Function at 0x140060fe0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xdf0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x280
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe18]
mov rax, qword [0x1400af080]
xor rax, rbp
mov qword [rbp + 0xdb0], rax
mov dword [rbp + 0xd54], 0
lea rcx, [0x1400c01c0]
call fcn.14002f99b
nop
mov rax, qword [rbp + 0xde8]
add rax, 0x40
mov qword [rbp + 0xd68], rax
lea rdx, [rbp + 0x698]
mov rcx, qword [rbp + 0xd68]
call qword [sym.imp.dpp.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_dpp::interaction::get_command_name_void____ptr64]
mov qword [rbp + 0xd70], rax
mov eax, dword [rbp + 0xd54]
or eax, 1
mov dword [rbp + 0xd54], eax
lea rdx, str.uninstall
mov rcx, qword [rbp + 0xd70]
call fcn.14002ea5a
movzx eax, al
test eax, eax
je 0x1400610ca
mov rax, qword [rbp + 0xde8]
add rax, 0xd0
mov qword [rbp + 0xd78], rax
mov rdx, qword [0x1400b0ea0]
mov rcx, qword [rbp + 0xd78]
call fcn.14002f7d9
movzx eax, al
test eax, eax
je 0x1400610ca
mov dword [rbp + 0xd80], 1
jmp 0x1400610d4
mov dword [rbp + 0xd80], 0
movzx eax, byte [rbp + 0xd80]
mov byte [rbp + 0x674], al
mov eax, dword [rbp + 0xd54]
and eax, 1
test eax, eax
je 0x140061102
and dword [rbp + 0xd54], 0xfffffffe
lea rcx, [rbp + 0x698]
call fcn.14002e4bf
nop
movzx eax, byte [rbp + 0x674]
test eax, eax
je 0x1400616c3
mov rax, qword [rbp + 0xde0]
cmp dword [rax], 0
je 0x14006163a
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x238]
call fcn.14002e87f
nop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
nop
mov qword [rbp + 0x278], 0
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
lea r9, [0x14009dca8]
mov r8d, 1
xor edx, edx
lea rcx, [0x14009df18]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop
mov rax, qword [rbp + 0x278]
mov rax, qword [rax]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0xd68], rax
lea rcx, [rbp + 0x708]
call fcn.14002e5af
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
lea rax, [rbp + 0x6d8]
mov rdi, rax
mov rsi, qword [rbp + 0xd78]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x948]
lea rcx, [rbp + 0x6d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa08]
lea rcx, [rbp + 0x948]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa68]
lea rcx, [rbp + 0xa08]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xb28]
lea rcx, [rbp + 0xa68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x768]
call fcn.14002e5af
mov qword [rbp + 0xd80], rax
mov rax, qword [rbp + 0xd80]
mov qword [rbp + 0xd88], rax
lea rax, [rbp + 0x738]
mov rdi, rax
mov rsi, qword [rbp + 0xd88]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x8e8]
lea rcx, [rbp + 0x738]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x9a8]
lea rcx, [rbp + 0x8e8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa38]
lea rcx, [rbp + 0x9a8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xaf8]
lea rcx, [rbp + 0xa38]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x7c8]
call fcn.14002e5af
mov qword [rbp + 0xd90], rax
mov rax, qword [rbp + 0xd90]
mov qword [rbp + 0xd98], rax
lea rax, [rbp + 0x798]
mov rdi, rax
mov rsi, qword [rbp + 0xd98]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x888]
lea rcx, [rbp + 0x798]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x978]
lea rcx, [rbp + 0x888]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x9d8]
lea rcx, [rbp + 0x978]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xac8]
lea rcx, [rbp + 0x9d8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x828]
call fcn.14002e5af
mov qword [rbp + 0xda0], rax
mov rax, qword [rbp + 0xda0]
mov qword [rbp + 0xda8], rax
lea rax, [rbp + 0x7f8]
mov rdi, rax
mov rsi, qword [rbp + 0xda8]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x858]
lea rcx, [rbp + 0x7f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x8b8]
lea rcx, [rbp + 0x858]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x918]
lea rcx, [rbp + 0x8b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xa98]
lea rcx, [rbp + 0x918]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd20]
lea rcx, [rbp + 0xb28]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xce0]
lea rcx, [rbp + 0xaf8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xca0]
lea rcx, [rbp + 0xac8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xc60]
lea rcx, [rbp + 0xa98]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xd20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xce0]
lea r8, [rbp + 0xca0]
lea rdx, [rbp + 0xc60]
mov rcx, qword [rbp + 0x278]
call qword [rbp + 0xd68]
nop
lea rcx, [rbp + 0x828]
call fcn.14002f2a2
nop
lea rcx, [rbp + 0x7c8]
call fcn.14002f2a2
nop
lea rcx, [rbp + 0x768]
call fcn.14002f2a2
nop
lea rcx, [rbp + 0x708]
call fcn.14002f2a2
nop
mov qword [rbp + 0x298], 0
mov rax, qword [rbp + 0x278]
mov rax, qword [rax]
mov rax, qword [rax + 0x38]
mov qword [rbp + 0xd68], rax
lea rdx, [0x14009b18c]
lea rcx, [rbp + 0xb58]
call fcn.14002f739
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
mov rcx, qword [rbp + 0xd78]
call fcn.14002f955
mov qword [rbp + 0xd80], rax
lea r8, [rbp + 0x298]
mov rdx, qword [rbp + 0xd80]
mov rcx, qword [rbp + 0x278]
call qword [rbp + 0xd68]
nop
lea rcx, [rbp + 0xb58]
call fcn.14002f59a
nop
mov rax, qword [rbp + 0x298]
mov rax, qword [rax]
mov rax, qword [rax + 0x78]
mov qword [rbp + 0xd68], rax
lea rdx, [0x14009b190]
lea rcx, [rbp + 0xb78]
call fcn.14002f739
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
mov rcx, qword [rbp + 0xd78]
call fcn.14002f955
mov qword [rbp + 0xd80], rax
xor r8d, r8d
mov rdx, qword [rbp + 0xd80]
mov rcx, qword [rbp + 0x298]
call qword [rbp + 0xd68]
nop
lea rcx, [rbp + 0xb78]
call fcn.14002f59a
nop
mov rax, qword [rbp + 0xde0]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov rax, qword [rbp + 0xde0]
mov rax, qword [rax + 8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x238]
call fcn.14002f5c2
nop
jmp 0x1400616c1
mov rax, qword [rbp + 0xde0]
cmp dword [rax], 0
jne 0x1400616c1
lea rax, [rbp + 0xb98]
mov qword [rbp + 0xbf8], rax
mov rcx, qword [rbp + 0xbf8]
call qword [sym.imp.dpp.dll_class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64_____cdecl_dpp::utility::log_error_void_]
mov qword [rbp + 0xd68], rax
mov rax, qword [rbp + 0xd68]
mov qword [rbp + 0xd70], rax
mov rax, qword [rbp + 0xd70]
mov qword [rbp + 0xd78], rax
lea rdx, str.you_are_not_admin_you_need_admin_to_run_this_command_run__getadmin
lea rcx, [rbp + 0xc18]
call fcn.14002ebe0
nop
mov r8, qword [rbp + 0xd78]
lea rdx, [rbp + 0xc18]
mov rcx, qword [rbp + 0xde8]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::interaction_create_t::reply_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__class_std::function_void____cdecl___struct_dpp::confirmation_callback_t_const____ptr64___const___ptr64]
nop
lea rcx, [rbp + 0xc18]
call fcn.14002e4bf
nop
jmp 0x1400616d7
lea rdx, str.not_for_me_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002e2f8
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140095d00]
call fcn.14002f4fa
mov rcx, qword [rbp + 0xdb0]
xor rcx, rbp
call fcn.14002eca8
lea rsp, [rbp + 0xdc0]
pop rdi
pop rsi
pop rbp
ret