Function at 0x140004a60
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x1400102d0]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [0x140012fd0]
call fcn.140004a30
lea rcx, [0x140011b80]
call fcn.140004990
lea rcx, [0x140013410]
call fcn.140004930
lea rcx, [0x140013c60]
call fcn.1400049d0
lea rcx, [0x1400102f0]
call fcn.1400048f0
mov dword [rsp + 0x40], 0x114
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x110
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x140004af0
mov eax, dword [rsp + 0x4c]
mov dword [0x1400102e0], eax
cmp dword [0x1400102e0], 0x2800
jae 0x140004b01
jmp 0x140004ce8
lea rdx, [0x14000e470]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b40], rax
cmp qword [0x140011b40], 0
jne 0x140004b36
mov byte [0x1400102c3], 0
lea rdx, [0x14000e4a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b38], rax
cmp qword [0x140011b38], 0
je 0x140004b6f
movzx eax, byte [0x1400102c3]
test eax, eax
jne 0x140004b76
mov byte [0x1400102c2], 0
lea rdx, [0x14000e4d0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b48], rax
movzx eax, byte [0x1400102c2]
test eax, eax
je 0x140004baf
cmp qword [0x140011b48], 0
jne 0x140004bb6
mov byte [0x1400102c1], 0
lea rdx, [0x14000e4f0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b30], rax
cmp qword [0x140011b30], 0
jne 0x140004beb
mov byte [0x1400102c7], 0
lea rdx, [0x14000e520]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b50], rax
lea rdx, [0x14000e540]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b58], rax
lea rdx, [0x14000e570]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b60], rax
lea rdx, [0x14000e5a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140011b68], rax
cmp qword [0x140011b58], 0
jne 0x140004c8c
mov byte [0x1400102c8], 0
cmp qword [0x140011b50], 0
je 0x140004cb4
cmp qword [0x140011b58], 0
je 0x140004cb4
cmp qword [0x140011b60], 0
je 0x140004cb4
cmp qword [0x140011b68], 0
jne 0x140004cbb
mov byte [0x1400102c9], 0
call fcn.140003a20
test eax, eax
jl 0x140004ce8
lea rcx, [0x14000e5e0]
call fcn.140003df0
mov qword [0x140011b70], rax
cmp qword [0x140011b70], 0
je 0x140004ce8
mov byte [0x1400102ca], 1
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000d060
add rsp, 0x170
pop rdi
ret