Function at 0x140007d4c
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r13
push r15
sub rsp, 0x970
mov r15, rcx
lea rcx, str.SeDebugPrivilege
mov rdi, r8
mov r13, rdx
call fcn.1400119f0
xor esi, esi
mov r11d, 0x20
lea rcx, [rsp + 0x80]
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0xc0], esi
mov dword [rsp + 0xb8], esi
mov qword [rsp + 0xc8], rsi
mov dword [rsp + 0xbc], r11d
mov dword [rsp + 0xd4], r11d
mov dword [rsp + 0xd8], esi
mov dword [rsp + 0xd0], esi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
mov rbp, rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
call fcn.1400126ac
cmp byte [r13], 0x2f
jne 0x140007e2d
lea rcx, [r13 + 1]
call fcn.140002a8c
mov ebx, eax
jmp 0x140007ebe
cmp dword [rsp + 0xd8], esi
mov edi, esi
jle 0x140007ea8
cmp edi, esi
jl 0x140007e59
cmp edi, dword [rsp + 0xd8]
jge 0x140007e59
movsxd rbx, edi
imul rbx, rbx, 0x130
add rbx, qword [rsp + 0xc8]
jmp 0x140007e5c
mov rbx, rsi
lea rsi, [rbx + 4]
mov rdx, r13
mov rcx, rsi
call sub.msvcrt.dll__mbsicmp
test eax, eax
je 0x140007f60
mov rcx, rsi
jmp 0x140007e88
cmp al, 0x5c
je 0x140007e80
cmp al, 0x2f
jne 0x140007e84
lea rcx, [rsi + 1]
add rsi, 1
mov al, byte [rsi]
test al, al
jne 0x140007e78
mov rdx, r13
call sub.msvcrt.dll__mbsicmp
xor esi, esi
cmp eax, esi
je 0x140007eab
add edi, 1
cmp edi, dword [rsp + 0xd8]
jl 0x140007e38
mov rbx, rsi
cmp rbx, rsi
je 0x140008096
mov ebx, dword [rbx]
mov rdi, qword [rsp + 0x9b0]
cmp ebx, esi
je 0x140008096
lea rcx, [rsp + 0x172]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x170], si
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x170]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x3ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, ebx
xor edx, edx
mov ecx, 0x2000000
mov qword [rsp + 0x9b8], rsi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rsi
mov rbx, rax
je 0x140007fcd
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x9a8], rsi
call fcn.140001000
mov r9, qword [rsp + 0x58]
mov edi, 2
cmp r9, rsi
je 0x140007f67
lea r8, [rsp + 0x9a8]
mov edx, edi
mov rcx, rbx
call r9
jmp 0x140007f69
xor esi, esi
jmp 0x140007eab
mov eax, esi
cmp eax, esi
je 0x140007faf
mov rdx, qword [rsp + 0x9a8]
lea rax, [rsp + 0x9b8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov r8d, 0x2000000
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], edi
call fcn.14000107c
mov rcx, qword [rsp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r15
mov edx, eax
call fcn.140006c2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x9b8]
cmp rbx, rsi
je 0x140008088
xor edx, edx
lea rcx, [rsp + 0x108]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x100], 0x68
call fcn.140001000
mov r11, qword [rsp + 0x50]
cmp r11, rsi
je 0x140008065
lea rax, [rsp + 0xe0]
lea r9, [rsp + 0x170]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x100]
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call r11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r15
mov edx, eax
call fcn.140006c2c
mov rcx, qword [rsp + 0x9b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x70]
cmp rbp, rsi
je 0x140008096
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x1400080a9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp qword [rsp + 0xc8], rsi
je 0x1400080c0
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0xb0]
cmp rcx, rsi
je 0x1400080d2
call sub.msvcrt.dll_free
mov rbx, qword [rsp + 0x9a0]
add rsp, 0x970
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret