Function at 0x140004500
Capabilities:
Accept command line arguments
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x300
mov rax, qword [0x1400dd078]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
mov rdi, r8
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140004584
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004562
mov ecx, 0x800
call qword [0x1400956a8]
jmp 0x140004584
lea rdx, str.SetDllDirectoryA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004584
lea rcx, [0x1400c3590]
call qword [0x1400956a8]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r8, rax
xor dil, dil
mov eax, dword [rsp + 0x68]
xor esi, esi
test eax, eax
jle 0x1400045f2
mov r9d, eax
lea r10, [0x1400a5810]
nop dword [rax]
mov rdx, qword [r8]
cmp word [rdx], 0x2d
jne 0x1400045c6
cmp word [rdx + 2], 0x71
jne 0x1400045c6
cmp word [rdx + 4], si
je 0x1400045e5
mov rax, rsi
nop dword [rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r10 + rax*2 - 2]
jne 0x1400045e8
cmp rax, 8
jne 0x1400045d0
mov dil, 1
add r8, 8
sub r9, 1
jne 0x1400045b0
mov dword [rsp + 0x64], 2
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], 0xf
mov byte [rsp + 0x2b0], 0
mov r8d, 9
lea rdx, str.Uninstall
lea rcx, [rsp + 0x2b0]
call fcn.140018430
nop
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2e8], rsi
mov qword [rsp + 0x2f0], 0xf
mov byte [rsp + 0x2d8], 0
mov r8d, 0x16
lea rdx, str.Sophos_HitmanPro.Alert
lea rcx, [rsp + 0x2d8]
call fcn.140018430
nop
xor ecx, ecx
call fcn.14006c168
mov r8, rax
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x2d8]
call fcn.1400204e0
nop
mov rdx, qword [rsp + 0x2f0]
cmp rdx, 0x10
jb 0x1400046db
inc rdx
mov rcx, qword [rsp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d23
call fcn.14006235c
mov qword [rsp + 0x2e8], rsi
mov qword [rsp + 0x2f0], 0xf
mov byte [rsp + 0x2d8], 0
mov rdx, qword [rsp + 0x2c8]
cmp rdx, 0x10
jb 0x14000473a
inc rdx
mov rcx, qword [rsp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004735
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d29
call fcn.14006235c
call fcn.14001c880
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 4
lea rcx, [rsp + 0x90]
call fcn.140017020
nop
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400956a8]
cmp dword [rsp + 0x88], eax
setl byte [rsp + 0x188]
jl 0x1400047a5
lea rdx, str.Running_uninstall
lea rcx, [rsp + 0x80]
call fcn.1400053c0
mov byte [rsp + 0x188], 1
lea rcx, [rsp + 0x80]
call fcn.1400162f0
xor r14b, r14b
mov dword [rsp + 0x2a8], 0
mov word [rsp + 0x2ac], 0x500
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp eax, 1
jne 0x140004a4b
lea r8, [rsp + 0x6c]
mov rdx, qword [rsp + 0x2a0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
cmp eax, 1
jne 0x14000483b
cmp dword [rsp + 0x6c], eax
sete r14b
jmp 0x1400048c6
call fcn.14001c880
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 2
lea rcx, [rsp + 0x90]
call fcn.140017020
nop
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400956a8]
cmp dword [rsp + 0x88], eax
setl byte [rsp + 0x188]
jl 0x1400048b9
lea rcx, [rsp + 0x80]
call fcn.1400052b0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140005390
mov byte [rsp + 0x188], 1
lea rcx, [rsp + 0x80]
call fcn.1400162f0
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test r14b, r14b
je 0x140004ac3
call fcn.140004260
test al, al
jne 0x140004972
call fcn.140003fd0
test al, al
jne 0x140004972
mov byte [rsp + 0x60], al
lea rcx, [rsp + 0x60]
call fcn.14002b140
mov r14d, esi
test eax, eax
movzx eax, byte [rsp + 0x60]
je 0x14000492e
test al, al
setne r14b
add r14d, 2
mov edx, 0x643
mov ecx, 0xbc9
test al, al
cmovne edx, ecx
mov r8d, 0x10
jmp 0x140004944
test al, al
setne r14b
neg al
sbb edx, edx
and edx, 0xbc2
mov r8d, 0x40
mov dword [rsp + 0x64], r14d
test dil, dil
jne 0x14000496d
test edx, edx
je 0x14000496d
mov byte [rsp + 0x2d0], dil
lea r9, [rsp + 0x2b0]
lea rcx, [rsp + 0x61]
call fcn.1400039c0
nop
jmp 0x140004ba3
call fcn.14001c880
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 3
lea rcx, [rsp + 0x90]
call fcn.140017020
nop
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400956a8]
cmp dword [rsp + 0x88], eax
setl byte [rsp + 0x188]
jl 0x1400049d6
lea rcx, [rsp + 0x80]
call fcn.140005500
mov byte [rsp + 0x188], 1
lea rcx, [rsp + 0x80]
call fcn.1400162f0
test dil, dil
jne 0x140004a41
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], 7
mov r8d, 0x1a
lea rdx, str.Disable_Tamper_Protection.
