Function at 0x140003650
Capabilities:
Attach user process memory
Complete processing asynchronous io request
Find process by pid
Inject apc
Map section object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x14000f090]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xc8], rsp
mov rdi, rdx
mov qword [rsp + 0xb0], rdx
mov esi, 0xc0000001
mov dword [rsp + 0x50], esi
xor r14d, r14d
mov qword [rsp + 0xa0], r14
cmp dword [0x140018fdc], r14d
jne 0x1400036c2
mov rax, qword [rdx + 0xb8]
mov qword [rsp + 0xa0], rax
mov ecx, dword [rax + 0x18]
jmp 0x1400036c5
mov ecx, dword [rdx + 0x10]
cmp ecx, 0x22e100
ja 0x1400043ea
je 0x1400043c0
add ecx, 0xffdd2000
cmp ecx, 0xfc
ja case.0x140004415.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x4f6c]
mov ecx, dword [rdx + rax*4 + 0x4ea4]
add rcx, rdx
jmp rcx
mov rcx, qword [rdi + 0x18]
movzx r9d, word [rcx + 0x10]
mov qword [rsp + 0x20], rcx
mov r8, qword [rcx + 8]
xor edx, edx
mov ecx, dword [rcx]
call fcn.140006100
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 0x12]
movzx r9d, word [rcx + 0x10]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 8]
xor edx, edx
mov ecx, dword [rcx]
call fcn.1400062d0
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140004415.2285861
mov qword [rsp + 0x68], r14
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov esi, ecx
call fcn.140007180
mov qword [rsp + 0x70], rax
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], r14d
test rax, rax
jne 0x140003803
mov byte [rbx + 8], r14b
mov qword [rsp + 0x70], r14
lea rdx, [rsp + 0x68]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400037f2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1fffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x50], eax
jmp 0x140003807
mov byte [rbx + 8], 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140003817
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
jmp case.0x140004415.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x78], r14
add rdi, 0x18
mov qword [rsp + 0x58], rdi
mov rax, qword [rdi]
mov ecx, dword [rax]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x70], r14
lea r9, [rsp + 0x78]
lea r8, [rsp + 0xd0]
mov edx, 0x1fffff
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwOpenThread]
mov dword [rsp + 0x50], eax
jmp 0x140003894
mov rcx, qword [rdi]
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
jmp case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbx + 8]
mov r8, qword [rbx + 8]
xor edx, edx
mov ecx, dword [rbx]
call fcn.140005cc0
movzx eax, al
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
jmp case.0x140004415.2285861
cli
sti
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400065a0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
test ecx, ecx
je 0x14000394e
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rdi + 0x18]
test eax, eax
jne 0x14000394b
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov qword [rcx], r14
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov r8, rcx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.140005e20
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
movups xmm0, xmmword [str.devicephysicalmemory]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [0x14000d4c0]
movups xmmword [rsp + 0x120], xmm1
movsd xmm0, qword [0x14000d4d0]
movsd qword [rsp + 0x130], xmm0
mov eax, dword [0x14000d4d8]
mov dword [rsp + 0x138], eax
movzx eax, word [0x14000d4dc]
mov word [rsp + 0x13c], ax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xd0], 0x30
mov qword [rsp + 0xd8], r14
mov dword [rsp + 0xe8], 0x40
lea rax, [rsp + 0x140]
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xd0]
mov edx, 0xf001f
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], 0x2000
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2000
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140003ad0
mov rcx, qword [rbx]
sub rcx, qword [rsp + 0x68]
lea rdx, [rbx + 0x10]
add rcx, qword [rsp + 0x70]
mov r8, rdi
call fcn.14000c8c0
mov rdx, qword [rsp + 0x70]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp case.0x140004415.2285861
mov qword [rsp + 0x98], r14
mov ebx, r14d
mov dword [rsp + 0x50], ebx
add rdi, 0x18
mov qword [rsp + 0x58], rdi
mov rsi, qword [rdi]
lea rdx, [rsp + 0x78]
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003b6a
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r14, rax
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140003b82
test ebx, ebx
jne case.0x140004415.2285861
mov rax, qword [rdi]
mov qword [rax], r14
jmp case.0x140004415.2285861
call fcn.140001b70
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
call fcn.140001ba0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140001c30
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov dword [rsp + 0x50], r14d
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x14000434a
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
call fcn.140001b90
mov r14, rax
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140004415.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.140001790
xor ecx, ecx
mov rax, qword [rdi + 0x18]
mov qword [rax], rcx
mov word [rax + 8], cx
mov rcx, qword [rdi + 0x18]
movsd xmm0, qword [rsp + 0x58]
movsd qword [rcx], xmm0
movzx eax, word [rsp + 0x60]
mov word [rcx + 8], ax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.14000b862
jmp 0x140003c7c
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call fcn.14000a9c0
mov ecx, dword [rbx + 8]
lea rax, [0x14000b6c0]
xor r9d, r9d
xor r8d, r8d
cmp ecx, 0xffffffff
jne 0x140003d00
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x14000b660]
call fcn.140001800
call fcn.14000a890
jmp case.0x140004415.2285861
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rdx, [0x14000b660]
call fcn.140001ac0
jmp case.0x140004415.2285861
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140002040]
call fcn.140001800
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov r9, qword [rcx + 0x18]
mov r8, qword [rcx + 0x10]
mov edx, dword [rcx + 8]
movzx ecx, byte [rcx]
call fcn.140003340
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov ebx, r14d
mov esi, 0x100
movzx ecx, bl
call fcn.1400034f0
inc ebx
cmp ebx, esi
jl 0x140003d67
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov ecx, dword [rcx]
call fcn.140002420
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov ecx, dword [rcx]
call fcn.140002590
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
call fcn.1400025d0
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
cmp byte [rax], r14b
setne byte [section..data]
cmp byte [0x140018ac8], r14b
je 0x140003de1
cmp qword [0x14000f140], r14
je 0x140003de1
mov dword [rsp + 0x50], esi
jmp case.0x140004415.2285861
mov dl, 1
lea rcx, [0x140018a60]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov byte [0x140018ad8], r14b
lea rcx, [0x140018a60]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call fcn.140006c80
cmp byte [0x140018ac8], r14b
jne 0x140003e4b
xor edx, edx
lea rcx, [0x1400070d0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
test eax, eax
sete byte [0x140018ac8]
test eax, eax
jne 0x140003e44
lea rcx, [0x1400070e0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
test eax, eax
sete byte [0x140018585]
cmp byte [0x140018ac8], r14b
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140004415.2285861
mov dl, 1
lea rcx, [0x140018a60]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x140018ad8]
mov byte [rcx], al
movzx eax, byte [0x140018ad8]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x140018ae0]
call fcn.14000c8c0
mov byte [0x140018ad8], r14b
lea rcx, [0x140018a60]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov dl, 1
lea rcx, [0x140018a60]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x140018590]
mov byte [rcx], al
movzx eax, byte [0x140018590]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x1400185a0]
call fcn.14000c8c0
mov byte [0x140018590], r14b
lea rcx, [0x140018a60]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 8]
mov ebx, dword [rax]
mov edx, 0x58
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov ecx, ebx
call fcn.1400065a0
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], r14b
lea rcx, [fcn.1400024f0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
lea r9, [0x1400053d0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInitializeApc]
xor r9d, r9d
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov ecx, dword [rcx]
call fcn.1400072d0
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov ecx, dword [rcx]
call fcn.140007230
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x14000f728], r14
je 0x140003ff2
mov ecx, dword [rax]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003fe5
mov rcx, qword [rsp + 0x78]
call qword [0x14000f728]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140004415.2285861
mov dword [rsp + 0x50], 0xc0000225
jmp case.0x140004415.2285861
mov dword [rsp + 0x50], 0xc0000002
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x14000f720], r14
je 0x140003ff2
mov ecx, dword [rax]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003fe5
mov rcx, qword [rsp + 0x78]
call qword [0x14000f720]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x70], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004415.2285861
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400040db
cmp byte [0x140018584], al
je 0x1400040db
mov r9, qword [rsp + 0x70]
mov ecx, r14d
mov eax, r14d
mov edx, r14d
mov r8d, r14d
mov dword [rsp + 0x68], ecx
cmp eax, dword [rsp + 0x78]
jge 0x1400040db
movsxd rax, edx
mov byte [rax + r9], cl
lea ecx, [r8 + 1]
mov eax, ecx
mov edx, ecx
mov r8d, ecx
jmp 0x1400040bd
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000498f
mov rax, qword [rdi + 0x18]
movsxd rcx, dword [rax]
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], r14
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
test rax, rax
jne 0x140004137
mov dword [rsp + 0x50], esi
jmp case.0x140004415.2285861
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14000c6c0
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rdx, qword [rdi + 0x18]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
lea rdx, str.PsGetProcessImageFileName
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400123e8], rax
test rax, rax
je case.0x140003702.2285616
mov rcx, qword [rbx]
call rax
mov qword [rbx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov ecx, dword [rcx]
call fcn.140001d40
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov ecx, dword [rcx]
call fcn.140002670
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140001d70
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140002170
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov dword [0x140018fa0], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
cmp dword [rcx], r14d
je 0x14000426d
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov ecx, dword [rcx + 4]
call fcn.1400023f0
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
mov ecx, dword [rcx + 4]
call fcn.140002650
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
xor ecx, ecx
call fcn.140002640
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
call rax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov dword [rax], 0x19ac12
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov r8, qword [rdi + 0x18]
mov ecx, dword [r8]
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [r8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x28], r14
lea rax, [0x140018ad0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov qword [rsp + 0x28], r14
lea rax, [0x140018588]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140004415.2285861
mov dword [rsp + 0x50], r14d
mov rcx, qword [rdi + 0x18]
cmp dword [rcx], r14d
je 0x1400043b4
mov rax, qword [rcx + 4]
mov qword [0x140018578], rax
mov eax, dword [rcx + 0xc]
mov dword [0x140018570], eax
mov rax, qword [rcx + 0x10]
mov qword [0x140018568], rax
call fcn.14000a5b0
mov dword [0x140018560], eax
mov dword [0x140018580], 1
jmp case.0x140004415.2285861
mov dword [0x140018580], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rcx + 8]
mov rax, rdx
shr rdx, 0x20
mov ecx, dword [rcx]
wrmsr
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
add ecx, 0xffdd1efc
cmp ecx, 0x84
ja case.0x140004415.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x50f4]
mov ecx, dword [rdx + rax*4 + 0x506c]
add rcx, rdx
jmp rcx
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
cmp qword [0x14000f0f8], r14
jne 0x140004472
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
test rax, rax
je 0x140004468
mov qword [0x14000f0f8], rax
mov edx, r14d
mov dword [rsp + 0x90], edx
movsxd rcx, edx
shl rcx, 4
cmp qword [rcx + rax + 8], 0
jne 0x140004464
cmp qword [rcx + rax], 0
jne 0x140004464
mov qword [0x14000f100], rcx
jmp 0x140004468
inc edx
jmp 0x14000443e
jmp 0x140004472
mov rax, qword [0x14000f0f8]
mov qword [rbx], rax
mov rax, qword [0x14000f100]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rbx, r14
mov qword [rsp + 0x88], rbx
mov rdi, qword [rdi + 0x18]
mov qword [rsp + 0x58], rdi
mov r15, rdi
mov dword [rsp + 0x50], esi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140004573
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400045d6
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14000454a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400045d6
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400045a9
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x1400045d6
test rbx, rbx
je case.0x140004415.2285861
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140004687
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004415.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, 2
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [rdi + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140004415.2285861
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, 2
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [rdi + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rcx]
mov rdx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rdi, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004415.2285861
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x14000477f
xor r8d, r8d
mov dl, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x14000477f
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov qword [rdi], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
movzx ecx, byte [rax]
mov dword [0x140018f9c], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400024f0
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x18]
lea r8, [rcx + 0xd8]
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 8]
mov edx, dword [rcx + 4]
mov ecx, dword [rcx]
call fcn.140008600
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
mov qword [rdx], r14
call fcn.14000a1a0
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400099d0
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140009a50
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
call fcn.140009980
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
call fcn.140009a90
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140009ae0
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
call fcn.140009bb0
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
call fcn.140009da0
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
call fcn.140009f20
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
call fcn.140008100
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x20]
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 0x18]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.1400076d0
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
call fcn.140007a40
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
call fcn.140007e70
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
call fcn.1400079d0
mov dword [rsp + 0x50], eax
jmp case.0x140004415.2285861
call fcn.140007ba0
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
call fcn.140007be0
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
call fcn.140007c20
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004415.2285861
mov rcx, qword [rsp + 0x58]
call fcn.1400066d0
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x14000394e
mov rcx, qword [rsp + 0x58]
call fcn.140006480
mov rcx, qword [rdi + 0x18]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rcx, qword [rdi + 0x18]
mov edx, dword [rcx]
call fcn.140006510
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [0x14000f108]
test rcx, rcx
je 0x140004a33
mov qword [rsp + 0x58], 0xfffffffffff85ee0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
mov edx, 6
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x140004415.2285861
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x14000f108], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004a55
cmp rax, rcx
je 0x140004a55
mov qword [0x14000f110], rcx
cmp qword [0x14000f0f0], r14
jne 0x140003907
mov ebx, dword [rbx]
test ebx, ebx
jne 0x140004a9e
movabs rbx, 0xfffff78000000320
mov rbx, qword [rbx]
movabs rax, 0x29f16b11c6d1e109
imul rbx
sar rdx, 0xd
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0xc350
sub ebx, eax
add ebx, 0x3e8
mov r9d, ebx
lea r8, [0x14000d514]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.140005290
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x110], 0x20100
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], r14
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 3
lea rax, [0x140005240]
mov qword [rsp + 0xe0], rax
lea rax, [fcn.1400024f0]
mov qword [rsp + 0xe8], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], 3
lea rax, [0x140005320]
mov qword [rsp + 0x100], rax
lea rax, [fcn.1400024f0]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x130], rax
lea rdx, [0x14000f0f0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
jne case.0x140004415.2285861
cmp r14d, 0xa
jge case.0x140004415.2285861
inc ebx
mov r9d, ebx
lea r8, [0x14000d514]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.140005290
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
inc r14d
lea rdx, [0x14000f0f0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
je 0x140004b91
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x110]
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140004c55
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x118]
mov qword [rcx], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp case.0x140004415.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140003ca0
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004cf5
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea r8, [rbx + 0x10]
mov r9d, dword [rbx + 0x18]
mov edx, dword [r8]
lea rax, [rsp + 0x68]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
cmp qword [rbx + 8], 0
jne 0x140004cc1
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
movsxd rcx, eax
mov qword [rbx], rcx
mov eax, dword [rsp + 0x68]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140004cfd
mov dword [rsp + 0x50], 0xc0190060
jmp case.0x140004415.2285861
mov rax, qword [rdi + 0x18]
mov r9, qword [rax]
cmp dword [0x140018580], r14d
jne 0x140004d2c
mov dword [rsp + 0x50], 0xc0000184
jmp case.0x140004415.2285861
shl r9, 0xc
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], 1
mov r8, r14
mov rdx, 0xffffffffffffffff
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmAllocatePagesForMdlEx]
mov r13, rax
test rax, rax
je 0x140004e36
mov r15d, dword [rax + 0x28]
shr r15, 0xc
lea rdi, [rax + 0x30]
test rdi, rdi
je 0x140004e24
mov edx, 0x10
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140004e24
mov edx, 0x100
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx], rax
test rax, rax
je 0x140004e19
mov dword [rbx + 8], r14d
mov esi, r14d
mov ecx, r14d
test r15, r15
je 0x140004e00
nop word [rax + rax]
mov rdx, qword [rdi]
shl rdx, 0xc
movsxd rcx, ecx
mov rax, qword [rbx]
mov qword [rax + rcx*8], rdx
mov ecx, dword [rbx + 8]
inc ecx
mov dword [rbx + 8], ecx
cmp ecx, 0x20
jne 0x140004def
mov edx, ecx
mov rcx, qword [rbx]
call fcn.14000a3c0
mov dword [rbx + 8], r14d
mov ecx, r14d
inc esi
add rdi, 8
movsxd rax, esi
cmp rax, r15
jb 0x140004dc0
mov rax, qword [rbx]
test ecx, ecx
je 0x140004e0e
mov edx, ecx
mov rcx, rax
call fcn.14000a3c0
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x140004415.2285861
mov dword [rsp + 0x50], 0xc00000a0
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
mov dword [rcx + 0x30], ebx
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x140004e73
test ebx, ebx
jne 0x140004e64
mov r14d, dword [rax + 8]
jmp 0x140004e67
xor r14d, r14d
mov qword [rcx + 0x38], r14
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14000c600
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret