Function at 0x5c9d17
Capabilities:
Inspect section memory permissions

Disassembly:
mov cl, byte [ebp - 0x25]
call dword [sym.imp.HAL.dll_KfLowerIrql]
cmp dword [0x4839fc], ebx
jne 0x5e52f4
mov eax, dword [0x479e1c]
mov ecx, dword [0x47a160]
add ecx, 0xfffffffb
cmp eax, ecx
ja 0x5e532d
mov ecx, dword [0x479e14]
cmp eax, ecx
ja 0x5e5339
push eax
push dword [0x479e18]
call fcn.005d9c90
or dword [0x488148], 0xffffffff
mov eax, 0x48813c
mov dword [0x488140], eax
mov dword [0x48813c], eax
mov eax, dword [0x48851c]
cmp eax, 0x400
mov ecx, eax
mov dword [0x488120], ebx
mov dword [0x48812c], esi
mov dword [0x488130], ebx
mov dword [0x488144], ebx
mov byte [0x488134], bl
mov byte [0x488136], 4
mov dword [0x488138], ebx
mov dword [0x488024], ecx
jbe 0x5c8b81
lea ecx, [eax - 0x400]
mov dword [0x488024], ecx
mov dword [0x488020], ecx
mov ecx, dword [0x47a160]
add eax, 0xfffffe00
add ecx, 0xfffffffb
cmp eax, ecx
mov dword [0x487fbc], eax
ja 0x5e5365
mov eax, 0x488058
mov byte [0x488050], bl
mov byte [0x488052], 4
mov dword [0x488054], ebx
mov dword [0x48805c], eax
mov dword [0x488058], eax
call fcn.005ddddb
push dword [ebp - 0x30]
call fcn.005d7019
test eax, eax
je 0x5cad29
mov eax, dword [0x488158]
cmp eax, ebx
jne 0x5e5370
mov dword [0x488158], 0x50
cmp dword [0x488528], 0x7f00
jbe 0x5c8c43
mov edi, dword [0x483794]
mov eax, dword [0x47a14c]
inc edi
shr edi, 0x14
and edi, 0xffc
sub edi, 0x3fd00000
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov byte [ebp - 0x25], al
test byte [edi], 1
je 0x5e538d
mov cl, byte [ebp - 0x25]
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov esi, dword [ebp - 0x24]
cmp esi, ebx
jne 0x5e53d9
mov dword [0x4839e8], ebx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0040d8f1
leave
ret 8
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x47aa20]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], edi
je 0x5d7afd
cmp dword [ebp + 8], 1
jne 0x5cace5
push edi
call fcn.005d212d
push edi
call fcn.005cd934
call fcn.005cd693
test eax, eax
je 0x5cad29
mov eax, dword fs:[0x124]
mov eax, dword [eax + 0x44]
add eax, 0x160
cmp dword [eax], ebx
jne 0x5c9d75
mov dword [eax + 4], eax
mov dword [eax], eax
push 0x20206d4d
push 4
push 1
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
cmp eax, ebx
mov dword [0x483ae0], eax
je 0x5cad29
mov ecx, 0xc03ff7c0
mov eax, ecx
mov esi, dword [eax]
shr esi, 0xc
call fcn.0040fe28
mov ecx, esi
shl ecx, 0xc
or eax, ecx
or eax, dword [0x479eec]
mov ecx, dword [0x483ae0]
mov dword [ecx], eax
mov ecx, dword [0x4884c8]
lea eax, [esi + esi*2]
lea esi, [ecx + eax*8]
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov cl, al
mov dword [esi + 0x10], 0x80
call dword [sym.imp.HAL.dll_KfLowerIrql]
cmp dword [sym.ntoskrnl.exe_MmHighestUserAddress], 0x7ffe0000
jb 0x5e5410
call fcn.005cdbb7
call fcn.005cd66a
call fcn.005cdabf
push 0x18
pop edi
push ebx
push 0x586add
push ebx
push ebx
lea eax, [ebp - 0x50]
push eax
mov esi, 0x1f03ff
push esi
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call sym.ntoskrnl.exe_PsCreateSystemThread
test eax, eax
jl 0x5cad29
push dword [ebp - 0x34]
call sym.ntoskrnl.exe_ZwClose
call fcn.005dc849
test eax, eax
je 0x5cad29
push ebx
push 0x40ea41
push ebx
mov eax, 0x488048
mov dword [0x48804c], eax
mov dword [0x488048], eax
push ebx
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
mov byte [0x488040], 1
mov byte [0x488042], 4
mov dword [0x488044], ebx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call sym.ntoskrnl.exe_PsCreateSystemThread
test eax, eax
jl 0x5cad29
push dword [ebp - 0x34]
call sym.ntoskrnl.exe_ZwClose
push ebx
push 0x4101c0
push ebx
push ebx
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
call sym.ntoskrnl.exe_PsCreateSystemThread
test eax, eax
jl 0x5cad29
push dword [ebp - 0x34]
call sym.ntoskrnl.exe_ZwClose
call fcn.005cd62e
push 1
mov ebx, 0x483b40
push ebx
call sym.ntoskrnl.exe_ExAcquireResourceExclusiveLite
mov esi, dword [0x483b20]
mov edi, 0x483b20
cmp esi, edi
je 0x5cda1f
push dword [esi + 0x18]
call sym.ntoskrnl.exe_RtlImageNtHeader
cmp word [eax + 0x40], 5
jb 0x5c9f03
cmp word [eax + 0x44], 5
jb 0x5c9f03
or byte [esi + 0x37], 8
push dword [esi + 0x18]
call fcn.004cfd8a
mov esi, dword [esi]
jmp 0x5c9ee1
cmp dword [ebp + 8], 2
jne 0x5cad29
call fcn.005cad35
jmp 0x5c8c49
mov ecx, edi
jmp 0x5d7bf2
mov ecx, esi
jmp 0x5d7c4d
add eax, 0x6000
jmp 0x5d80c6
cmp ecx, 0x4000
jb 0x5d832c
jmp 0x5d8326
mov ecx, dword [0x479e14]
jmp 0x5d84ef
xor al, al
jmp 0x5c8c4b
mov ecx, ebx
call sym.ntoskrnl.exe_ExReleaseResourceLite
mov eax, 0xffffffff
mov ecx, 0x47a130
xadd dword [ecx], eax
jmp 0x5c8c49
mov edx, dword [0x487f50]
mov dword [0x488518], 0x1c2
mov dword [0x488514], 0x7f
mov dword [sym.ntoskrnl.exe_MmHighestUserAddress], 0x7ffeffff
mov dword [sym.ntoskrnl.exe_MmUserProbeAddress], 0x7fff0000
mov dword [sym.ntoskrnl.exe_MmSystemRangeStart], 0x80000000
mov dword [0x4884c4], 0xc01fffbc
mov dword [0x4884c0], 0xc03007fc
mov eax, dword [edi + 0x58]
mov eax, dword [eax + 0x28]
shl eax, 0xc
add eax, 0x3fffff
and eax, 0xffc00000
cmp edx, 4
mov dword [0x48375c], eax
mov ecx, dword [edi + 0x64]
mov eax, 0x3000000
mov dword [0x488530], ecx
mov dword [0x487f60], eax
jae 0x5e4d52
mov edx, 0x1000000
cmp ecx, ebx
mov dword [0x487f50], edx
mov dword [0x487f2c], 0xc0000000
jne 0x5e4de4
mov esi, dword [0x487f20]
cmp esi, 4
jae 0x5e4d77
mov esi, 0x800000
mov ecx, 0xc0000000
sub ecx, esi
mov dword [0x487f30], ecx
mov ecx, dword [0x487f38]
cmp ecx, 4
mov dword [0x487f20], esi
jb 0x5e4da4
mov edi, 0x21400000
sub edi, eax
add ecx, 3
sub edi, edx
and ecx, 0xfffffffc
shr edi, 0x14
cmp ecx, edi
ja 0x5cacf5
cmp ecx, ebx
je 0x5cacf5
shl ecx, 0x14
lea eax, [eax + ecx - 0x1400000]
mov dword [0x487f60], eax
mov edi, 0xbfc00000
sub edi, ecx
mov dword [0x487f38], ecx
mov ecx, dword [0x487f34]
sub edi, esi
cmp ecx, 4
mov dword [0x487f40], edi
mov dword [0x487f48], edi
jb 0x5e4dae
mov esi, 0x21000000
sub esi, eax
add ecx, 3
sub esi, edx
and ecx, 0xfffffffc
shr esi, 0x14
cmp ecx, esi
ja 0x5cacfc
cmp ecx, ebx
je 0x5cacfc
shl ecx, 0x14
lea eax, [eax + ecx - 0x1000000]
mov dword [0x487f60], eax
sub edi, ecx
mov dword [0x487f34], ecx
mov ecx, edi
mov edi, dword [ebp - 0x30]
shr eax, 0x16
mov dword [0x487f4c], ecx
mov dword [0x487f6c], ecx
sub ecx, edx
mov dword [0x487f44], 0xc0000000
mov dword [0x487f3c], eax
mov dword [0x487f54], ecx
mov eax, 0xe1000000
sub eax, dword [0x479e10]
mov dword [0x4882a4], 0x7f7effff
push 0x5d8224
push dword [edi + 0x44]
shr eax, 0xc
mov dword [ebp - 0x2c], eax
xor esi, esi
call sym.ntoskrnl.exe_strstr
cmp eax, ebx
pop ecx
pop ecx
jne 0x5e4e11
cmp dword [0x488530], ebx
mov edx, dword [0x487f60]
jne 0x5e4e45
cmp esi, 0x40
jae 0x5e4f68
mov edx, dword [0x487f30]
mov eax, dword [0x487f6c]
mov ecx, dword [0x487f44]
mov edi, dword [0x487f60]
mov esi, eax
sub esi, dword [0x487f20]
shr edx, 0xa
lea esi, [esi + edi - 0x10000]
mov dword [0x487f68], esi
mov esi, 0x3ffffc
and edx, esi
mov edi, 0x40000000
sub edx, edi
mov dword [0x487f28], edx
mov edx, dword [0x487f2c]
shr edx, 0xa
shr eax, 0xa
and edx, esi
and eax, esi
sub edx, edi
sub eax, edi
shr ecx, 0xa
mov dword [0x487f24], edx
mov edx, dword [0x487f40]
mov dword [0x4884bc], eax
mov eax, dword [0x487f38]
and ecx, esi
add edx, eax
sub ecx, edi
cmp dword [0x47a0a0], ebx
mov dword [0x487f64], edx
mov dword [0x4884b8], ecx
je 0x5d7d6f
mov byte [0x47c308], 1
mov eax, 0x4839f0
mov dword [0x4839f4], eax
mov dword [0x4839f0], eax
mov eax, 0x483ac0
mov dword [0x483ac4], eax
mov dword [0x483ac0], eax
mov eax, 0x483ab8
mov dword [0x483abc], eax
mov dword [0x483ab8], eax
mov eax, 0x483578
push 0x483ab0
mov dword [0x48357c], eax
mov dword [0x483578], eax
call sym.ntoskrnl.exe_KeInitializeSpinLock
mov eax, dword [0x5d823c]
push 0xffffffffffffffff
cdq
mov edi, 0xff676980
push edi
push edx
push eax
call sym.ntoskrnl.exe__allmul
mov dword [0x487fb0], eax
mov eax, 0x488294
mov dword [0x488298], eax
mov dword [0x488294], eax
mov eax, 0x488274
xor esi, esi
inc esi
mov dword [0x488278], eax
mov dword [0x488274], eax
mov eax, 0x487f14
push ebx
push 0x483bc0
mov dword [0x487fb4], edx
mov dword [0x488280], esi
mov dword [0x488284], ebx
mov dword [0x488288], ebx
mov byte [0x48828c], 1
mov byte [0x48828e], 4
mov dword [0x488290], ebx
mov dword [0x488260], esi
mov dword [0x488264], ebx
mov dword [0x488268], ebx
mov byte [0x48826c], 1
mov byte [0x48826e], 4
mov dword [0x488270], ebx
mov dword [0x487f00], esi
mov dword [0x487f04], ebx
mov dword [0x487f08], ebx
mov byte [0x487f0c], 1
mov byte [0x487f0e], 4
