Function at 0x11c74
Capabilities:
Manipulate safe mode programs

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor eax, eax
xor r14d, r14d
lea rdx, [0x00040a70]
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
lea eax, [r14 + 8]
lea rcx, [rsp + 0x50]
mov dword [r11 + 0x10], r14d
mov word [rsp + 0x30], ax
lea eax, [r14 + 0xa]
mov word [rsp + 0x40], r14w
mov word [rsp + 0x32], ax
lea rax, [0x00040a60]
mov word [rsp + 0x50], r14w
mov r12b, r14b
mov byte [rsp + 0xe0], r14b
mov qword [r11 + 0x18], r14
mov qword [rsp + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
xor r9d, r9d
call fcn.00016aac
mov r15d, 0x6e65654b
lea r13d, [r14 + 1]
mov edi, eax
cmp eax, 0xc0000023
jne 0x11f3f
mov esi, dword [rsp + 0xe8]
cmp esi, r14d
je 0x12122
lea edi, [r14 + 0x20]
mov r8d, r15d
mov rdx, rsi
mov ecx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r14
jne 0x11d63
add edi, 0xffffffff
jne 0x11d42
mov rbx, r14
jmp 0x11d70
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.000407c0
cmp rbx, r14
jne 0x11d7f
mov edi, 0xc000009a
jmp 0x12122
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r9, rbx
mov dword [rsp + 0xe8], esi
call fcn.00016aac
cmp eax, r14d
mov edi, eax
jl 0x11f33
mov r12, rbx
lea edi, [rsi + 0x20]
mov r13d, 0x20
lea rdx, [rdi + 2]
mov r8d, r15d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
cmp rax, r14
jne 0x11ddc
add r13d, 0xffffffff
jne 0x11db7
mov rbp, r14
jmp 0x11dea
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
call fcn.000407c0
mov r13d, 1
cmp rbp, r14
jne 0x11e02
mov edi, 0xc000009a
mov r12b, r14b
jmp 0x11f33
mov rax, qword [0x00040b00]
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov qword [rbp], rax
mov rax, qword [0x00040b08]
lea rdx, [0x00040b20]
mov qword [rbp + 8], rax
mov rax, qword [0x00040b10]
mov qword [rbp + 0x10], rax
mov eax, dword [0x00040b18]
mov dword [rbp + 0x18], eax
movzx eax, word [0x00040b1c]
mov word [rbp + 0x1c], ax
xor eax, eax
repne scasw ax, word [rdi]
lea r8d, [rax + 0x20]
not rcx
sub rcx, r13
lea r15, [rbp + rcx*2 + 2]
mov rcx, r15
call fcn.00040300
mov rdi, rbx
jmp 0x11edd
mov rcx, rdx
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
lea rdx, [0x00040b00]
not rcx
sub rcx, r13
mov r13, rcx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
je 0x11ec7
lea rdx, [0x00040b20]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
je 0x11ec7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
repne scasw ax, word [rdi]
lea r8d, [r13 + r13 + 2]
mov rdx, r12
not rcx
lea r15, [r15 + rcx*2]
mov rcx, r15
call fcn.00040300
jmp 0x11ecc
lea r14d, [r14 + r13*2 + 2]
lea eax, [r13 + 1]
mov r13d, 1
lea r12, [r12 + rax*2]
mov rdi, r12
or rdx, 0xffffffffffffffff
xor eax, eax
mov rcx, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, r13
jne 0x11e66
lea r8d, [rdx + 8]
sub esi, r14d
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
lea r9d, [rsi + 0x42]
mov qword [rsp + 0x20], rbp
call fcn.00016b54
mov r15d, 0x6e65654b
mov rcx, rbp
mov edx, r15d
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r12b, byte [rsp + 0xe0]
xor r14d, r14d
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp edi, r14d
jl 0x12122
lea rdx, [0x00040b20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00040b50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx ecx, word [rsp + 0x42]
movzx eax, word [rsp + 0x32]
add ecx, eax
mov ebp, 0x20
movsxd rsi, ecx
lea rdx, [rsi + 0x10]
mov r8d, r15d
mov ecx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r14
jne 0x11fa2
add ebp, 0xffffffff
jne 0x11f80
mov rbx, r14
jmp 0x11fb0
lea r8, [rsi + 0x10]
xor edx, edx
mov rcx, rax
call fcn.000407c0
cmp rbx, r14
je 0x120f8
movzx eax, word [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rbx
add ax, word [rsp + 0x40]
mov word [rbx], ax
movzx eax, word [rsp + 0x42]
add ax, word [rsp + 0x32]
mov word [rbx + 2], ax
lea rax, [rbx + 0x10]
mov qword [rbx + 8], rax
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
cmp eax, r14d
mov edi, eax
jl 0x120ec
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x28]
call fcn.000407c0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.000166f4
cmp eax, r14d
mov edi, eax
jl 0x120ec
mov ebp, 0x20
mov r8d, r15d
mov edx, 0x1a
mov ecx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r14
jne 0x1205b
add ebp, 0xffffffff
jne 0x12038
mov rsi, r14
jmp 0x1206c
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], ax
cmp rsi, r14
je 0x120ce
xor eax, eax
lea rdx, [rsp + 0x60]
mov r9d, 0x1a
mov qword [rsp + 0x62], rax
mov dword [rsp + 0x6a], eax
mov word [rsp + 0x6e], ax
mov rax, qword [0x00040be0]
mov r8d, r13d
mov rcx, rbx
mov qword [rsi], rax
mov rax, qword [0x00040be8]
mov word [rsp + 0x60], r14w
mov qword [rsi + 8], rax
mov rax, qword [0x00040bf0]
mov qword [rsp + 0x20], rsi
mov qword [rsi + 0x10], rax
call fcn.00016b54
mov edx, r15d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x0006a6e0]
mov rcx, qword [rsp + 0xf0]
cmp rax, r14
je 0x120e6
call rax
jmp 0x120ec
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r12b, r14b
jne 0x1210c
mov r12b, r13b
lea rdx, [0x00040c00]
jmp 0x11f61
mov eax, dword [0x00062968]
cmp edi, 0xc0000034
cmove eax, r13d
mov dword [0x00062968], eax
mov eax, edi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret