Function at 0x140005450
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x1400225c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rcx, str.win32u.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
mov dword [rsp + 0x20], 0xc9874890
mov r8d, 0x270
mov dword [rsp + 0x24], 0x4dd28748
mov rcx, rbx
mov dword [rsp + 0x28], 0x874dc087
mov rsi, rax
mov word [rsp + 0x2c], 0x90c9
call fcn.140007fc0
mov eax, dword [rsp + 0x28]
lea rcx, [rbx + 0x1a]
movsd xmm0, qword [rsp + 0x20]
lea rdx, str.BaseNamedObjectsGMMut
movsd qword [rbx + 0xc], xmm0
mov r8d, 0x3c
mov dword [rbx + 0x14], eax
movzx eax, word [rsp + 0x2c]
mov word [rbx + 0x18], ax
mov dword [rbx], 0x1badc0d3
mov dword [rbx + 4], 0xdeadbeef
call fcn.14000b39c
lea rcx, [rbx + 0x92]
mov r8d, 0x3c
lea rdx, str.BaseNamedObjectsGMReq
call fcn.14000b39c
lea rcx, [rbx + 0x10a]
mov r8d, 0x3c
lea rdx, str.BaseNamedObjectsGMDone
call fcn.14000b39c
lea rcx, [rbx + 0x182]
mov r8d, 0x3c
lea rdx, str.BaseNamedObjectsGMSec
call fcn.14000b39c
test rdi, rdi
je 0x140005754
test rsi, rsi
je 0x140005754
lea rdx, str.CsrGetProcessId
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000556d
lea rdx, str.Failed_to_resolve_CsrGetProcessId
jmp 0x14000575b
call rax
mov r8d, eax
mov dword [rbx + 0x1fc], eax
lea rdx, str.CSRSS_PID_is__u
mov ecx, 1
call fcn.140005ca0
lea rdx, str.NtOpenProcess
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x200], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtTerminateProcess
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x208], rax
test rax, rax
je 0x14000574b
lea rdx, [0x140023598]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x210], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x218], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtWriteVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x220], rax
test rax, rax
je 0x14000574b
lea rdx, str.RtlCreateUserThread
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x228], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtWaitForSingleObject
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x230], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtCreateMutant
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x248], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtCreateEvent
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x238], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtSetEvent
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x240], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtCreateSection
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x250], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtMapViewOfSection
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x258], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtUserHardErrorControl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x268], rax
test rax, rax
je 0x14000574b
lea rdx, str.NtUserSetInformationThread
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x260], rax
test rax, rax
je 0x14000574b
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.Failed_to_resolve_a_payload_import
jmp 0x14000575b
lea rdx, str.Couldnt_find_kernel32_win32u___What_
mov ecx, 3
call fcn.140005ca0
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret