Function at 0x140050d90
Capabilities:
Load ntoskrnl

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140050dbb
mov rsi, qword [rsi]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rbp - 0x30], ymm0
mov rcx, rsi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x140051034
mov rbx, rax
cmp rax, 0xf
ja 0x140050e05
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
lea rcx, [rbp - 0x30]
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, rbp
add rbx, 0xffffffffffffffd0
jmp 0x140050e63
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x140050e3a
lea rcx, [r15 + 0x28]
call fcn.140056a8c
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140050e46
lea rcx, [r15 + 1]
call fcn.140056a8c
mov r14, rax
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r15
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, r14
mov byte [rbx], 0
lea rbx, [rbp - 0x30]
mov rdx, rbx
call fcn.14004ec40
mov rsi, rax
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x140050eb4
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140050eaf
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140051039
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056ad0
test rsi, rsi
je 0x140050f4a
cmp qword [rdi + 0x18], 0x10
jb 0x140050ec7
mov rdi, qword [rdi]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rbp - 0x30], ymm0
mov rcx, rdi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x140051034
mov r14, rax
cmp rax, 0xf
ja 0x140050f14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xf
lea rcx, [rbp - 0x30]
mov rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, rbp
add r14, 0xffffffffffffffd0
jmp 0x140050f9f
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x140050f75
lea rcx, [r12 + 0x28]
call fcn.140056a8c
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140050f82
lea rdx, str.dependenciescommunicationedk.cpp
lea r9, str.failed_to_get_ntoskrnl._n
mov cl, 1
mov r8d, 0x59
call fcn.140050a70
cmp qword [rdi + 0x18], 0x10
jae 0x140050ec4
jmp 0x140050ec7
lea rcx, [r12 + 1]
call fcn.140056a8c
mov r15, rax
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r12
mov rcx, r15
mov rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
mov byte [r14], 0
lea rcx, str.ntoskrnl.exe
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140050fe5
mov rdi, rax
cmp qword [rbp - 0x18], 0x10
jb 0x140050fc3
mov rbx, qword [rbp - 0x30]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140050fe5
sub rsi, rdi
add rsi, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140050fe7
xor esi, esi
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x140051022
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005101d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140051039
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140056ad0
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.140002290
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3