Function at 0x140001af0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rbp], rax
cmp dword [0x14005dd10], 0
jne 0x140002b64
lea r8, [rsp + 0x48]
mov edx, 0x28
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r15d, r15d
test eax, eax
je 0x140001bb0
lea r8, [rsp + 0x68]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140001bb0
mov dword [rsp + 0x50], 1
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001bb0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x18]
call fcn.140016390
mov r13, qword [rbp - 0x18]
mov r12, qword [rbp - 0x10]
mov qword [rsp + 0x68], r12
cmp r13, r12
je 0x1400024ab
lea rax, str.xxxxxx
mov qword [rsp + 0x48], rax
lea rax, str.xx_xxxx
mov qword [rsp + 0x30], rax
lea rax, str.xxx____x
mov qword [rsp + 0x38], rax
lea rax, str.xxx____xxx
mov qword [rsp + 0x40], rax
lea rax, str.xxxxxx____xxx
mov qword [rsp + 0x50], rax
mov edi, 0xf8
mov ebx, 0x8664
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140001c23
mov rcx, qword [rcx]
lea rdx, str.ntoskrnl.exe
call fcn.14002abc8
test eax, eax
jne 0x140001d47
mov rax, qword [r13 + 0x40]
mov qword [0x14005dc90], rax
mov rdi, qword [0x14005dd60]
mov r12, qword [0x14005dd68]
cmp rdi, r12
je 0x140001ccc
nop word [rax + rax]
mov rax, qword [rdi]
mov r15, qword [rax]
mov r14, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001c78
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140001c8a
xor ebx, ebx
jmp 0x140001cad
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001ca4
sub r14, rsi
add rbx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rdi]
mov qword [rax], rbx
mov rax, qword [rdi]
cmp qword [rax], 0
je 0x140002500
add rdi, 8
cmp rdi, r12
jne 0x140001c60
xor r15d, r15d
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001cde
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000253c
lea r8, str.xxxxxxxxxxxx
lea rdx, [0x14004c808]
mov rcx, rax
call fcn.140001540
mov rbx, rax
test rax, rax
je 0x140001d14
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005dcf0], rbx
test rbx, rbx
je 0x140002543
lea rax, [rbx + 0xc]
mov qword [0x14005dcf0], rax
mov r12, qword [rsp + 0x68]
mov ebx, 0x8664
mov edi, 0xf8
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140001d55
mov rcx, qword [rcx]
lea rdx, str.pci.sys
call fcn.14002abc8
test eax, eax
jne 0x140002154
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001d77
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140001e31
mov ecx, dword [rax + 0x3c]
add rcx, rax
cmp rcx, rax
je 0x140001e31
mov esi, pe_nt_image_headers64
cmp word [rcx + 4], bx
cmovne rsi, rdi
add rsi, rcx
movzx r11d, r15w
movzx edi, word [rcx + 6]
cmp r15w, di
jae 0x140001e31
nop word [rax + rax]
movzx eax, r11w
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140001e27
mov ebx, dword [rsi + rcx*8 + 0xc]
add rbx, r14
mov r10d, dword [rsi + rcx*8 + 8]
sub r10, 6
mov r9, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c858]
mov al, 0x78
lea rcx, str.xxxxxx
mov r8, rbx
sub r8, qword [rsp + 0x48]
cmp al, 0x78
jne 0x140001e15
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001e6e
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140001e08
test rbx, rbx
jne 0x140001e7f
inc r11w
cmp r11w, di
jb 0x140001dc0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.pci.sys_DriverObject_not_found_n
jmp 0x1400025db
inc r9
inc rbx
cmp r9, r10
jbe 0x140001df0
jmp 0x140001e27
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], eax
mov byte [rbp - 0x6c], al
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400055a0
cmp byte [rsp + 0x7b], 0xe8
je 0x140001ee0
nop word [rax + rax]
movzx eax, byte [rsp + 0x70]
add rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], eax
mov byte [rbp - 0x6c], al
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400055a0
cmp byte [rsp + 0x7b], 0xe8
jne 0x140001eb0
movzx ecx, byte [rsp + 0x70]
movsxd rax, dword [rbp - 0x7b]
add rbx, rax
add rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], eax
mov byte [rbp - 0x44], al
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.1400055a0
cmp byte [rbp - 0x5d], 0xe8
je 0x140001f4c
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp - 0x68]
add rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], eax
mov byte [rbp - 0x44], al
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.1400055a0
cmp byte [rbp - 0x5d], 0xe8
jne 0x140001f20
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], eax
mov byte [rbp - 0x1c], al
movsxd rax, dword [rbp - 0x53]
movzx ecx, byte [rbp - 0x68]
add rax, rbx
add rcx, rax
lea rdx, [rbp - 0x40]
call fcn.1400055a0
movzx eax, byte [rbp - 0x23]
mov dword [0x14005dcb8], eax
mov eax, dword [r14 + 0x3c]
add rax, r14
cmp rax, r14
je 0x140001e31
mov esi, pe_nt_image_headers64
mov ecx, 0x8664
cmp word [rax + 4], cx
mov ecx, 0xf8
cmovne esi, ecx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140001e31
nop dword [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140002027
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 7
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c868]
mov al, 0x78
lea rcx, str.xx_xxxx
mov r8, r9
sub r8, qword [rsp + 0x30]
cmp al, 0x78
jne 0x140002015
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140002034
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140002008
test r9, r9
jne 0x140002041
inc bx
cmp bx, di
jb 0x140001fc0
jmp 0x140001e31
inc r10
inc r9
cmp r10, r11
jbe 0x140001ff0
jmp 0x140002027
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], eax
mov byte [rbp - 0x1c], al
lea rdx, [rbp - 0x40]
mov rcx, r9
call fcn.1400055a0
movzx eax, byte [rbp - 0x23]
mov dword [0x14005dcbc], eax
mov eax, dword [r14 + 0x3c]
add rax, r14
cmp rax, r14
je 0x140001e31
mov esi, pe_nt_image_headers64
mov ecx, 0x8664
cmp word [rax + 4], cx
mov ecx, 0xf8
cmovne esi, ecx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140001e31
nop word [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140002117
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 8
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c880]
mov al, 0x78
lea rcx, str.xxx____x
mov r8, r9
sub r8, qword [rsp + 0x38]
cmp al, 0x78
jne 0x140002105
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140002124
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x1400020f8
test r9, r9
jne 0x140002131
inc bx
cmp bx, di
jb 0x1400020b0
jmp 0x140001e31
inc r10
inc r9
cmp r10, r11
jbe 0x1400020e0
jmp 0x140002117
mov rbx, qword [r13 + 0x40]
sub rbx, r14
add rbx, r9
mov qword [0x14005dce0], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140001e3a
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140002162
mov rcx, qword [rcx]
lea rdx, str.acpi.sys
call fcn.14002abc8
test eax, eax
jne 0x1400021d3
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140002184
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140002574
lea r8, str.xxx____x_xxx
lea rdx, [0x14004c8d0]
mov rcx, rax
call fcn.140001540
mov rbx, rax
test rax, rax
je 0x1400021ba
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005dcc0], rbx
test rbx, rbx
je 0x14000257b
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400021e1
mov rcx, qword [rcx]
lea rdx, str.usbccgp.sys
call fcn.14002abc8
test eax, eax
jne 0x140002394
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140002203
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140002378
mov eax, dword [rax + 0x3c]
add rax, r14
cmp rax, r14
je 0x140002378
mov esi, pe_nt_image_headers64
mov ecx, 0x8664
cmp word [rax + 4], cx
mov edx, 0xf8
cmovne esi, edx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x1400022d1
nop
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x1400022bf
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 0xa
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c928]
mov al, 0x78
lea rcx, str.xxx____xxx
mov r8, r9
sub r8, qword [rsp + 0x40]
cmp al, 0x78
jne 0x1400022a9
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x14000242d
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140002298
test r9, r9
jne 0x140002459
inc bx
cmp bx, di
jb 0x140002250
mov ecx, 0x8664
mov edx, 0xf8
mov eax, dword [r14 + 0x3c]
add rax, r14
cmp rax, r14
je 0x140002378
mov esi, pe_nt_image_headers64
cmp word [rax + 4], cx
cmovne rsi, rdx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140002378
nop
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140002370
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 0xd
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c948]
mov cl, 0x78
lea rax, str.xxxxxx____xxx
mov r8, r9
sub r8, qword [rsp + 0x50]
cmp cl, 0x78
jne 0x14000235a
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x140002441
inc rdx
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x140002348
test r9, r9
jne 0x140002455
inc bx
cmp bx, di
jb 0x140002300
mov rbx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x1400025ac
mov qword [0x14005dd20], rbx
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400023a2
mov rcx, qword [rcx]
lea rdx, str.hidusb.sys
call fcn.14002abc8
test eax, eax
jne 0x1400023bd
mov rax, qword [r13 + 0x40]
mov qword [0x14005dce8], rax
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400023cb
mov rcx, qword [rcx]
lea rdx, str.mouhid.sys
call fcn.14002abc8
test eax, eax
jne 0x1400023e6
mov rax, qword [r13 + 0x40]
mov qword [0x14005dd18], rax
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400023f4
mov rcx, qword [rcx]
lea rdx, str.win32kfull.sys
call fcn.14002abc8
test eax, eax
jne 0x14000249e
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x14000241a
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x140002470
mov rbx, r15
jmp 0x140002497
inc r10
inc r9
cmp r10, r11
jbe 0x140002280
jmp 0x1400022bf
inc r10
inc r9
cmp r10, r11
jbe 0x140002330
jmp 0x140002370
add r9, 3
movsxd rbx, dword [r9 + 3]
add rbx, qword [r13 + 0x40]
sub rbx, r14
add rbx, 7
add rbx, r9
jmp 0x14000237b
lea rdx, str.memmove
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000248e
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005dd28], rbx
add r13, 0x50
cmp r13, r12
jne 0x140001c0b
lea rcx, [rbp - 0x18]
call fcn.1400044b0
mov rdi, r15
mov ecx, 0x10
call fcn.14001b0b0
mov rbx, rax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rsi, vtable.cl::clrt.0
mov qword [rax], rsi
mov qword [rax + 8], r15
mov rcx, rax
mov rax, qword [vtable.cl::clrt.0]
call rax
test eax, eax
je 0x14000260c
mov rdi, rbx
mov qword [0x14005dc98], rbx
jmp 0x14000261c
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, r15
lea rcx, str.ntoskrnl.exe_export__s_not_found_n
call fcn.140001350
jmp 0x1400025e0
mov qword [0x14005dcf0], r15
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ntoskrnl.exe_Offset_InterruptObject_not_found_n
jmp 0x1400025db
mov qword [0x14005dcc0], r15
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.acpi.sys_AcpiDriverObject_not_found_n
jmp 0x1400025db
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.usbccgp.sys_UsbccgpDriverObject_not_found_n
call fcn.140001350
mov ebx, 7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx edx, bx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x18]
call fcn.1400044b0
xor eax, eax
jmp 0x140002b69
mov qword [rbx], rsi
mov edx, 0x10
mov rcx, rbx
call fcn.14001b32c
mov dword [0x14005dd10], 1
test rdi, rdi
je 0x140002b64
cmp qword [0x14005dc90], 0
jne 0x140002690
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Run_as_Administrator_n
call fcn.140001350
mov ebx, 7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor eax, eax
jmp 0x140002b69
cmp qword [0x14005dce0], 0
je 0x140002605
cmp qword [0x14005dcc0], 0
je 0x140002605
cmp qword [0x14005dd28], 0
je 0x140002605
cmp qword [0x14005dd20], 0
je 0x140002605
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r9, [0x14005dcd0]
xor r8d, r8d
lea rdx, str.NtGdiGetUFI
mov rcx, rdi
call fcn.140001670
mov qword [0x14005dd48], rax
lea r9, [0x14005dcd8]
mov r8, qword [0x14005dd28]
lea rdx, str.NtGdiGetEmbUFI
mov rcx, rdi
call fcn.140001670
mov qword [0x14005dd40], rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiGetEmbUFI
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005dcc8], rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiGetUFI
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005dcf8], rax
cmp qword [0x14005dd48], 0
je 0x140002ba2
mov rdx, qword [0x14005dd40]
test rdx, rdx
je 0x140002ba2
mov rax, qword [rdi]
mov r10, qword [rax + 0x10]
lea rax, [method.cl::clrt.virtual_16]
mov r9d, 8
lea r8, [0x14005dd28]
cmp r10, rax
jne 0x1400027aa
mov rcx, qword [rdi + 8]
call fcn.140005160
jmp 0x1400027b0
mov rcx, rdi
call r10
mov dword [0x14005dd14], 1
mov qword [rdi], rsi
mov edx, 0x10
mov rcx, rdi
call fcn.14001b32c
mov qword [0x14005dc98], r15
mov dword [0x14005dd14], 1
mov rdx, qword [str.HalPrivateDispatchTable]
add rdx, 0xa0
mov ebx, 4
mov ecx, ebx
call fcn.1400045c0
mov rdi, rax
lea rdx, [rax + 0x1c]
mov r9d, ebx
lea r8, [rsp + 0x48]
mov ecx, ebx
call fcn.140002ea0
test eax, eax
mov eax, r15d
je 0x140002816
mov eax, dword [rsp + 0x48]
cdqe
add rdi, 0x20
add rdi, rax
mov esi, 0xc084
mov rdx, rdi
mov ecx, ebx
call fcn.1400045c0
cmp al, 0xe8
jne 0x14000283b
shr rax, 0x28
cmp ax, si
je 0x140002840
inc rdi
jmp 0x140002824
lea rdx, [rdi + 1]
mov r9, rbx
lea r8, [rsp + 0x48]
mov ecx, ebx
call fcn.140002ea0
test eax, eax
mov eax, r15d
je 0x14000285e
mov eax, dword [rsp + 0x48]
cdqe
add rdi, 5
add rdi, rax
mov esi, 0xd8b
nop dword [rax]
mov r9, rbx
lea r8, [rsp + 0x48]
mov rdx, rdi
mov ecx, ebx
call fcn.140002ea0
test eax, eax
jne 0x14000288f
mov eax, r15d
mov dword [rsp + 0x48], eax
jmp 0x140002893
mov eax, dword [rsp + 0x48]
cmp al, 0x4c
jne 0x14000289f
shr eax, 8
cmp ax, si
je 0x1400028a4
inc rdi
jmp 0x140002870
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rsp + 0x48]
mov ecx, ebx
call fcn.140002ea0
test eax, eax
mov eax, r15d
je 0x1400028c2
mov eax, dword [rsp + 0x48]
cdqe
add rdi, 7
add rax, rdi
mov qword [0x14005dca0], rax
add rax, 0xffffffffffffffe8
mov qword [0x14005dd50], rax
mov rdx, qword [str.MmGetVirtualForPhysical]
add rdx, 0x10
mov ecx, ebx
call fcn.1400045c0
sub rax, 8
mov qword [0x14005dd30], rax
mov rdx, qword [str.MmGetVirtualForPhysical]
add rdx, 0x22
mov ecx, ebx
call fcn.1400045c0
mov qword [0x14005dca8], rax
mov rdi, qword [0x14005dcc0]
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rsp + 0x48]
mov ecx, ebx
call fcn.140002ea0
test eax, eax
mov eax, r15d
je 0x140002938
mov eax, dword [rsp + 0x48]
movsxd rdx, eax
add rdi, 7
add rdx, rdi
mov ecx, ebx
call fcn.1400045c0
mov qword [0x14005dcc0], rax
mov rdi, qword [0x14005dce0]
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rsp + 0x48]
mov ecx, ebx
call fcn.140002ea0
test eax, eax
mov eax, r15d
je 0x140002975
mov eax, dword [rsp + 0x48]
movsxd rdx, eax
add rdx, 7
add rdx, rdi
mov ecx, ebx
call fcn.1400045c0
mov qword [0x14005dce0], rax
mov rdx, qword [0x14005dd20]
mov ecx, ebx
call fcn.1400045c0
mov qword [0x14005dd20], rax
mov r9, rbx
lea r8, [rsp + 0x48]
mov rdx, qword [0x14005dcf0]
mov ecx, ebx
call fcn.140002ea0
test eax, eax
mov eax, r15d
je 0x1400029c3
mov eax, dword [rsp + 0x48]
mov qword [0x14005dcf0], rax
mov rdx, qword [str.PsInitialSystemProcess]
mov ecx, ebx
call fcn.1400045c0
lea rdx, [rax + 0x28]
mov ecx, ebx
call fcn.1400045c0
mov qword [0x14005dd08], rax
xor edx, edx
xor ecx, ecx
call fcn.1400033f0
mov qword [0x14005dd00], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.1400041a0
nop
mov rax, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
sub rax, r14
test rax, 0xfffffffffffffff8
je 0x140002a33
mov r15, qword [r14]
and r15, 0xfffffffffffff000
mov rcx, r15
call fcn.140002be0
test rax, 0xfffffffffffff000
je 0x140002a6c
cmp qword [0x14005dd00], rax
je 0x140002a65
add r15, 0x1000
mov rcx, r15
call fcn.140002be0
test rax, 0xfffffffffffff000
jne 0x140002a43
jmp 0x140002a6c
mov qword [0x14005dd38], r15
mov rcx, qword [0x14005dd20]
add rcx, 8
call fcn.140004680
mov rsi, rax
nop
lea rdx, [rsi + 0x18]
mov ecx, ebx
call fcn.1400045c0
test rax, rax
je 0x140002aca
mov rdi, rax
lea rdx, [rax + 0x18]
mov ecx, ebx
call fcn.1400045c0
test rax, rax
jne 0x140002a90
test rdi, rdi
je 0x140002aca
lea rcx, [rdi + 8]
call fcn.140004680
mov rdi, rax
lea rcx, [rax + 0x18]
call fcn.140004680
cmp rax, qword [0x14005dce8]
je 0x140002b96
lea rcx, [rsi + 0x10]
call fcn.140004680
mov rsi, rax
test rax, rax
jne 0x140002a80
mov rdi, qword [0x14005dcb0]
lea rcx, [rdi + 8]
call fcn.140004680
mov rbx, rax
nop
lea rcx, [rbx + 0x18]
call fcn.140004680
test rax, rax
je 0x140002b19
lea rcx, [rax + 8]
call fcn.140004680
lea rcx, [rax + 0x18]
call fcn.140004680
cmp rax, qword [0x14005dd18]
je 0x140002b2a
lea rcx, [rbx + 0x10]
call fcn.140004680
mov rbx, rax
test rax, rax
jne 0x140002af0
test r14, r14
je 0x140002b64
mov rdx, qword [rsp + 0x60]
sub rdx, r14
and rdx, 0xfffffffffffffff8
mov rax, r14
cmp rdx, 0x1000
jb 0x140002b5c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bd6
mov rcx, r14
call fcn.14001b32c
mov eax, 1
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14001af70
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [0x14005dcb0], rdi
jmp 0x140002ae2
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Failed_to_locate_win32k_functions_n
jmp 0x140002668
call fcn.140024a38
int3