Function at 0x1400d5880
Capabilities:
Acquire debug privileges
Create thread
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140403f00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
lea rdx, str.SeSecurityPrivilege
xorps xmm1, xmm1
lea rcx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_send
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.14007f3f0
lea rcx, [rsp + 0x30]
call fcn.1400d9070
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400d5921
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d591c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d591c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14029abd4
xorps xmm0, xmm0
lea rdx, str.SeDebugPrivilege
xorps xmm1, xmm1
lea rcx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.14007f3f0
lea rcx, [rsp + 0x30]
call fcn.1400d9070
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400d5993
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d598e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d598e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14029abd4
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], rdi
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_139]
mov r9, qword [0x140408828]
lea r8, [0x140093c90]
xor ebx, ebx
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_539]
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_23]
call fcn.1400d17f0
mov edi, eax
nop dword [rax]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140408170], bl
je 0x1400d59e0
cmp edi, 0xffffffff
je 0x1400d5bc2
test edi, edi
je 0x1400d5a46
cmp edi, 1
je 0x1400d5a3a
cmp edi, 2
je 0x1400d5a16
lea rdx, str.An_unsecured_error_has_occurred__try_again_or_contact_support
jmp 0x1400d5bc9
lea rdx, [rsp + 0x30]
call fcn.1400d5c00
mov rdx, qword [rax]
add rdx, 0x40
cmp qword [rdx + 0x18], 0xf
jbe 0x1400d5bc9
mov rdx, qword [rdx]
jmp 0x1400d5bc9
lea rdx, str.Connection_error__try_again_later_or_contact_support
jmp 0x1400d5bc9
mov qword [rsp + 0x28], rbx
lea r8, [0x1400d8cf0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, qword [0x140408800]
lea r8, [0x140085bd0]
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [0x140407f10], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, qword [0x140408808]
lea r8, [0x140086490]
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [0x140407f18], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, qword [0x140408818]
lea r8, [0x140084940]
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [0x140407f20], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, qword [0x140408830]
lea r8, [0x1400d60b0]
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [0x140407f28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, qword [0x140408820]
lea r8, [0x1400d5dc0]
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [0x140407f30], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, qword [0x140408810]
lea r8, [0x140089d90]
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [0x140407f38], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r8d, r8d
lea rdi, [0x140407f10]
mov r9d, 0xffffffff
mov qword [0x140407f40], rax
mov rdx, rdi
lea ecx, [r8 + 7]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
jne 0x1400d5b88
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400d5b9f
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400d5bb6
cmp dword [rsp + 0x50], 0x103
jne 0x1400d5bb6
inc ebx
add rdi, 8
cmp ebx, 7
jl 0x1400d5b88
jmp 0x1400d5bdb
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Error_has_occured__please_re_download_file
xor r9d, r9d
lea r8, str.Spark_Error
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_24]
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14029a860
add rsp, 0x68
ret