Function at 0x1400796d0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1940
call fcn.1400b6c10
sub rsp, rax
mov rax, qword [0x1401e4c00]
xor rax, rsp
mov qword [rsp + 0x1930], rax
xor eax, eax
mov qword [rsp + 0x60], rax
call fcn.14007cde0
test eax, eax
jne 0x14007972f
lea rcx, [rsp + 0x30]
call fcn.14007d120
nop
mov rcx, rax
call fcn.140088680
nop
lea rcx, [rsp + 0x30]
call fcn.140042490
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.SeDebugPrivilege
call fcn.1400898b0
lea rcx, str.SeImpersonatePrivilege
call fcn.1400898b0
lea rcx, [rsp + 0x30]
call fcn.140085640
mov r8, rax
movabs rax, 0xc48ee0efc2c1fe70
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rcx
movabs rdx, 0x8defd1e29afb38f6
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x58], rcx
movabs rax, 0xc48ee0efefac933d
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x17d0], rcx
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x17d8], rax
movdqa xmm0, xmmword [rsp + 0x17d0]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.14007a650
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140079815
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079ee9
call fcn.1400b5f70
movdqa xmm0, xmmword [0x1401c82c0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova r8, qword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x14007985a
mov ecx, IStream_Read
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x15e0]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x1400796a0]
lea rdx, [fcn.14009b740]
lea rcx, [rsp + 0x15e0]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x15e0]
call fcn.1400c3120
lea rdx, [0x1401c7498]
lea rcx, [rsp + 0x17e0]
call fcn.14009b740
lea rcx, [rsp + 0x15e0]
call fcn.1400c8160
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x13f0]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x14007d260]
lea rdx, [fcn.14009aca4]
lea rcx, [rsp + 0x13f0]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x13f0]
call fcn.1400c3120
movzx ebx, al
mov edx, 4
mov ecx, 5
call fcn.14009aca4
lea rcx, [rsp + 0x13f0]
call fcn.1400c8160
test bl, bl
jne 0x140079956
mov ecx, 0x675
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x1200]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x140085990]
lea rdx, [fcn.140079580]
lea rcx, [rsp + 0x1200]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x1200]
call fcn.1400c3120
lea rdx, [rsp + 0x17e0]
lea rcx, [0x1401c76a8]
call fcn.140079580
lea rcx, [rsp + 0x1200]
call fcn.1400c8160
nop
call fcn.14003e240
nop
jmp 0x1400799c8
call fcn.14003f2e0
call fcn.14003f890
call fcn.1400405c0
call fcn.14003d6e0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x1010]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x140063c30]
lea rdx, [fcn.14009b538]
lea rcx, [rsp + 0x1010]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x1010]
call fcn.1400c3120
lea rcx, [rsp + 0x17e0]
call fcn.14009b538
lea rcx, [rsp + 0x1010]
call fcn.1400c8160
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0xe20]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x140066920]
lea rdx, [fcn.1400795d0]
lea rcx, [rsp + 0xe20]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0xe20]
call fcn.1400c3120
lea rdx, [rsp + 0x17e0]
lea rcx, [rsp + 0x1850]
call fcn.1400795d0
lea rcx, [rsp + 0xe20]
call fcn.1400c8160
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0xc30]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x140033ab0]
lea rdx, [fcn.140079630]
lea rcx, [rsp + 0xc30]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0xc30]
call fcn.1400c3120
lea rdx, [rsp + 0x17e0]
lea rcx, [rsp + 0x18c0]
call fcn.140079630
lea rcx, [rsp + 0xc30]
call fcn.1400c8160
nop
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x90]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x14003bab0]
lea rdx, [fcn.140098158]
lea rcx, [rsp + 0x90]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x90]
call fcn.1400c3120
mov r8d, 0xa
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x17e0]
call fcn.140098158
lea rcx, [rsp + 0x90]
call fcn.1400c8160
nop
lea rcx, [rsp + 0x90]
call fcn.1400c0040
nop
jmp 0x140079b82
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0xa40]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x14003a360]
lea rdx, [fcn.14009b1d0]
lea rcx, [rsp + 0xa40]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0xa40]
call fcn.1400c3120
mov ecx, 0x141
call fcn.14009b1d0
lea rcx, [rsp + 0xa40]
call fcn.1400c8160
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x850]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x14007a880]
lea rdx, [fcn.14009b120]
lea rcx, [rsp + 0x850]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x850]
call fcn.1400c3120
mov ecx, 0x141
call fcn.14009b120
lea rcx, [rsp + 0x850]
call fcn.1400c8160
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x660]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x14003cc10]
lea rdx, [fcn.140091d58]
lea rcx, [rsp + 0x660]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x660]
call fcn.1400c3120
mov ecx, 0x41
call fcn.140091d58
lea rcx, [rsp + 0x660]
call fcn.1400c8160
call fcn.1400384c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x470]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x1400357e0]
lea rdx, [fcn.14009ac18]
lea rcx, [rsp + 0x470]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x470]
call fcn.1400c3120
mov ecx, 0x2a
call fcn.14009ac18
lea rcx, [rsp + 0x470]
call fcn.1400c8160
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x280]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x140038790]
lea rdx, [0x140079690]
lea rcx, [rsp + 0x280]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x280]
call fcn.1400c3120
xor ecx, ecx
call fcn.14009ac30
lea rcx, [rsp + 0x280]
call fcn.1400c8160
nop
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x90]
call fcn.1400fdab0
lea r9, [rsp + 0x60]
lea r8, [0x140082010]
lea rdx, [fcn.14009abec]
lea rcx, [rsp + 0x90]
call fcn.1400bf8e0
nop
lea rcx, [rsp + 0x90]
call fcn.1400c3120
call fcn.14009abec
lea rcx, [rsp + 0x90]
call fcn.1400c8160
nop
lea rcx, [rsp + 0x90]
call fcn.1400c0040
nop
jmp 0x140079db2
call fcn.140078b70
test rdi, rdi
je 0x140079dce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1401e4f48], 0
je 0x140079ddd
call fcn.140079f00
nop
lea rcx, [rsp + 0x280]
call fcn.1400c0040
nop
lea rcx, [rsp + 0x470]
call fcn.1400c0040
nop
lea rcx, [rsp + 0x660]
call fcn.1400c0040
nop
lea rcx, [rsp + 0x850]
call fcn.1400c0040
nop
lea rcx, [rsp + 0xa40]
call fcn.1400c0040
nop
lea rcx, [rsp + 0xc30]
call fcn.1400c0040
nop
lea rcx, [rsp + 0xe20]
call fcn.1400c0040
nop
lea rcx, [rsp + 0x1010]
call fcn.1400c0040
nop
lea rcx, [rsp + 0x1200]
call fcn.1400c0040
nop
lea rcx, [rsp + 0x13f0]
call fcn.1400c0040
nop
lea rcx, [rsp + 0x15e0]
call fcn.1400c0040
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140079eb3
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079eae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079eef
call fcn.1400b5f70
movdqa xmm0, xmmword [0x1401c82c0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
xor eax, eax
mov rcx, qword [rsp + 0x1930]
xor rcx, rsp
call fcn.1400b5f50
mov rbx, qword [rsp + 0x1950]
add rsp, 0x1940
pop rdi
ret
call fcn.140093b64
nop
call fcn.140093b64
int3