Function at 0x14003cdd0
Capabilities:
Acquire debug privileges
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
xor ebp, ebp
mov rbx, rcx
lea rcx, [rsp + 0x50]
mov r12d, 1
mov dword [rsp + 0x108], ebp
mov r15d, ebp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x78], rbp
call fcn.1400632a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, qword [rsp + 0xf8]
lea r8, [rsp + 0x50]
xor r9d, r9d
mov rcx, rbx
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x20], r12b
call fcn.14007bba4
mov r11, qword [rsp + 0x50]
lea eax, [rbp + 0x2d]
mov qword [rsp + 0xf8], r11
movzx r14d, bp
lea edi, [rbp + 0x2a]
mov si, bp
mov r13w, bp
mov word [rsp + 0x3c], bp
cmp ax, word [r11]
jne 0x14003ce77
mov edi, eax
mov ebx, 4
cmp di, word [r11]
jne 0x14003d0ed
add r11, 2
mov qword [rsp + 0xf8], r11
je 0x14003cffd
lea rdx, [rsp + 0xf8]
lea rcx, [0x1401202c0]
mov r8d, 5
call fcn.140065d7c
cmp al, bpl
je 0x14003cec0
or r14w, r12w
jmp 0x14003cfeb
mov rdx, qword [rsp + 0xf8]
lea rcx, str.svr2
mov r8d, ebx
call fcn.14005c4dc
cmp al, bpl
jne 0x14003d053
mov rdx, qword [rsp + 0xf8]
lea rcx, str.exitcode
mov r8d, 9
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
jne 0x14003cf59
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x40], ebp
lea rdx, [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0xf8], rax
movzx ecx, word [rax]
mov eax, 9
sub cx, 0x30
cmp cx, ax
lea rcx, [rsp + 0xf8]
setbe bl
call fcn.140074498
cmp bl, bpl
mov ebx, 4
je 0x14003cfeb
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x108], eax
jmp 0x14003cfeb
lea rdx, [rsp + 0xf8]
lea rcx, str.explorer
mov r8d, 8
call fcn.140065d7c
cmp al, bpl
je 0x14003cf82
mov dword [rsp + 0x108], r12d
jmp 0x14003cfeb
lea rdx, [rsp + 0xf8]
lea rcx, [0x140121fe4]
mov r8d, 3
call fcn.140065d7c
cmp al, bpl
je 0x14003cfa6
mov esi, r12d
jmp 0x14003cfeb
lea rdx, [rsp + 0xf8]
lea rcx, str.tree
mov r8d, ebx
call fcn.140065d7c
cmp al, bpl
je 0x14003cfca
mov r13d, 0xc0
jmp 0x14003cfeb
lea rdx, [rsp + 0xf8]
lea rcx, [0x140121fd8]
mov r8d, r12d
call fcn.140065d7c
cmp al, bpl
je 0x14003d048
mov dword [rsp + 0x3c], r12d
mov r11, qword [rsp + 0xf8]
cmp di, word [r11]
je 0x14003ce86
cmp si, bp
je 0x14003d0ed
mov rax, qword [str.26:INDATA]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x80]
mov qword [rcx], rax
mov rax, qword [0x140121fc8]
mov qword [rcx + 8], rax
mov rax, qword [0x140121fd0]
mov qword [rcx + 0x10], rax
mov rcx, qword [rsp + 0xf0]
call fcn.140031518
jmp 0x14003d518
sub qword [rsp + 0xf8], 2
jmp 0x14003cffd
lea rsi, [0x14013e190]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, 2
lea rcx, str.SeShutdownPrivilege
lea r8d, [rdx + 6]
call fcn.14001c318
movzx eax, word [0x14013e20c]
mov edi, 4
mov bl, bpl
lea r12, str.SeDebugPrivilege
test dil, al
jne 0x14003d0ad
or ax, di
lea edx, [rdi - 2]
xor r8d, r8d
mov rcx, r12
mov bl, 1
mov word [0x14013e20c], ax
call fcn.14001c318
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
cmp bl, bpl
je 0x14003d0d3
mov eax, 0xfffb
xor r8d, r8d
mov edx, edi
and word [0x14013e20c], ax
mov rcx, r12
call fcn.14001c318
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x50]
call fcn.14005aef8
xor eax, eax
jmp 0x14003d525
lea rsi, [0x14013e190]
mov rcx, rsi
mov rbx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x38], 0x8000
mov dil, bpl
lea r12, str.SeDebugPrivilege
cmp r14b, bpl
je 0x14003d148
movzx eax, word [0x14013e20c]
mov ecx, 4
test cl, al
jne 0x14003d148
lea r14d, [rcx - 3]
or ax, cx
lea edx, [rcx - 2]
xor r8d, r8d
mov rcx, r12
mov dil, r14b
mov word [0x14013e20c], ax
call fcn.14001c318
jmp 0x14003d15a
mov rcx, rsi
mov rbx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14d, 1
mov rcx, qword [rsp + 0xf8]
mov esi, 0x2a
cmp si, word [rcx]
jne 0x14003d30a
mov esi, ebp
mov eax, 0x2a
add rcx, 2
add esi, r14d
mov qword [rsp + 0xf8], rcx
cmp ax, word [rcx]
je 0x14003d177
mov eax, 0x26
jmp 0x14003d1a1
add rcx, 2
add r15d, r14d
mov qword [rsp + 0xf8], rcx
cmp ax, word [rcx]
je 0x14003d192
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xf8]
call fcn.140074228
cmp eax, ebp
jle 0x14003d2d0
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x14003d2d0
cmp esi, r14d
jne 0x14003d237
cmp r15d, ebp
je 0x14003d28f
mov edx, dword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp eax, r14d
jne 0x14003d1f3
mov rsi, rbp
jmp 0x14003d201
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebp
cmove eax, r14d
mov esi, eax
cmp dil, bpl
je 0x14003d221
xor r8d, r8d
mov eax, 0xfffb
mov rcx, r12
and word [0x14013e20c], ax
lea edx, [r8 + 4]
call fcn.14001c318
cmp rbx, rbp
je 0x14003d22f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, rsi
jmp 0x14003d518
cmp esi, 2
jne 0x14003d28f
cmp r15d, ebp
je 0x14003d250
mov edx, dword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14003d1e9
mov r8d, ecx
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, rax
cmp rax, rbp
je 0x14003d1f3
cmp rax, 0xffffffffffffffff
je 0x14003d1f3
mov edx, dword [rsp + 0x108]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, r13
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, r14d
jmp 0x14003d1ec
mov esi, dword [rsp + 0x108]
mov r14, rcx
mov qword [rsp + 0x68], rcx
mov r15b, bpl
cmp r13w, bp
je 0x14003d2c0
lea r10, [0x14011c618]
or r13w, 1
mov qword [rsp + 0xf8], r10
jmp 0x14003d3c6
mov r10, rbp
mov qword [rsp + 0xf8], rbp
jmp 0x14003d44c
cmp dil, bpl
je 0x14003d2f0
xor r8d, r8d
mov eax, 0xfffb
mov rcx, r12
and word [0x14013e20c], ax
lea edx, [r8 + 4]
call fcn.14001c318
cmp rbx, rbp
je 0x14003d2fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, 0xffffffff80070057
jmp 0x14003d518
call fcn.140018bbc
mov rcx, rax
call fcn.14001be60
mov qword [rsp + 0xf8], rax
cmp word [rax], bp
je 0x14003d2d0
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r10, qword [rsp + 0xf8]
neg rax
sbb al, al
and al, 0x20
mov byte [rsp + 0x100], al
cmp r10, rbp
je 0x14003d3a8
lea rcx, [rsp + 0x58]
mov r8d, 0x3f
mov edx, esi
mov qword [rsp + 0x58], r10
call fcn.14005b0c8
mov r11, qword [rsp + 0x58]
mov r10, qword [rsp + 0xf8]
cmp r11, r10
jbe 0x14003d39c
cmp si, word [r11]
jne 0x14003d39c
cmp word [r11 + 2], bp
jne 0x14003d39c
mov word [r11], bp
mov r10, qword [rsp + 0xf8]
mov qword [rsp + 0x70], r11
mov r13d, 0x81
jmp 0x14003d3a8
cmp word [r11], bp
je 0x14003d3a8
mov r13d, 0x181
mov rcx, qword [rsp + 0x30]
mov esi, dword [rsp + 0x108]
mov r15b, byte [rsp + 0x100]
cmp r10, rbp
je 0x14003d41a
mov r14, qword [rsp + 0x68]
movzx eax, r13w
mov rcx, r10
mov dword [rsp + 0x20], r14d
neg ax
movsx eax, r15b
sbb edx, edx
xor r9d, r9d
and edx, esi
mov r8d, edx
movzx edx, r13w
or edx, 0x10
or edx, eax
call fcn.14002d7cc
mov rcx, rax
mov qword [rsp + 0x30], rax
cmp r14, rbp
je 0x14003d412
lea r8, [rsp + 0x48]
mov edx, esi
mov ecx, r14d
call fcn.14001a55c
mov rcx, qword [rsp + 0x30]
mov r10, qword [rsp + 0xf8]
cmp r13w, bp
je 0x14003d442
cmp rcx, rbp
mov rax, rbp
sete al
mov qword [rsp + 0x48], rax
cmp r10, rbp
je 0x14003d4d3
cmp rcx, rbp
je 0x14003d4d3
jmp 0x14003d46a
movsxd rax, dword [rsp + 0x60]
cmp rax, rcx
je 0x14003d46a
cmp rcx, rbp
je 0x14003d46a
lea r8, [rsp + 0x48]
mov edx, esi
call fcn.14001a55c
mov r10, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x30]
cmp word [rsp + 0x3c], bp
jne 0x14003d4d3
cmp r10, rbp
je 0x14003d4d3
cmp rcx, rbp
je 0x14003d4d3
mov r14d, 1
cmp qword [rsp + 0x78], rcx
jne 0x14003d4ab
mov rcx, qword [rsp + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call fcn.14001963c
mov r10, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x30]
cmp r13w, bp
mov rax, rcx
cmovne rax, rbp
cmp rcx, rbp
mov qword [rsp + 0x78], rax
jle 0x14003d4d3
mov eax, dword [rsp + 0x38]
sub eax, r14d
cmp eax, ebp
mov dword [rsp + 0x38], eax
jg 0x14003d3bc
mov rax, qword [rsp + 0x70]
cmp rax, rbp
je 0x14003d4e5
mov ecx, 0x2a
mov word [rax], cx
cmp dil, bpl
je 0x14003d505
xor r8d, r8d
mov eax, 0xfffb
mov rcx, r12
and word [0x14013e20c], ax
lea edx, [r8 + 4]
call fcn.14001c318
cmp rbx, rbp
je 0x14003d513
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.14005aef8
mov rax, rbp
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret