Function at 0x140001af0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
cmp dword [0x14005daf0], 0
jne 0x140002a53
lea r8, [rbp - 0x11]
mov edx, 0x28
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r15d, r15d
test eax, eax
je 0x140001ba7
lea r8, [rbp + 0xf]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140001ba7
mov dword [rbp - 9], 1
mov rax, qword [rbp + 0xf]
mov qword [rbp - 5], rax
mov dword [rbp + 3], 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rbp - 9]
xor edx, edx
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001ba7
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x17]
call fcn.140015a60
mov r13, qword [rbp + 0x17]
mov r12, qword [rbp + 0x1f]
mov qword [rbp + 0xf], r12
cmp r13, r12
je 0x1400023aa
lea rax, str.xxxxxx
mov qword [rbp - 0x11], rax
lea rax, str.xx_xxxx
mov qword [rbp - 0x29], rax
lea rax, str.xxx____x
mov qword [rbp - 0x21], rax
lea rax, str.xxx____xxx
mov qword [rbp - 0x19], rax
lea rax, str.xxxxxx____xxx
mov qword [rbp - 9], rax
mov edi, 0xf8
mov ebx, 0x8664
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140001c14
mov rcx, qword [rcx]
lea rdx, str.ntoskrnl.exe
call fcn.14002a338
test eax, eax
jne 0x140001d36
mov rax, qword [r13 + 0x40]
mov qword [0x14005da70], rax
mov rdi, qword [0x14005db40]
mov r12, qword [0x14005db48]
cmp rdi, r12
je 0x140001cbc
nop word [rax + rax]
mov rax, qword [rdi]
mov r15, qword [rax]
mov r14, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001c68
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140001c7a
xor ebx, ebx
jmp 0x140001c9d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001c94
sub r14, rsi
add rbx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rdi]
mov qword [rax], rbx
mov rax, qword [rdi]
cmp qword [rax], 0
je 0x1400023fe
add rdi, 8
cmp rdi, r12
jne 0x140001c50
xor r15d, r15d
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001cce
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000243a
lea r8, str.xxxxxxxxxxxx
lea rdx, [0x14004c808]
mov rcx, rax
call fcn.140001540
mov rbx, rax
test rax, rax
je 0x140001d04
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005dad0], rbx
test rbx, rbx
je 0x140002441
lea rax, [rbx + 0xc]
mov qword [0x14005dad0], rax
mov r12, qword [rbp + 0xf]
mov ebx, 0x8664
mov edi, 0xf8
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140001d44
mov rcx, qword [rcx]
lea rdx, str.pci.sys
call fcn.14002a338
test eax, eax
jne 0x140002053
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001d66
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140001e1e
mov ecx, dword [rax + 0x3c]
add rcx, rax
cmp rcx, rax
je 0x140001e1e
mov esi, 0x108
cmp word [rcx + 4], bx
cmovne rsi, rdi
add rsi, rcx
movzx ebx, r15w
movzx edi, word [rcx + 6]
cmp r15w, di
jae 0x140001e1e
nop word [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140001e16
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 6
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c858]
mov al, 0x78
lea rcx, str.xxxxxx
mov r8, r9
sub r8, qword [rbp - 0x11]
cmp al, 0x78
jne 0x140001e04
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001e5b
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140001df7
test r9, r9
jne 0x140001e6c
inc bx
cmp bx, di
jb 0x140001db0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.pci.sys_DriverObject_not_found_n
jmp 0x1400024d9
inc r10
inc r9
cmp r10, r11
jbe 0x140001de0
jmp 0x140001e16
movsxd rcx, dword [r9 + 0xb]
add rcx, 0x16
add rcx, r9
movsxd rdx, dword [rcx + 1]
add rdx, 5
add rdx, rcx
cmp byte [rdx], 0x41
je 0x140001e90
lea rdx, [rdx + 1]
cmp byte [rdx], 0x41
jne 0x140001e87
movzx eax, byte [rdx + 1]
mov dword [0x14005da98], eax
mov eax, dword [r14 + 0x3c]
add rax, r14
cmp rax, r14
je 0x140001e1e
mov esi, 0x108
mov ecx, 0x8664
cmp word [rax + 4], cx
mov ecx, 0xf8
cmovne esi, ecx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140001e1e
nop word [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140001f46
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 7
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c868]
mov al, 0x78
lea rcx, str.xx_xxxx
mov r8, r9
sub r8, qword [rbp - 0x29]
cmp al, 0x78
jne 0x140001f34
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001f53
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140001f27
test r9, r9
jne 0x140001f60
inc bx
cmp bx, di
jb 0x140001ee0
jmp 0x140001e1e
inc r10
inc r9
cmp r10, r11
jbe 0x140001f10
jmp 0x140001f46
movzx eax, byte [r9 + 2]
mov dword [0x14005da9c], eax
mov eax, dword [r14 + 0x3c]
add rax, r14
cmp rax, r14
je 0x140001e1e
mov esi, 0x108
mov ecx, 0x8664
cmp word [rax + 4], cx
mov ecx, 0xf8
cmovne esi, ecx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140001e1e
nop word [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140002016
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 8
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c880]
mov al, 0x78
lea rcx, str.xxx____x
mov r8, r9
sub r8, qword [rbp - 0x21]
cmp al, 0x78
jne 0x140002004
movzx eax, byte [rdx]
cmp byte [rcx + r8], al
jne 0x140002023
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140001ff7
test r9, r9
jne 0x140002030
inc bx
cmp bx, di
jb 0x140001fb0
jmp 0x140001e1e
inc r10
inc r9
cmp r10, r11
jbe 0x140001fe0
jmp 0x140002016
mov rbx, qword [r13 + 0x40]
sub rbx, r14
add rbx, r9
mov qword [0x14005dac0], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140001e27
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140002061
mov rcx, qword [rcx]
lea rdx, str.acpi.sys
call fcn.14002a338
test eax, eax
jne 0x1400020d2
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140002083
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140002472
lea r8, str.xxx____x_xxx
lea rdx, [0x14004c8d0]
mov rcx, rax
call fcn.140001540
mov rbx, rax
test rax, rax
je 0x1400020b9
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005daa0], rbx
test rbx, rbx
je 0x140002479
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400020e0
mov rcx, qword [rcx]
lea rdx, str.usbccgp.sys
call fcn.14002a338
test eax, eax
jne 0x140002293
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140002102
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140002277
mov eax, dword [rax + 0x3c]
add rax, r14
cmp rax, r14
je 0x140002277
mov esi, 0x108
mov ecx, 0x8664
cmp word [rax + 4], cx
mov edx, 0xf8
cmovne esi, edx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x1400021d0
nop
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x1400021be
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 0xa
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c928]
mov al, 0x78
lea rcx, str.xxx____xxx
mov r8, r9
sub r8, qword [rbp - 0x19]
cmp al, 0x78
jne 0x1400021a8
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x14000232c
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140002197
test r9, r9
jne 0x140002358
inc bx
cmp bx, di
jb 0x140002150
mov ecx, 0x8664
mov edx, 0xf8
mov eax, dword [r14 + 0x3c]
add rax, r14
cmp rax, r14
je 0x140002277
mov esi, 0x108
cmp word [rax + 4], cx
cmovne rsi, rdx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140002277
nop
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x14000226f
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 0xd
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c948]
mov cl, 0x78
lea rax, str.xxxxxx____xxx
mov r8, r9
sub r8, qword [rbp - 9]
cmp cl, 0x78
jne 0x140002259
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x140002340
inc rdx
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x140002247
test r9, r9
jne 0x140002354
inc bx
cmp bx, di
jb 0x140002200
mov rbx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x1400024aa
mov qword [0x14005db00], rbx
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400022a1
mov rcx, qword [rcx]
lea rdx, str.hidusb.sys
call fcn.14002a338
test eax, eax
jne 0x1400022bc
mov rax, qword [r13 + 0x40]
mov qword [0x14005dac8], rax
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400022ca
mov rcx, qword [rcx]
lea rdx, str.mouhid.sys
call fcn.14002a338
test eax, eax
jne 0x1400022e5
mov rax, qword [r13 + 0x40]
mov qword [0x14005daf8], rax
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400022f3
mov rcx, qword [rcx]
lea rdx, str.win32kfull.sys
call fcn.14002a338
test eax, eax
jne 0x14000239d
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140002319
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14000236f
mov rbx, r15
jmp 0x140002396
inc r10
inc r9
cmp r10, r11
jbe 0x140002180
jmp 0x1400021be
inc r10
inc r9
cmp r10, r11
jbe 0x140002230
jmp 0x14000226f
add r9, 3
movsxd rbx, dword [r9 + 3]
add rbx, qword [r13 + 0x40]
sub rbx, r14
add rbx, 7
add rbx, r9
jmp 0x14000227a
lea rdx, str.memmove
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000238d
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005db08], rbx
add r13, 0x50
cmp r13, r12
jne 0x140001bfc
lea rcx, [rbp + 0x17]
call fcn.1400043a0
mov rdi, r15
mov ecx, 0x10
call fcn.14001a820
mov rbx, rax
mov qword [rbp - 9], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rsi, vtable.cl::clrt.0
mov qword [rax], rsi
mov qword [rax + 8], r15
mov rcx, rax
mov rax, qword [vtable.cl::clrt.0]
call rax
test eax, eax
je 0x14000250a
mov rdi, rbx
mov qword [0x14005da78], rbx
jmp 0x14000251a
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, r15
lea rcx, str.ntoskrnl.exe_export__s_not_found_n
call fcn.140001350
jmp 0x1400024de
mov qword [0x14005dad0], r15
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ntoskrnl.exe_Offset_InterruptObject_not_found_n
jmp 0x1400024d9
mov qword [0x14005daa0], r15
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.acpi.sys_AcpiDriverObject_not_found_n
jmp 0x1400024d9
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.usbccgp.sys_UsbccgpDriverObject_not_found_n
call fcn.140001350
mov ebx, 7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx edx, bx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x17]
call fcn.1400043a0
xor eax, eax
jmp 0x140002a58
mov qword [rbx], rsi
mov edx, 0x10
mov rcx, rbx
call fcn.14001aa9c
mov dword [0x14005daf0], 1
test rdi, rdi
je 0x140002a53
cmp qword [0x14005da70], 0
jne 0x14000258e
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Run_as_Administrator_n
call fcn.140001350
mov ebx, 7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor eax, eax
jmp 0x140002a58
cmp qword [0x14005dac0], 0
je 0x140002503
cmp qword [0x14005daa0], 0
je 0x140002503
cmp qword [0x14005db08], 0
je 0x140002503
cmp qword [0x14005db00], 0
je 0x140002503
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r9, [0x14005dab0]
xor r8d, r8d
lea rdx, str.NtGdiGetUFI
mov rcx, rdi
call fcn.140001670
mov qword [0x14005db28], rax
lea r9, [0x14005dab8]
mov r8, qword [0x14005db08]
lea rdx, str.NtGdiGetEmbUFI
mov rcx, rdi
call fcn.140001670
mov qword [0x14005db20], rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiGetEmbUFI
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005daa8], rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiGetUFI
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005dad8], rax
cmp qword [0x14005db28], 0
je 0x140002a91
mov rdx, qword [0x14005db20]
test rdx, rdx
je 0x140002a91
mov rax, qword [rdi]
mov r10, qword [rax + 0x10]
lea rax, [method.cl::clrt.virtual_16]
mov r9d, 8
lea r8, [0x14005db08]
cmp r10, rax
jne 0x1400026a8
mov rcx, qword [rdi + 8]
call fcn.140005050
jmp 0x1400026ae
mov rcx, rdi
call r10
mov dword [0x14005daf4], 1
mov qword [rdi], rsi
mov edx, 0x10
mov rcx, rdi
call fcn.14001aa9c
mov qword [0x14005da78], r15
mov dword [0x14005daf4], 1
mov rdx, qword [str.HalPrivateDispatchTable]
add rdx, 0xa0
mov ebx, 4
mov ecx, ebx
call fcn.1400044b0
mov rdi, rax
lea rdx, [rax + 0x1c]
mov r9d, ebx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d90
test eax, eax
mov eax, r15d
je 0x140002712
mov eax, dword [rbp - 0x11]
cdqe
add rdi, 0x20
add rdi, rax
mov esi, 0xc084
mov rdx, rdi
mov ecx, ebx
call fcn.1400044b0
cmp al, 0xe8
jne 0x140002737
shr rax, 0x28
cmp ax, si
je 0x14000273c
inc rdi
jmp 0x140002720
lea rdx, [rdi + 1]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d90
test eax, eax
mov eax, r15d
je 0x140002758
mov eax, dword [rbp - 0x11]
cdqe
add rdi, 5
add rdi, rax
mov esi, 0xd8b
nop word [rax + rax]
mov r9, rbx
lea r8, [rbp - 0x11]
mov rdx, rdi
mov ecx, ebx
call fcn.140002d90
test eax, eax
jne 0x14000278d
mov eax, r15d
mov dword [rbp - 0x11], eax
jmp 0x140002790
mov eax, dword [rbp - 0x11]
cmp al, 0x4c
jne 0x14000279c
shr eax, 8
cmp ax, si
je 0x1400027a1
inc rdi
jmp 0x140002770
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d90
test eax, eax
mov eax, r15d
je 0x1400027bd
mov eax, dword [rbp - 0x11]
cdqe
add rdi, 7
add rax, rdi
mov qword [0x14005da80], rax
add rax, 0xffffffffffffffe8
mov qword [0x14005db30], rax
mov rdx, qword [str.MmGetVirtualForPhysical]
add rdx, 0x10
mov ecx, ebx
call fcn.1400044b0
sub rax, 8
mov qword [0x14005db10], rax
mov rdx, qword [str.MmGetVirtualForPhysical]
add rdx, 0x22
mov ecx, ebx
call fcn.1400044b0
mov qword [0x14005da88], rax
mov rdi, qword [0x14005daa0]
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d90
test eax, eax
mov eax, r15d
je 0x140002831
mov eax, dword [rbp - 0x11]
movsxd rdx, eax
add rdi, 7
add rdx, rdi
mov ecx, ebx
call fcn.1400044b0
mov qword [0x14005daa0], rax
mov rdi, qword [0x14005dac0]
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d90
test eax, eax
mov eax, r15d
je 0x14000286c
mov eax, dword [rbp - 0x11]
movsxd rdx, eax
add rdx, 7
add rdx, rdi
mov ecx, ebx
call fcn.1400044b0
mov qword [0x14005dac0], rax
mov rdx, qword [0x14005db00]
mov ecx, ebx
call fcn.1400044b0
mov qword [0x14005db00], rax
mov r9, rbx
lea r8, [rbp - 0x11]
mov rdx, qword [0x14005dad0]
mov ecx, ebx
call fcn.140002d90
test eax, eax
mov eax, r15d
je 0x1400028b8
mov eax, dword [rbp - 0x11]
mov qword [0x14005dad0], rax
mov rdx, qword [str.PsInitialSystemProcess]
mov ecx, ebx
call fcn.1400044b0
lea rdx, [rax + 0x28]
mov ecx, ebx
call fcn.1400044b0
mov qword [0x14005dae8], rax
xor edx, edx
xor ecx, ecx
call fcn.1400032e0
mov qword [0x14005dae0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rax
lea rcx, [rbp - 9]
call fcn.140004090
nop
mov rax, qword [rbp - 1]
mov r14, qword [rbp - 9]
sub rax, r14
test rax, 0xfffffffffffffff8
je 0x140002923
mov r15, qword [r14]
and r15, 0xfffffffffffff000
mov rcx, r15
call fcn.140002ad0
test rax, 0xfffffffffffff000
je 0x14000295c
cmp qword [0x14005dae0], rax
je 0x140002955
add r15, 0x1000
mov rcx, r15
call fcn.140002ad0
test rax, 0xfffffffffffff000
jne 0x140002933
jmp 0x14000295c
mov qword [0x14005db18], r15
mov rcx, qword [0x14005db00]
add rcx, 8
call fcn.140004570
mov rsi, rax
nop
lea rdx, [rsi + 0x18]
mov ecx, ebx
call fcn.1400044b0
test rax, rax
je 0x1400029ba
mov rdi, rax
lea rdx, [rax + 0x18]
mov ecx, ebx
call fcn.1400044b0
test rax, rax
jne 0x140002980
test rdi, rdi
je 0x1400029ba
lea rcx, [rdi + 8]
call fcn.140004570
mov rdi, rax
lea rcx, [rax + 0x18]
call fcn.140004570
cmp rax, qword [0x14005dac8]
je 0x140002a85
lea rcx, [rsi + 0x10]
call fcn.140004570
mov rsi, rax
test rax, rax
jne 0x140002970
mov rdi, qword [0x14005da90]
lea rcx, [rdi + 8]
call fcn.140004570
mov rbx, rax
nop
lea rcx, [rbx + 0x18]
call fcn.140004570
test rax, rax
je 0x140002a09
lea rcx, [rax + 8]
call fcn.140004570
lea rcx, [rax + 0x18]
call fcn.140004570
cmp rax, qword [0x14005daf8]
je 0x140002a1a
lea rcx, [rbx + 0x10]
call fcn.140004570
mov rbx, rax
test rax, rax
jne 0x1400029e0
test r14, r14
je 0x140002a53
mov rdx, qword [rbp + 7]
sub rdx, r14
and rdx, 0xfffffffffffffff8
mov rax, r14
cmp rdx, 0x1000
jb 0x140002a4b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ac5
mov rcx, r14
call fcn.14001aa9c
mov eax, 1
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001a6e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [0x14005da90], rdi
jmp 0x1400029d2
lea rcx, str._drvscan_
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Failed_to_locate_win32k_functions_n
jmp 0x140002566
call fcn.1400241a8
int3