Function at 0x1400011b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15, rcx
lea rax, vtable.app.0
mov qword [rcx], rax
lea r12, [rcx + 8]
xor r13d, r13d
mov qword [r12], r13
mov qword [r12 + 8], r13
mov rdi, qword [rdx]
mov rbx, qword [rdi]
mov qword [rsp + 0x30], r12
mov esi, r13d
mov qword [rsp + 0x38], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
cmp rbx, rdi
je 0x14000128d
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov ecx, 0x18
call fcn.140002cf0
mov rbp, rax
mov rcx, qword [rbx + 0x10]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x48], rax
mov r14, rax
mov qword [rsp + 0x40], rax
mov esi, 1
mov qword [rsp + 0x38], rsi
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x14000128b
nop
mov qword [rsp + 0x28], r13
mov ecx, 0x18
call fcn.140002cf0
mov rcx, qword [rbx + 0x10]
mov qword [rax + 0x10], rcx
mov qword [r14], rax
mov qword [rax + 8], r14
mov qword [rsp + 0x28], r13
mov r14, rax
mov qword [rsp + 0x40], rax
inc rsi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140001250
jmp 0x140001297
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov ecx, 0x18
call fcn.140002cf0
test rsi, rsi
jne 0x1400012b9
mov qword [rax], rax
mov qword [rax + 8], rax
jmp 0x1400012c7
mov qword [rax], rbp
mov qword [rax + 8], r14
mov qword [rbp + 8], rax
mov qword [r14], rax
mov qword [r12 + 8], rsi
mov qword [r12], rax
lea rax, vtable.evz::console.0
mov qword [r15 + 0x18], rax
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
nop
lea rax, vtable.evz::native.0
mov qword [r15 + 0x20], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [r15 + 0x58], rax
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x28], rax
lea rdx, str.NtAdjustPrivilegesToken
mov rcx, qword [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x40], rax
lea rdx, str.NtOpenProcessToken
mov rcx, qword [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x30], rax
lea rdx, str.NtOpenThreadToken
mov rcx, qword [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x38], rax
lea rdx, str.NtClose
mov rcx, qword [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x48], rax
lea rdx, str.RtlCheckTokenMembershipEx
mov rcx, qword [r15 + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x50], rax
lea rbx, [r15 + 0x60]
mov qword [rsp + 0x98], rbx
lea rax, vtable.evz::log.0
mov qword [rbx], rax
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov ecx, 0x18
call fcn.140002cf0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], r13
lea rdx, [0x140004420]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov rax, qword [rbx]
mov r8, qword [rax + 0x20]
lea rax, [method.evz::log.virtual_32]
cmp r8, rax
jne 0x140001402
mov qword [rsp + 0x98], r15
lea rcx, [rbx + 8]
lea r8, [rsp + 0x98]
mov rdx, qword [rcx]
call fcn.140002ac0
jmp 0x14000140c
mov rdx, r15
mov rcx, rbx
call r8
nop
mov rax, r15
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret