r14b, 0x40
cmove edx, ecx
mov ecx, edx
or ecx, 4
test r14b, 4
cmove ecx, edx
mov edx, ecx
or edx, 0x10
test r14b, 0x10
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
test r14b, 2
cmove ecx, edx
mov edx, ecx
bts edx, 0x13
test r14b, 0x80
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
test r14b, 8
cmove ecx, edx
mov edx, ecx
bts edx, 0x1a
bt r14d, 8
cmovae edx, ecx
test rbx, rbx
je 0x1401367ad
mov rcx, qword [rbx + 8]
jmp 0x1401367b0
mov rcx, rsi
lea rax, [rbp - 0x58]
mov r9d, 1
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x38], r8
mov r8, qword [rdi + 0x40]
mov dword [rsp + 0x30], edx
mov rdx, qword [rdi + 0x30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
nop dword [rax]
test eax, eax
jne 0x140136813
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov esi, eax
test rbx, rbx
je 0x14013682d
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x14013682d
call fcn.14013d2a0
test esi, esi
js 0x140136885
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140136847
mov eax, dword [rbp - 0x48]
mov qword [rcx], rax
mov eax, dword [rbp - 0x44]
mov qword [rcx + 8], rax
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140136859
mov rax, qword [rbp - 0x58]
mov qword [rcx], rax
jmp 0x14013686b
mov rcx, qword ds:[rbp - 0x58]
test rcx, rcx
je 0x14013686b
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140136894
mov rax, qword ds:[rbp - 0x50]
mov qword [rcx], rax
jmp 0x1401371ba
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140136894
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp - 0x50]
test rcx, rcx
je 0x1401371ba
jmp 0x1401371b4
bt r14d, 0xc
jae 0x140136985
cmp dword [0x1402c2f94], 3
lea rcx, [rbp - 0x70]
mov rax, qword [rdi + 0x30]
mov edx, 0x1000
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rsi
jl 0x1401368e7
lea r8, ds:[rbp + 0x28]
call fcn.14016dca0
jmp 0x140136916
xorps xmm0, xmm0
mov dword [rbp + 0x50], 0x30
lea r9, [rbp + 0x28]
mov qword [rbp + 0x58], rsi
lea r8, [rbp + 0x50]
mov dword [rbp + 0x68], esi
movdqu xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x60], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
je 0x140136979
test eax, eax
js 0x140136979
mov r12, qword [rbp - 0x70]
lea r8, [rsp + 0x68]
mov r13d, dword [0x1402c2f94]
mov rcx, r12
mov edx, 0xf01ff
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140136961
cmp r13d, 5
jne 0x140136961
lea r8, [rsp + 0x68]
mov edx, 0xf01ff
mov rcx, r12
call fcn.14016dde0
mov ebx, eax
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x1401369e1
lfence
mov eax, ebx
jmp 0x1401371bc
lfence
jmp 0x1401371bc
bt r14d, 0xd
jae 0x140136a7b
call fcn.140169e20
test rax, rax
jne 0x1401369a5
mov eax, 0xc000007a
jmp 0x1401371bc
call fcn.140169e20
mov edx, dword [rdi + 0x30]
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x28], rcx
lea r9, [rbp + 0x28]
xor ecx, ecx
mov dword [rsp + 0x20], 0x18
mov r8d, 0xe
call qword [str.PB__]
test al, al
je 0x140136b52
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x68], rax
mov r12d, r14d
shr r12d, 0x11
and r12b, 1
bt r14d, 0x10
jae 0x140136b6e
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x130]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x120]
lea edx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop
test eax, eax
js 0x140136b6e
mov rbx, qword [rbp + 0x120]
lea rax, [rbp + 8]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
test eax, eax
js 0x140136b65
cmp dword ds:[rsp + 0x60], 1
jne 0x140136b65
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x68], rbx
jmp 0x140136be5
mov ebx, dword [rdi + 0x48]
test ebx, ebx
mov dword [rsp + 0x60], ebx
lea rbx, [rdi + 0x30]
jne 0x140136b26
mov rcx, qword [rdi + 0x30]
mov dword [rsp + 0x60], 2
movzx eax, word [rcx]
xor ax, 0x4e
test al, 0x1f
jne 0x140136b26
lea rdx, str.NT_AUTHORITY
call fcn.1401e420c
test eax, eax
jne 0x140136b26
mov rcx, qword [rdi + 0x38]
movzx eax, word [rcx]
xor ax, 0x53
test al, 0x1f
jne 0x140136adc
lea rdx, str.SYSTEM
call fcn.1401e420c
test eax, eax
je 0x140136b1a
mov rcx, qword [rdi + 0x38]
movzx eax, word [rcx]
xor ax, 0x4c
test al, 0x1f
jne 0x140136afb
lea rdx, str.LOCAL_SERVICE
call fcn.1401e420c
test eax, eax
je 0x140136b1a
mov rcx, qword [rdi + 0x38]
movzx eax, word [rcx]
lea rbx, [rdi + 0x30]
xor ax, 0x4e
test al, 0x1f
jne 0x140136b26
lea rdx, str.NETWORK_SERVICE
call fcn.1401e420c
test eax, eax
jne 0x140136b26
mov r9d, 5
lea rbx, [rdi + 0x30]
jmp 0x140136b2b
mov r9d, dword [rsp + 0x60]
mov r8, qword [rdi + 0x40]
lea rax, [rsp + 0x68]
mov rdx, qword [rbx]
mov rcx, qword [rdi + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
jne 0x1401369ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
nop
jmp 0x1401371bc
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test r12b, r12b
je 0x140136be5
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x10]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0x80]
mov dword [rbp + 0x80], 0x30
mov edx, 0xf01ff
mov qword [rbp + 0x88], rsi
mov dword [rbp + 0x98], esi
mov qword [rbp + 0x90], rsi
movdqu xmmword [rbp + 0xa0], xmm0
call qword [sym.imp.ntdll.dll_NtDuplicateToken]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x14013696f
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x68], rax
bt r14d, 0x11
jae 0x140136c11
mov eax, dword [rdi + 0x28]
lea r8, [rbp - 0x60]
mov rcx, qword [rsp + 0x68]
mov r9d, 4
mov dword [rbp - 0x60], eax
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
js 0x140136c44
bt r14d, 0x13
jae 0x140136c59
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x128]
mov r9d, 4
mov dword [rbp + 0x128], 1
lea edx, [r9 + 0x16]
call qword [sym.imp.ntdll.dll_NtSetInformationToken]
mov ebx, eax
test eax, eax
jns 0x140136c59
lfence
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
jmp 0x1401371bc
cmp qword [rdi + 0x18], rsi
jne 0x140136c90
nop
call fcn.140169720
test rax, rax
je 0x140136c90
call fcn.140169720
mov rdx, qword ds:[rsp + 0x68]
lea rcx, [rbp - 0x78]
xor r8d, r8d
call qword [str.PB__]
cmp qword [rbp - 0x78], rsi
je 0x140136c90
or r14d, 2
mov rax, qword [rdi + 0x18]
mov r13, rsi
mov r12, qword [rbp - 0x78]
test rax, rax
mov rcx, qword [rdi + 8]
mov rbx, qword [rdi]
cmovne r12, rax
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x20], rax
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x18], rax
mov qword [rbp - 0x80], r12
mov qword [rsp + 0x78], rsi
test rcx, rcx
je 0x140136cd0
call sym.SystemInformer.exe_PhCreateString
mov r13, rax
test rbx, rbx
je 0x140136cea
mov rcx, rbx
call sym.SystemInformer.exe_PhCreateString
mov rdi, rax
mov qword [rsp + 0x78], rax
jmp 0x140136f39
lea r9, [rsp + 0x78]
mov rcx, r13
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x40]
call sym.SystemInformer.exe_PhParseCommandLineFuzzy
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x140136d12
cmp qword [rdi], rsi
jne 0x140136d90
mov r12, qword [rbp - 0x40]
test r12, r12
jne 0x140136d2a
nop dword [rax + rax]
call sym.SystemInformer.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x140136d65
mov rdx, qword [0x1402bfcf8]
lea rcx, [r12 + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdx, qword [rbp - 0x38]
mov rbx, rax
mov qword [rax], r12
add rax, 0x10
mov qword [rbx + 8], rax
mov word [r12 + rax], si
test rdx, rdx
je 0x140136d65
mov rcx, qword ds:[rbx + 8]
mov r8, r12
call fcn.1401e3aa0
mov rcx, rdi
mov qword [rsp + 0x78], rbx
mov rdi, rbx
test rcx, rcx
je 0x140136d94
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140136d8b
call fcn.14013d2a0
mov rdi, qword [rsp + 0x78]
mov r12, qword [rbp - 0x40]
mov rax, qword [0x1402bb660]
mov rdx, qword [0x1402bfcf8]
lea rbx, [r12 + rax*2]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov qword [rbp - 0x68], rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rbx, qword [rax + 8]
mov r8, qword [0x1402bb660]
mov rcx, rbx
mov rdx, qword [str.hd_]
call fcn.1401e3aa0
add rbx, qword [0x1402bb660]
mov r8, r12
mov rdx, qword [rbp - 0x38]
mov rcx, rbx
call fcn.1401e3aa0
mov r8, qword [0x1402bb660]
lea rcx, [r12 + rbx]
mov rdx, qword [str.hd_]
call fcn.1401e3aa0
mov rcx, qword [rbp + 0x40]
mov r12, qword [rbp - 0x68]
mov rax, r12
test rcx, rcx
je 0x140136eb6
mov rbx, qword [r12]
mov rdx, qword [0x1402bfcf8]
add rbx, rcx
add rbx, qword [0x1402bb690]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov qword ds:[rbp - 0x68], rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rbx, qword [rax + 8]
mov r8, qword [r12]
mov rcx, rbx
mov rdx, qword [r12 + 8]
call fcn.1401e3aa0
add rbx, qword [r12]
mov r8, qword [0x1402bb690]
mov rcx, rbx
mov rdx, qword [str.ld_]
call fcn.1401e3aa0
add rbx, qword [0x1402bb690]
