Function at 0x180040810
Capabilities:
Get token membership
Terminate process

Disassembly:
mov r11, rsp
push rbp
push rdi
push r13
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1800737f8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
lea eax, [rdx - 0xa]
mov dword [rbp + 0xf], edx
mov dword [rbp + 0x13], eax
mov rdi, rcx
cmp edx, eax
jbe 0x180040ea0
mov qword [r11 + 0x10], rbx
lea r8, [0x180000000]
mov qword [r11 + 0x18], rsi
mov rsi, qword [rbp - 1]
mov qword [r11 + 0x20], r12
mov r12, qword [rbp - 1]
mov qword [r11 - 0x20], r14
lea r14d, [rdx - 0x5b]
mov qword [r11 - 0x28], r15
xor edx, edx
mov r15d, 0xa
lea ebx, [rdx + 1]
lea r10d, [r15 - 7]
lea r13d, [r15 - 3]
lea r11d, [r15 - 1]
lea r9d, [r15 - 6]
cmp r14d, 0x1f
ja case.0x1800408a4.10
movzx eax, byte [r8 + r14 + 0x40ee4]
mov ecx, dword [r8 + rax*4 + 0x40eb8]
add rcx, r8
jmp rcx
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf1
call fcn.180021380
mov r12, rax
jmp 0x180040ad4
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x1b]
call fcn.180017730
test al, al
je 0x180040ad4
mov r9d, 0x3c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800365a0
jmp 0x180040ad4
mov qword [rdi + 0x10], rdx
jmp case.0x1800408a4.10
mov qword [rbp + 7], rdx
lea rax, [rbp + 7]
mov rdx, r12
mov qword [rsp + 0x20], rax
lea r9, [rbp - 1]
mov qword [rbp - 1], r10
mov r8d, 0xbb
mov rcx, r10
call fcn.18005f180
lea rax, [rbp + 7]
mov qword [rbp - 1], rbx
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r12
mov rcx, rbx
call fcn.18005f180
jmp 0x180040ad4
mov word [rbp - 9], dx
lea r8, [rbp - 0x19]
mov eax, 5
mov word [rbp - 0x11], r13w
lea rdx, [rbp - 0x11]
mov word [rbp - 0x19], ax
mov r9d, 0xb2
lea rcx, [rbp - 9]
call fcn.180003f50
mov eax, 6
mov word [rbp - 0x19], bx
mov word [rbp - 9], ax
mov word [rbp - 0x11], r13w
jmp 0x180040abd
mov word [rbp - 0x11], dx
lea r8, [rbp - 9]
lea rdx, [rbp - 0x11]
mov word [rbp - 0x19], r10w
mov r9d, 0xb2
mov word [rbp - 9], bx
lea rcx, [rbp - 0x19]
call fcn.180003f50
mov eax, 3
mov word [rbp - 0x11], r13w
mov word [rbp - 0x19], ax
lea r8, [rbp - 9]
mov eax, 2
lea rdx, [rbp - 0x11]
mov r9d, 0xb2
mov word [rbp - 9], ax
lea rcx, [rbp - 0x19]
call fcn.180003f50
xor eax, eax
mov word [rbp - 0x11], r13w
mov word [rbp - 0x19], ax
mov eax, 3
mov word [rbp - 9], ax
jmp 0x180040abd
mov word [rbp - 0x19], dx
mov word [rbp - 9], r11w
jmp 0x180040ab8
mov r9d, 0xb2
mov word [rbp - 0x19], r10w
lea r8, [rbp - 9]
mov word [rbp - 0x11], r13w
lea rdx, [rbp - 0x11]
mov word [rbp - 9], r13w
lea rcx, [rbp - 0x19]
call fcn.180003f50
mov eax, 3
mov word [rbp - 0x19], ax
xor eax, eax
mov word [rbp - 0x11], ax
mov eax, 8
mov word [rbp - 9], ax
jmp 0x180040abd
cmp qword [rdi], 0
je case.0x1800408a4.10
mov ebx, 0xc3
cmp ebx, 0xc3
je 0x180040a8b
cmp ebx, 0x163
je 0x180040a6f
cmp ebx, 0x203
jne 0x180040a99
mov qword [rdi], rdx
jmp 0x180040a99
xor eax, eax
lea r8, [rbp + 0x17]
lea rdx, [rbp + 0x1f]
mov qword [rbp + 0x1f], rax
mov rcx, rsi
mov dword [rbp + 0x27], eax
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
jmp 0x180040a97
mov rcx, qword [rdi]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
add ebx, 0xa0
cmp ebx, 0x2a3
jb 0x180040a52
mov ebx, 1
jmp 0x180040ad4
mov word [rbp - 0x19], r10w
mov word [rbp - 9], r9w
mov word [rbp - 0x11], r13w
mov r9d, 0xb2
lea r8, [rbp - 9]
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x19]
call fcn.180003f50
mov r11d, 9
lea r8, [0x180000000]
lea r9d, [r11 - 5]
lea r10d, [r11 - 6]
dec r14d
mov edx, 0
sub r15, 1
jne 0x180040886
mov ebx, dword [rbp + 0xf]
mov rdi, qword [rbp - 1]
add ebx, 0xffffffad
mov esi, dword [rbp + 0x13]
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
nop dword [rax + rax]
cmp ebx, 9
ja case.default.0x180040b34
mov ecx, dword [r8 + rbx*4 + 0x40f04]
add rcx, r8
jmp rcx
cmp qword [rdi + 8], 2
je case.default.0x180040b34
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Priority_level__1_is_now_active.
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [rbp + 7]
lea rax, [rbp - 1]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, r12
mov qword [rbp - 1], 1
mov ecx, 0x88
call fcn.180016bb0
mov rdi, rax
cmp qword [rax + 8], 1
je case.default.0x180040b34
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__builtin_ia32_cvtps2uqq512_mask
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rdi + 8], 3
jne 0x180040dca
cmp qword [rdi + 0x10], 0
jne 0x180040da4
cmp qword [rdi + 0x18], 0
je case.default.0x180040b34
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Name_in_clone_parameter_is_NULL.
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rdi + 0x10], 0
jne 0x180040df0
cmp qword [rdi + 0x18], 0
je case.default.0x180040b34
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.SetupAPI:_Bad_section_name_line_
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180040e3c
cmp qword [rax + 8], 1
jne 0x180040e3c
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x180040e16
cmp qword [rax + 8], 3
jne 0x180040e16
cmp qword [rdi + 0x20], 0
je case.default.0x180040b34
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Print_margins_dont_fit_on_page.
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x180040cb8
cmp qword [rax + 8], 2
je case.default.0x180040b34
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Adobe_Flash_Playerin_oletusarvot
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdi, qword [rdi + 0x18]
jmp case.default.0x180040b34
mov r10d, 2
lea rax, [rbp + 7]
mov ecx, r10d
mov qword [rbp - 1], r10
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r12
call fcn.18005f180
lea rax, [rbp + 7]
mov qword [rbp - 1], 4
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r12
mov ecx, 4
call fcn.18005f180
mov r9, r12
mov qword [rbp - 1], 4
lea r8, [rbp - 1]
mov edx, 0xd7
lea rcx, [rbp + 7]
call fcn.18002fee0
jmp case.default.0x180040b34
mov r9d, 0xba
mov byte [rbp - 0x19], 1
lea r8, [rbp - 0x19]
xor edx, edx
mov rcx, r12
call fcn.1800401b0
mov r12, rax
jmp case.default.0x180040b34
mov rdi, qword [rdi + 0x20]
test rdi, rdi
je 0x180040e62
cmp qword [rdi + 8], 2
jne 0x180040e62
dec ebx
lea eax, [rbx + 0x53]
cmp eax, esi
jbe 0x180040e88
lea r8, [0x180000000]
jmp 0x180040b20
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Two_different_imports___same_IAT
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.SoftwareTortoiseOverlaysLocked
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Phx.CxxIL.PragmaType.PR_NOFLOATT
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.PAGING_FILE_NOT_ON_SYS_PARTITION
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.common_data_:_from_file___FALSE
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.unable_to_change_wdir_to__s___s_
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rsi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800604b0
add rsp, 0x90
pop r13
pop rdi
pop rbp
ret