Function at 0x140076480
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x14012dc00]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call fcn.140079760
test eax, eax
jne 0x1400764ce
lea rcx, [rsp + 0x48]
call fcn.140079aa0
nop
mov rcx, rax
call fcn.1400846e0
nop
lea rcx, [rsp + 0x48]
call fcn.14003fb00
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.SeDebugPrivilege
call fcn.140085910
lea rcx, str.SeImpersonatePrivilege
call fcn.140085910
lea rcx, [rsp + 0x48]
call fcn.140081f90
mov r8, rax
movabs rax, 0x77b7ad948b7bfcca
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rcx
movabs rdx, 0x6b4485892558aea8
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x38], rcx
movabs rax, 0x77b7ad94a6169187
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x98], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140076eb0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400765b4
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400765af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140076746
call fcn.1400acb30
movdqa xmm0, xmmword [0x1401151b0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova r8, qword [rsp + 0x70]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x1400765f9
mov ecx, IStream_Read
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova r8, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x68]
call fcn.1400709f0
call fcn.140079be0
test al, al
jne 0x14007663e
mov ecx, 0x675
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140082290
nop
call fcn.14003b820
nop
jmp 0x140076651
call fcn.14003c8c0
call fcn.14003cf60
call fcn.14003dc90
call fcn.14003acc0
call fcn.140060d70
call fcn.140063a60
call fcn.140031100
nop
call fcn.140039090
nop
jmp 0x140076682
call fcn.140037940
call fcn.1400770e0
call fcn.14003a1f0
call fcn.140035a90
call fcn.140032e30
call fcn.140035d60
nop
call fcn.14007e990
nop
jmp 0x1400766ae
call fcn.140075a80
test rbx, rbx
je 0x1400766ca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14012df08], 0
je 0x1400766d9
call fcn.140076760
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x140076715
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140076710
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007674c
call fcn.1400acb30
movdqa xmm0, xmmword [0x1401151b0]
movdqu xmmword [rsp + 0x80], xmm0
mov byte [rsp + 0x70], 0
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400acb10
add rsp, 0xb0
pop rbx
ret
call fcn.14008fbac
nop
call fcn.14008fbac
int3