mov r8, qword [rbp + 0x40]
mov rcx, rbx
mov rdx, qword [rbp + 0x48]
call fcn.1401e3aa0
lea rcx, [r12 - 0x10]
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140136ead
call fcn.14013d2a0
mov rax, qword [rbp - 0x68]
mov rdi, qword [rsp + 0x78]
mov rcx, r13
mov r13, rax
test rcx, rcx
je 0x140136ee0
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140136edb
call fcn.14013d2a0
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x140136f35
mov rcx, qword [rdi + 8]
call sym.SystemInformer.exe_PhDoesFileExistWin32
test al, al
jne 0x140136f35
mov rcx, qword ds:[rdi + 8]
lea rdx, str..exe
call fcn.14013ad00
mov rcx, rdi
test rax, rax
je 0x140136f52
mov rdi, rax
mov qword [rsp + 0x78], rax
test rcx, rcx
je 0x140136f35
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140136f30
call fcn.14013d2a0
mov rdi, qword [rsp + 0x78]
mov r12, qword [rbp - 0x80]
mov rax, qword ds:[rbp + 0x18]
test rax, rax
je 0x140136f5c
mov rcx, rax
call sym.SystemInformer.exe_PhCreateString
mov rbx, rax
jmp 0x140136f7a
mov rdi, rsi
mov qword [rsp + 0x78], rsi
jmp 0x140136f15
nop dword [rax]
test rdi, rdi
je 0x140136f77
cmp qword [rdi], rsi
je 0x140136f77
mov rcx, rdi
call sym.SystemInformer.exe_PhGetBaseDirectory
mov rbx, rax
jmp 0x140136f7a
mov rbx, rsi
mov ecx, r14d
shr ecx, 5
and ecx, 1
mov edx, ecx
or edx, 2
test r14b, 0x40
cmove edx, ecx
mov ecx, edx
or ecx, 4
test r14b, 4
cmove ecx, edx
mov edx, ecx
or edx, 0x10
test r14b, 0x10
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
test r14b, 2
cmove ecx, edx
mov edx, ecx
bts edx, 0x13
test r14b, 0x80
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
test r14b, 8
cmove ecx, edx
mov r9d, ecx
bts r9d, 0x1a
bt r14d, 8
cmovae r9d, ecx
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140137050
test r13, r13
je 0x140136ff3
mov r8, qword [r13 + 8]
jmp 0x140136ff6
mov r8, rsi
test rdi, rdi
je 0x140137002
mov rdx, qword ds:[rdi + 8]
jmp 0x140137005
mov rdx, rsi
test rbx, rbx
je 0x140137010
mov rax, qword [rbx + 8]
jmp 0x140137013
mov rax, rsi
lea r10, [rbp - 0x30]
and r14d, 1
mov qword [rsp + 0x50], r10
lea r10, [rbp + 0xb0]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r9d
xor r9d, r9d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1401370b5
test rdi, rdi
je 0x14013705b
mov rcx, qword [rdi + 8]
jmp 0x14013705e
mov rcx, rsi
nop
test rbx, rbx
je 0x14013706b
mov rax, qword [rbx + 8]
jmp 0x14013706e
mov rax, rsi
test r13, r13
je 0x140137079
mov rdx, qword [r13 + 8]
jmp 0x14013707c
mov rdx, rsi
lea r8, [rbp - 0x30]
and r14d, 1
mov qword [rsp + 0x48], r8
lea r10, [rbp + 0xb0]
mov qword [rsp + 0x40], r10
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1401370c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov esi, eax
test rdi, rdi
je 0x1401370e5
lea rcx, [rdi - 0x10]
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401370e5
nop
call fcn.14013d2a0
test r13, r13
je 0x140137105
lea rcx, [r13 - 0x10]
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140137105
nop dword [rax + rax]
call fcn.14013d2a0
test rbx, rbx
je 0x14013711f
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x14013711f
call fcn.14013d2a0
nop
test esi, esi
js 0x14013716f
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14013713a
mov eax, dword [rbp - 0x20]
mov qword [rcx], rax
mov eax, dword [rbp - 0x1c]
mov qword [rcx + 8], rax
mov rcx, qword ds:[rbp - 8]
test rcx, rcx
je 0x14013714e
mov rax, qword [rbp - 0x30]
mov qword [rcx], rax
jmp 0x14013715d
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14013715d
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp]
test rcx, rcx
je 0x14013717e
mov rax, qword [rbp - 0x28]
mov qword [rcx], rax
jmp 0x14013718d
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14013717e
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14013718d
call qword [sym.imp.ntdll.dll_NtClose]
call fcn.1401698e0
test rax, rax
je 0x1401371af
cmp qword [rbp - 0x78], 0
je 0x1401371af
nop
call fcn.1401698e0
mov rcx, qword [rbp - 0x78]
call qword [str.PB__]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov r13, qword [rsp + 0x250]
mov rbx, qword [rsp + 0x258]
mov r15, qword [rsp + 0x248]
mov rcx, qword ds:[rbp + 0x138]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x260
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret