Function at 0x14000193c
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r14, r8
mov qword [rsp + 0x30], rcx
mov r12, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x100
mov r15, r9
xor r13d, r13d
call fcn.14000e880
xor edi, edi
mov dword [rsp + 0x20], edi
cmp qword [sym.imp.ntoskrnl.exe_CmRegisterCallback], rdi
je 0x140001b95
xor edx, edx
lea rbp, [0x140000000]
mov sil, 0xcc
lea r11d, [r13 + 1]
xor r8d, r8d
mov r9b, byte [r8 + rbp + 0x103c0]
cmp r9b, sil
je 0x1400019d8
mov rax, qword [sym.imp.ntoskrnl.exe_CmRegisterCallback]
lea ecx, [r8 + rdx]
cmp r9b, byte [rcx + rax]
jne 0x140001b89
add r8d, r11d
cmp r8d, r11d
jb 0x1400019b6
mov r8, qword [sym.imp.ntoskrnl.exe_CmRegisterCallback]
inc r8
mov ecx, edx
add r8, rcx
je 0x140001b95
mov r9, qword [sym.imp.ntoskrnl.exe_CmRegisterCallback]
add r9, 5
mov ecx, edx
movsxd rdx, dword [r8]
add r9, rcx
add r9, rdx
je 0x140001b95
xor edx, edx
xor r8d, r8d
mov r10b, byte [r8 + rbp + 0x103bc]
cmp r10b, sil
je 0x140001a31
lea eax, [r8 + rdx]
cmp r10b, byte [rax + r9]
jne 0x140001bcb
add r8d, r11d
cmp r8d, 3
jb 0x140001a16
mov ecx, edx
add rcx, 3
add rcx, r9
je 0x140001b95
movsxd r8, dword [rcx]
mov eax, edx
add r8, 7
add rax, r9
add r8, rax
je 0x140001b95
xor edx, edx
mov ebx, 0xc4
xor r9d, r9d
mov r10b, byte [r9 + rbp + 0x103b4]
cmp r10b, sil
je 0x140001a83
lea eax, [r9 + rdx]
cmp r10b, byte [rax + r8]
jne 0x140001bdc
add r9d, r11d
cmp r9d, 2
jb 0x140001a68
mov ecx, edx
add rcx, 3
add rcx, r8
je 0x140001b95
movsxd rbp, dword [rcx]
add rbp, 7
mov ecx, edx
add rbp, r8
add rbp, rcx
xor r9d, r9d
xor edx, edx
lea rcx, [0x140000000]
mov r10b, byte [rdx + rcx + 0x103c4]
cmp r10b, sil
je 0x140001ad8
lea eax, [rdx + r9]
cmp r10b, byte [rax + r8]
jne 0x140001be9
lea rcx, [0x140000000]
add edx, r11d
cmp edx, 3
jb 0x140001ab6
mov ecx, r9d
add rcx, 3
add rcx, r8
je 0x140001b95
movsxd rcx, dword [rcx]
mov eax, r9d
add rax, r8
xor edx, edx
mov esi, dword [rcx + rax + 7]
xor r9d, r9d
lea rcx, [0x140000000]
mov r10b, byte [r9 + rcx + 0x103b8]
cmp r10b, 0xcc
je 0x140001b2c
lea eax, [r9 + rdx]
cmp r10b, byte [rax + r8]
jne 0x140001bf7
lea rcx, [0x140000000]
add r9d, r11d
cmp r9d, 3
jb 0x140001b09
mov ecx, edx
add rcx, 3
add rcx, r8
je 0x140001b95
movsxd rax, dword [rcx]
add r8, 7
mov ecx, edx
add rax, r8
add rcx, rax
xor edx, edx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rbx, rbp
test r15, r15
je 0x140001c04
test r14, r14
je 0x140001c04
cmp qword [rbx + 0x28], r15
jne 0x140001c6c
mov qword [rbx + 0x28], r14
jmp 0x140001c6c
add edx, r11d
cmp edx, 0x22
jb 0x1400019b3
mov eax, 0xc0000225
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000e590
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
add edx, r11d
cmp edx, 0x108
jb 0x140001a13
jmp 0x140001b95
add edx, r11d
cmp edx, ebx
jb 0x140001a65
jmp 0x140001b95
add r9d, r11d
cmp r9d, ebx
jb 0x140001aad
jmp 0x140001b95
add edx, r11d
cmp edx, ebx
jb 0x140001aff
jmp 0x140001b95
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140001c72
mov eax, edi
lea r8, [rsp + 0x40]
imul rdi, rax, 0x110
mov rax, qword [r12 + 8]
mov qword [rdi + rax], rcx
mov rcx, qword [r12 + 8]
mov rax, qword [rbx + 0x20]
mov qword [rcx + rdi + 8], rax
mov rdx, qword [r12 + 8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rdx + rdi]
call fcn.140001cac
test eax, eax
js 0x140001c68
mov rcx, qword [r12 + 8]
lea r8, [rsp + 0x40]
add rcx, 0x10
mov edx, 0x100
add rcx, rdi
call sub.ntoskrnl.exe_strcpy_s
test eax, eax
jne 0x140001c80
mov edi, dword [rsp + 0x20]
inc edi
mov dword [rsp + 0x20], edi
mov rbx, qword [rbx]
cmp rbx, rbp
jne 0x140001b64
jmp 0x140001c86
mov r13d, 0x80
xor edx, edx
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
test r15, r15
jne 0x140001ca1
test r14, r14
jne 0x140001ca1
mov dword [r12], esi
mov eax, r13d
jmp 0x140001b9a