Function at 0x140001194
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x38], 0
lea rax, [0x14000ed00]
and qword [rbp - 0x20], 0
mov rdi, rcx
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x10], rax
mov bl, dl
mov dword [rbp - 0x18], 0x220020
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov r9, rax
test rax, rax
je 0x140001389
xor edx, edx
lea rsi, [0x140000000]
mov r11d, 0x29d
xor r8d, r8d
mov r10b, byte [r8 + rsi + 0x10380]
cmp r10b, 0xcc
je 0x14000120e
lea eax, [r8 + rdx]
cmp r10b, byte [rax + r9]
jne 0x14000136e
inc r8d
cmp r8d, 3
jb 0x1400011f2
mov ecx, edx
add rcx, 4
add rcx, r9
jne 0x14000125b
xor edx, edx
xor r8d, r8d
mov r10b, byte [r8 + rsi + 0x10384]
cmp r10b, 0xcc
je 0x140001243
lea eax, [r8 + rdx]
cmp r10b, byte [rax + r9]
jne 0x14000137e
inc r8d
cmp r8d, 3
jb 0x140001227
mov ecx, edx
add rcx, 4
add rcx, r9
je 0x140001389
mov eax, edx
mov esi, 0x275
movsxd rdx, dword [rcx]
add rax, r9
add rdx, rax
mov r8d, 0xedf
mov eax, dword [0x1400121d0]
mov r10d, 0x4d4
mov ecx, eax
lea r9d, [rsi + 0x29]
mov r11d, 0x343
sub ecx, 0x2800
je 0x1400012c3
sub ecx, 0x15a
je 0x1400012c3
sub ecx, r8d
je 0x1400012c3
sub ecx, r9d
je 0x1400012c3
sub ecx, r10d
je 0x1400012c3
sub ecx, r11d
je 0x1400012c3
sub ecx, esi
je 0x1400012c3
sub ecx, 0x257
je 0x1400012c3
cmp ecx, 1
mov ecx, 0x88
jne 0x1400012c8
mov ecx, 0x78
lea r14, [rdx + rcx]
sub eax, 0x295a
je 0x1400012fc
sub eax, r8d
je 0x1400012fc
sub eax, r9d
je 0x1400012fc
sub eax, r10d
je 0x1400012fc
sub eax, r11d
je 0x1400012fc
sub eax, esi
je 0x1400012fc
sub eax, 0x257
je 0x1400012fc
cmp eax, 1
mov eax, 0x1c0
jne 0x140001301
mov eax, 0x1a8
add rax, rdx
lea rcx, [rbp + 0x38]
xor edx, edx
mov qword [rbp + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
test bl, bl
je 0x1400013a3
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x20]
mov esi, 4
mov qword [rsp + 0x30], rcx
lea rdx, [rdi + 0x1808]
mov byte [rsp + 0x28], 0
mov rcx, rax
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8, rbx
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov ebx, eax
test eax, eax
js 0x140001411
and dword [rdi + 0x1808], 0
jmp 0x140001411
inc edx
cmp edx, r11d
jb 0x1400011ef
jmp 0x140001222
inc edx
cmp edx, r11d
jb 0x140001224
mov eax, 0xc0000225
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
and dword [rbp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
and dword [rsp + 0x28], 0
lea r9, [rdi + 0x1808]
mov rcx, qword [0x1400121e0]
mov esi, 4
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r8, r14
call fcn.140005b6c
mov ebx, eax
test eax, eax
js 0x140001411
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x20]
mov r9, r14
mov qword [rsp + 0x30], rcx
lea rdx, [rbp + 0x30]
mov byte [rsp + 0x28], 0
mov rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], rsi
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov ebx, eax
cmp qword [rbp + 0x38], 0
je 0x140001424
xor edx, edx
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov eax, ebx
jmp 0x14000138e