Function at 0x1400796d0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1940
call fcn.1400b6c70
sub rsp, rax
mov rax, qword [0x1401e4c00]
xor rax, rsp
mov qword [rsp + 0x1930], rax
xor eax, eax
mov qword [rsp + 0x60], rax
call fcn.14007cde0
test eax, eax
jne 0x14007972f
lea rcx, [rsp + 0x30]
call fcn.14007d120
nop
mov rcx, rax
call fcn.1400886e0
nop
lea rcx, [rsp + 0x30]
call fcn.140042490
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.SeDebugPrivilege
call fcn.140089910
lea rcx, str.SeImpersonatePrivilege
call fcn.140089910
lea rcx, [rsp + 0x30]
call fcn.1400856a0
mov r8, rax
movabs rax, 0xc48ee0efc2c1fe70
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rcx
movabs rdx, 0x8defd1e29afb38f6
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x58], rcx
movabs rax, 0xc48ee0efefac933d
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x17d0], rcx
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x17d8], rax
movdqa xmm0, xmmword [rsp + 0x17d0]
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.14007a650
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140079815
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079ee9
call fcn.1400b5fd0
movdqa xmm0, xmmword [0x1401c81b0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova r8, qword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x14007985a
mov ecx, IStream_Read
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x15e0]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x1400796a0]
lea rdx, [fcn.14009b7a0]
lea rcx, [rsp + 0x15e0]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x15e0]
call fcn.1400c3180
lea rdx, [0x1401c7384]
lea rcx, [rsp + 0x17e0]
call fcn.14009b7a0
lea rcx, [rsp + 0x15e0]
call fcn.1400c81c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x13f0]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x14007d260]
lea rdx, [fcn.14009ad04]
lea rcx, [rsp + 0x13f0]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x13f0]
call fcn.1400c3180
movzx ebx, al
mov edx, 4
mov ecx, 5
call fcn.14009ad04
lea rcx, [rsp + 0x13f0]
call fcn.1400c81c0
test bl, bl
jne 0x140079956
mov ecx, 0x675
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x1200]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x1400859f0]
lea rdx, [fcn.140079580]
lea rcx, [rsp + 0x1200]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x1200]
call fcn.1400c3180
lea rdx, [rsp + 0x17e0]
lea rcx, [0x1401c7598]
call fcn.140079580
lea rcx, [rsp + 0x1200]
call fcn.1400c81c0
nop
call fcn.14003e240
nop
jmp 0x1400799c8
call fcn.14003f2e0
call fcn.14003f890
call fcn.1400405c0
call fcn.14003d6e0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x1010]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x140063c30]
lea rdx, [fcn.14009b598]
lea rcx, [rsp + 0x1010]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x1010]
call fcn.1400c3180
lea rcx, [rsp + 0x17e0]
call fcn.14009b598
lea rcx, [rsp + 0x1010]
call fcn.1400c81c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0xe20]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x140066920]
lea rdx, [fcn.1400795d0]
lea rcx, [rsp + 0xe20]
call fcn.1400bf940
nop
lea rcx, [rsp + 0xe20]
call fcn.1400c3180
lea rdx, [rsp + 0x17e0]
lea rcx, [rsp + 0x1850]
call fcn.1400795d0
lea rcx, [rsp + 0xe20]
call fcn.1400c81c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0xc30]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x140033ab0]
lea rdx, [fcn.140079630]
lea rcx, [rsp + 0xc30]
call fcn.1400bf940
nop
lea rcx, [rsp + 0xc30]
call fcn.1400c3180
lea rdx, [rsp + 0x17e0]
lea rcx, [rsp + 0x18c0]
call fcn.140079630
lea rcx, [rsp + 0xc30]
call fcn.1400c81c0
nop
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x90]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x14003bab0]
lea rdx, [fcn.1400981b8]
lea rcx, [rsp + 0x90]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x90]
call fcn.1400c3180
mov r8d, 0xa
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x17e0]
call fcn.1400981b8
lea rcx, [rsp + 0x90]
call fcn.1400c81c0
nop
lea rcx, [rsp + 0x90]
call fcn.1400c00a0
nop
jmp 0x140079b82
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0xa40]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x14003a360]
lea rdx, [fcn.14009b230]
lea rcx, [rsp + 0xa40]
call fcn.1400bf940
nop
lea rcx, [rsp + 0xa40]
call fcn.1400c3180
mov ecx, 0x141
call fcn.14009b230
lea rcx, [rsp + 0xa40]
call fcn.1400c81c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x850]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x14007a880]
lea rdx, [fcn.14009b180]
lea rcx, [rsp + 0x850]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x850]
call fcn.1400c3180
mov ecx, 0x141
call fcn.14009b180
lea rcx, [rsp + 0x850]
call fcn.1400c81c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x660]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x14003cc10]
lea rdx, [fcn.140091db8]
lea rcx, [rsp + 0x660]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x660]
call fcn.1400c3180
mov ecx, 0x41
call fcn.140091db8
lea rcx, [rsp + 0x660]
call fcn.1400c81c0
call fcn.1400384c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x470]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x1400357e0]
lea rdx, [fcn.14009ac78]
lea rcx, [rsp + 0x470]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x470]
call fcn.1400c3180
mov ecx, 0x2a
call fcn.14009ac78
lea rcx, [rsp + 0x470]
call fcn.1400c81c0
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x280]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x140038790]
lea rdx, [0x140079690]
lea rcx, [rsp + 0x280]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x280]
call fcn.1400c3180
xor ecx, ecx
call fcn.14009ac90
lea rcx, [rsp + 0x280]
call fcn.1400c81c0
nop
xor edx, edx
mov r8d, 0x1e8
lea rcx, [rsp + 0x90]
call fcn.1400fdb10
lea r9, [rsp + 0x60]
lea r8, [0x140082070]
lea rdx, [fcn.14009ac4c]
lea rcx, [rsp + 0x90]
call fcn.1400bf940
nop
lea rcx, [rsp + 0x90]
call fcn.1400c3180
call fcn.14009ac4c
lea rcx, [rsp + 0x90]
call fcn.1400c81c0
nop
lea rcx, [rsp + 0x90]
call fcn.1400c00a0
nop
jmp 0x140079db2
call fcn.140078b70
test rdi, rdi
je 0x140079dce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1401e4f48], 0
je 0x140079ddd
call fcn.140079f00
nop
lea rcx, [rsp + 0x280]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0x470]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0x660]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0x850]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0xa40]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0xc30]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0xe20]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0x1010]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0x1200]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0x13f0]
call fcn.1400c00a0
nop
lea rcx, [rsp + 0x15e0]
call fcn.1400c00a0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140079eb3
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079eae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079eef
call fcn.1400b5fd0
movdqa xmm0, xmmword [0x1401c81b0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
xor eax, eax
mov rcx, qword [rsp + 0x1930]
xor rcx, rsp
call fcn.1400b5fb0
mov rbx, qword [rsp + 0x1950]
add rsp, 0x1940
pop rdi
ret
call fcn.140093bc4
nop
call fcn.140093bc4
int3