lea rcx, [rsp + 0x2b0]
call fcn.1400175d0
mov byte [rsp + 0x2d0], 1
lea r9, [rsp + 0x2b0]
mov edx, 5
lea r8d, [rdx + 0xb]
lea rcx, [rsp + 0x61]
call fcn.1400039c0
mov eax, 5
jmp 0x140004cfa
call fcn.14001c880
mov rax, qword [rax]
mov qword [rsp + 0x190], rax
mov dword [rsp + 0x198], 2
lea rcx, [rsp + 0x1a0]
call fcn.140017020
nop
mov rcx, qword [rsp + 0x190]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400956a8]
cmp dword [rsp + 0x198], eax
setl byte [rsp + 0x298]
jl 0x140004ab6
lea rdx, str.Failed_to_initialize_Sid_in_IsRunningAsAdmin
lea rcx, [rsp + 0x190]
call fcn.140005020
mov byte [rsp + 0x298], 1
lea rcx, [rsp + 0x190]
call fcn.1400162f0
call fcn.14001c880
mov rax, qword [rax]
mov qword [rsp + 0x190], rax
mov dword [rsp + 0x198], 3
lea rcx, [rsp + 0x1a0]
call fcn.140017020
nop
mov rcx, qword [rsp + 0x190]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400956a8]
cmp dword [rsp + 0x198], eax
setl byte [rsp + 0x298]
jl 0x140004b27
lea rcx, [rsp + 0x190]
call fcn.140005420
mov byte [rsp + 0x298], 1
lea rcx, [rsp + 0x190]
call fcn.1400162f0
test dil, dil
jne 0x140004b92
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], 7
mov r8d, 0x15
lea rdx, str.Run_as_Administrator.
lea rcx, [rsp + 0x2b0]
call fcn.1400175d0
mov byte [rsp + 0x2d0], 1
lea r9, [rsp + 0x2b0]
mov edx, 5
lea r8d, [rdx + 0xb]
lea rcx, [rsp + 0x61]
call fcn.1400039c0
mov eax, 6
jmp 0x140004cfa
mov edx, 8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400e3060], eax
jle 0x140004c0e
lea rcx, [0x1400e3060]
call fcn.1400624f8
cmp dword [0x1400e3060], 0xffffffff
jne 0x140004c0e
mov qword [0x1400e3058], rsi
lea rax, vtable.sophlib::logging::Logger.0
mov qword [0x1400e3050], rax
lea rcx, [0x1400e3058]
call fcn.14001dd80
lea rcx, [0x140093b10]
call fcn.140062344
nop
lea rcx, [0x1400e3060]
call fcn.140062498
mov ecx, 0x88
call fcn.140062608
mov r15, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15 + 4], xmm0
movups xmmword [r15 + 0x14], xmm0
movups xmmword [r15 + 0x24], xmm0
movups xmmword [r15 + 0x34], xmm0
movups xmmword [r15 + 0x44], xmm0
movups xmmword [r15 + 0x54], xmm0
movups xmmword [r15 + 0x64], xmm0
movups xmmword [r15 + 0x74], xmm0
mov dword [r15 + 0x84], eax
mov dword [r15], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [r15 + 4], eax
lea rdi, [r15 + 8]
mov edx, 2
mov rcx, rdi
call fcn.140061408
mov byte [r15 + 0x58], 0
mov qword [r15 + 0x60], rsi
mov qword [r15 + 0x68], rsi
mov qword [r15 + 0x70], rsi
mov qword [r15 + 0x78], rsi
mov qword [r15 + 0x80], rsi
mov qword [rsp + 0x2a0], r15
mov qword [rsp + 0x2a8], rdi
mov rcx, rdi
call fcn.140061438
test eax, eax
jne 0x140004d2f
mov rbx, qword [0x1400e3058]
lea rcx, [rbx + 8]
call fcn.140061438
test eax, eax
jne 0x140004d37
mov rcx, qword [0x1400e3058]
mov qword [0x1400e3058], r15
mov qword [rsp + 0x2a0], rcx
lea rcx, [rbx + 8]
call fcn.14006145c
nop
mov rcx, rdi
call fcn.14006145c
nop
lea rcx, [rsp + 0x2a0]
call fcn.14001ca70
mov eax, r14d
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.1400620b0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14006b338
nop
call fcn.14006b338
nop
mov ecx, eax
call fcn.14006071c
nop
mov ecx, eax
call fcn.14006071c
int3