Function at 0x330b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, edx
mov ebp, edx
mov ebx, edx
and edi, 4
je 0x330fb
lea rdx, [0x00050c90]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d828], rax
jne 0x330fb
and ebx, 0xfffffffb
test edi, edi
je 0x3312b
lea rdx, [0x00050c60]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d830], rax
jne 0x3312b
and ebx, 0xfffffffb
mov edi, ebp
and edi, 1
je 0x3315e
lea rdx, [0x00050c30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d848], rax
jne 0x3315e
and ebx, 0xfffffffe
test edi, edi
je 0x331be
lea rdx, [0x00050bf0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d850], rax
jne 0x3318e
and ebx, 0xfffffffe
test edi, edi
je 0x331be
lea rdx, [0x00050bc0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d858], rax
jne 0x331be
and ebx, 0xfffffffe
mov esi, ebp
and esi, 2
je 0x331f1
lea rdx, [0x00050b80]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d860], rax
jne 0x331f1
and ebx, 0xfffffffd
test esi, esi
je 0x33285
lea rdx, [0x00050b40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d868], rax
jne 0x33225
and ebx, 0xfffffffd
test esi, esi
je 0x33285
lea rdx, [0x00050b00]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d870], rax
jne 0x33255
and ebx, 0xfffffffd
test esi, esi
je 0x33285
lea rdx, [0x00050ae0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d878], rax
jne 0x33285
and ebx, 0xfffffffd
test edi, edi
je 0x332b5
lea rdx, [0x00050aa0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d880], rax
jne 0x332b5
and ebx, 0xfffffffe
test esi, esi
je 0x332e5
lea rdx, [0x00050a50]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d888], rax
jne 0x332e5
and ebx, 0xfffffffd
test edi, edi
je 0x33345
lea rdx, [0x00050a20]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d890], rax
jne 0x33315
and ebx, 0xfffffffe
test edi, edi
je 0x33345
lea rdx, [0x000509f0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d898], rax
jne 0x33345
and ebx, 0xfffffffe
test esi, esi
je 0x33375
lea rdx, [0x000509a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8a0], rax
jne 0x33375
and ebx, 0xfffffffd
test edi, edi
je 0x33409
lea rdx, [0x00050980]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8a8], rax
jne 0x333a9
and ebx, 0xfffffffe
test edi, edi
je 0x33409
lea rdx, [0x00050960]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8b0], rax
jne 0x333d9
and ebx, 0xfffffffe
test edi, edi
je 0x33409
lea rdx, [0x00050940]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8b8], rax
jne 0x33409
and ebx, 0xfffffffe
test esi, esi
je 0x3349d
lea rdx, [0x00050910]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8c0], rax
jne 0x3343d
and ebx, 0xfffffffd
test esi, esi
je 0x3349d
lea rdx, [0x000508e0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8c8], rax
jne 0x3346d
and ebx, 0xfffffffd
test esi, esi
je 0x3349d
lea rdx, [0x000508b0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8d0], rax
jne 0x3349d
and ebx, 0xfffffffd
test edi, edi
je 0x33705
lea rdx, [0x00050880]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8d8], rax
jne 0x334d1
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x00050840]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8e0], rax
jne 0x33505
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x00050810]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8e8], rax
jne 0x33539
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x000507e0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8f0], rax
jne 0x3356d
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x000507a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d8f8], rax
jne 0x335a1
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x00050760]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d900], rax
jne 0x335d5
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x00050720]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d908], rax
jne 0x33609
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x000506f0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d910], rax
jne 0x3363d
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x000506c0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d918], rax
jne 0x33671
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x000506a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d920], rax
jne 0x336a5
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x00050670]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d928], rax
jne 0x336d5
and ebx, 0xfffffffe
test edi, edi
je 0x33705
lea rdx, [0x00050650]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d930], rax
jne 0x33705
and ebx, 0xfffffffe
test esi, esi
je 0x33735
lea rdx, [0x00050620]