mov dword [0x487f10], ebx
mov dword [0x487f18], eax
mov dword [0x487f14], eax
call sym.ntoskrnl.exe_KeInitializeMutant
mov eax, 0x4884a8
mov dword [0x4884ac], eax
mov dword [0x4884a8], eax
mov eax, 0x483688
mov dword [0x48368c], eax
mov dword [0x483688], eax
mov eax, 0x487bf8
mov dword [0x487bfc], eax
mov dword [0x487bf8], eax
mov eax, 0x488498
mov byte [0x4884a0], bl
mov byte [0x4884a2], 4
mov dword [0x4884a4], esi
mov byte [0x483680], bl
mov byte [0x483682], 4
mov dword [0x483684], esi
mov byte [0x487bf0], bl
mov byte [0x487bf2], 4
mov dword [0x487bf4], ebx
mov byte [0x488490], 1
mov byte [0x488492], 4
mov dword [0x488494], ebx
mov dword [0x48849c], eax
mov dword [0x488498], eax
mov byte [0x488030], bl
mov eax, 0x488038
mov dword [0x48803c], eax
mov dword [0x488038], eax
mov eax, 0x487cd8
push ebx
mov dword [0x487cdc], eax
mov dword [0x487cd8], eax
mov eax, 0x483a88
push 0x425032
push 0x483a60
mov byte [0x488032], 4
mov dword [0x488034], ebx
mov byte [0x487cd0], bl
mov byte [0x487cd2], 4
mov dword [0x487cd4], ebx
mov byte [0x483a80], bl
mov byte [0x483a82], 4
mov dword [0x483a84], ebx
mov dword [0x483a8c], eax
mov dword [0x483a88], eax
call sym.ntoskrnl.exe_KeInitializeDpc
push esi
push 0x483a20
call sym.ntoskrnl.exe_KeInitializeTimerEx
mov eax, dword [0x5d8240]
push 0xffffffffffffffff
cdq
push edi
push edx
push eax
call sym.ntoskrnl.exe__allmul
mov dword [0x483a90], eax
mov eax, 0x488150
mov dword [0x488154], eax
mov dword [0x488150], eax
mov eax, dword [ebp - 0x30]
mov dword [0x483a94], edx
mov dword [0x4882c0], ebx
mov dword [0x4882c4], ebx
mov dword [0x4882b8], ebx
mov dword [0x4882bc], ebx
mov dword [0x4882b0], ebx
mov dword [0x4882b4], ebx
mov byte [0x488484], bl
call fcn.005cd98f
push 6
pop ecx
mov eax, 0x1010101
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x20]
push eax
push edi
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
call fcn.005cd955
push 0x5d822c
push dword [edi + 0x44]
mov dword [ebp - 0x24], eax
call sym.ntoskrnl.exe_strstr
test eax, eax
pop ecx
pop ecx
jne 0x5e4fe7
push dword [ebp - 0x30]
call fcn.005de0a4
mov eax, dword [0x48833c]
cmp eax, ebx
mov edx, 0x2000
je 0x5e5037
cmp eax, 0xffffffff
je 0x5e506b
mov ecx, 0xc350
cmp eax, ecx
jbe 0x5d8059
mov eax, ecx
mov ecx, 0x1b58
cmp eax, ecx
jb 0x5e507b
cmp dword [0x479e58], ebx
jne 0x5d8078
mov dword [0x479e58], 0x100000
cmp dword [0x479e5c], ebx
jne 0x5d8086
mov dword [0x479e5c], edx
cmp dword [0x479e60], ebx
mov edi, 0x10000
jne 0x5d8099
mov dword [0x479e60], edi
cmp dword [0x479e64], ebx
jne 0x5d80ab
mov dword [0x479e64], 0x1000
cmp dword [0x47a064], 0xffffffff
jne 0x5cad03
mov ecx, dword [0x48380c]
cmp ecx, ebx
jne 0x5e5082
add eax, dword [0x480f1c]
cmp dword [0x488530], ebx
mov dword [0x48833c], eax
jne 0x5d80df
mov dword [0x483adc], ebx
push 0x487fe0
call sym.ntoskrnl.exe_ExInitializeResourceLite
push dword [ebp - 0x30]
call fcn.005ddd26
mov eax, 0x80000
mov dword [0x488024], eax
mov dword [0x488020], eax
mov eax, dword [0x4839e4]
cmp eax, ebx
jne 0x5e509f
cmp dword [ebp - 0x24], edi
mov dword [0x4839e4], edi
jb 0x5e5090
cmp dword [ebp - 0x24], 0x40000
jae 0x5d812f
mov dword [0x4839e4], 0x8000
call fcn.005cd67f
push dword [ebp - 0x30]
call fcn.005d212d
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x30]
call fcn.005d1279
cmp eax, ebx
mov dword [0x483ac8], eax
je 0x5e50d8
call fcn.005d4874
push 0x4881a0
call sym.ntoskrnl.exe_KeInitializeSpinLock
push 0x7fffffff
mov eax, 0x4881b8
push ebx
push 0x4881a4
mov dword [0x4881bc], eax
mov dword [0x4881b8], eax
call sym.ntoskrnl.exe_KeInitializeSemaphore
mov eax, 0x488188
mov dword [0x48818c], eax
mov dword [0x488188], eax
mov eax, 0x488180
mov dword [0x488184], eax
mov dword [0x488180], eax
mov eax, 0x488178
mov byte [0x488170], bl
mov byte [0x488172], 4
mov dword [0x488174], ebx
mov dword [0x48817c], eax
mov dword [0x488178], eax
call fcn.005cdb44
call fcn.0040d8f1
cmp dword [0x488530], ebx
jne 0x5e50df
mov eax, dword [0x488520]
add eax, 0x20
shr eax, 5
push 0x20206d4d
shl eax, 2
push eax
push ebx
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
cmp eax, ebx
je 0x5e50f3
mov ecx, dword [0x488520]
inc ecx
push ecx
push eax
mov edi, 0x483aa8
push edi
call sym.ntoskrnl.exe_RtlInitializeBitMap
push edi
call sym.ntoskrnl.exe_RtlClearAllBits
mov eax, dword [0x483ac8]
cmp dword [eax], ebx
mov dword [ebp - 0x24], ebx
jbe 0x5d826a
jmp 0x5d8244
mov ecx, dword [ebp - 0x24]
lea ecx, [eax + ecx*8 + 8]
mov edx, dword [ecx + 4]
cmp edx, ebx
je 0x5d8260
push edx
push dword [ecx]
push edi
call sym.ntoskrnl.exe_RtlSetBits
mov eax, dword [0x483ac8]
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax]
jb 0x5d8244
test byte [0x47c33c], 1
jne 0x5e5111
push dword [ebp - 0x30]
call fcn.005d1503
push dword [ebp - 0x30]
call fcn.005cd64b
mov ecx, dword [0x488528]
cmp ecx, 0xd00
push 2
pop edi
jbe 0x5e51b3
cmp ecx, 0x1300
jbe 0x5e51f0
add dword [0x479e18], 0x190
add dword [0x479e1c], 0x320
push 7
pop eax
mov dword [0x483a00], esi
mov dword [0x479e20], 5
mov dword [0x488018], 0x96
mov dword [0x48801c], 0x12c
mov dword [0x483ad4], 3
mov dword [0x483ad0], eax
mov dword [0x479e3c], eax
mov dword [0x47a0b0], 4
mov eax, 0x1800
cmp ecx, eax
jb 0x5e5242
cmp ecx, 0x2000
jb 0x5d832c
cmp dword [0x4839f8], 0x690057
jne 0x5cad0d
mov dword [0x483a00], edi
cmp ecx, 0x2100
jbe 0x5d8363
add dword [0x479e18], 0x1f4
add dword [0x479e1c], 0x384
add dword [0x47a0b0], 4
mov dword [0x488018], 0x190
mov dword [0x48801c], 0x320
cmp ecx, 0xdc00
jbe 0x5e5251
cmp dword [0x479e18], eax
jge 0x5d8384
cmp dword [0x479e1c], eax
jge 0x5d8384
mov dword [0x479e1c], eax
lea eax, [ebp - 0x38]
push eax
call sym.ntoskrnl.exe_MmIsVerifierEnabled
test eax, eax
mov ecx, dword [0x488528]
jge 0x5e5267
cmp ecx, 0xff00
jbe 0x5e526e
push 0x20
pop eax
cmp eax, ebx
mov dword [0x47a9b8], ebx
mov dword [0x47a9bc], ebx
jbe 0x5d83e5
mov dword [ebp - 0x24], eax
push 0x6d446d4d
push 0x48
push ebx
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
cmp eax, ebx
je 0x5d83da
mov edx, eax
mov ecx, 0x47a9b8
call sym.ntoskrnl.exe_InterlockedPushEntrySList
dec dword [ebp - 0x24]
jne 0x5d83bd
mov ecx, dword [0x488528]
mov dword [0xffdf02e8], ecx
mov eax, dword [0x4839f8]
cmp eax, 0x690057
jne 0x5e5282
mov dword [0xffdf0264], esi
mov dword [0x4839f8], ebx
mov dword [0x488518], 0xfa
mov dword [0x488514], 0x1e
xor eax, eax
cmp dword [0x4839f8], ebx
sete al
push eax
call fcn.005cda3d
mov eax, dword [0x48851c]
sub eax, dword [0x4838a4]
sub eax, dword [0x479e18]
sub eax, 0x20
mov dword [0x4884dc], eax
mov dword [0x483acc], eax
js 0x5cad29
push 0x487fc0
call sym.ntoskrnl.exe_KeInitializeSpinLock
mov eax, 0x4881d4
push 0x488220
mov dword [0x4881c0], esi
mov dword [0x4881c4], ebx
mov dword [0x4881c8], ebx
mov byte [0x4881cc], 1
mov byte [0x4881ce], 4
mov dword [0x4881d0], ebx
mov dword [0x4881d8], eax
mov dword [0x4881d4], eax
call sym.ntoskrnl.exe_ExInitializeResourceLite
push 0x4881e0
call sym.ntoskrnl.exe_ExInitializeResourceLite
mov eax, dword [0x483770]
mov ecx, dword [ebp - 0x2c]
mov edi, dword [0x479e0c]
lea edx, [eax + ecx]
mov eax, dword [0x488528]
shr edi, 0x14
add eax, 0x41
and edi, 0xffc
shr eax, 0xa
sub edi, 0x3fd00000
cmp eax, 4
jb 0x5cad1e
lea ecx, [eax - 2]
shl ecx, 0xe
cmp ecx, edx
mov dword [0x479e14], ecx
jbe 0x5d84ef
mov ecx, edx
mov dword [0x479e14], ecx
mov edx, dword [0x479e10]
mov eax, ecx
shl eax, 0xc
cmp ecx, dword [ebp - 0x2c]
lea eax, [eax + edx - 1]
mov dword [0x4882c8], eax
ja 0x5e52c4
mov ecx, dword [0x479e10]
mov dword [0x48376c], ecx
mov dword [0x483768], eax
shr eax, 0x14
and eax, 0xffc
sub eax, 0x3fd00000
mov dword [ebp - 0x24], eax
mov eax, dword [0x47a148]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov byte [ebp - 0x25], al
cmp edi, dword [ebp - 0x24]
ja 0x5c8adb
mov ecx, dword [0x4884d4]
and ecx, dword [0x487fb8]
inc dword [0x487fb8]
call fcn.0040fe00
mov ecx, dword [ebp - 0x2c]
mov edx, eax
push esi
and ecx, 0xfff
shl edx, 0xc
or ecx, edx
push edi
push eax
mov dword [ebp - 0x2c], ecx
mov dword [edi], ecx
call fcn.0041094e
push dword [0x40d8c4]
mov eax, edi
push 0x1000
shl eax, 0xa
push eax
call sym.ntoskrnl.exe_RtlFillMemoryUlong
add edi, 4
jmp 0x5d853e
cmp ecx, ebx
jne 0x5d7b7d
add edx, 3
and edx, 0xfffffffc
mov esi, 0x1d0
cmp edx, esi
ja 0x5e4d6d
cmp edx, ebx
jne 0x5e4d6f
mov edx, esi
shl edx, 0x14
jmp 0x5d7b82
mov eax, 0x1d800000
add esi, 3
sub eax, edx
and esi, 0xfffffffc
shr eax, 0x14
cmp esi, eax
ja 0x5e4d8f
cmp esi, ebx
jne 0x5e4d91
mov esi, eax
shl esi, 0x14
lea eax, [esi + 0x2800000]
mov dword [0x487f60], eax
jmp 0x5d7bae
mov ecx, 0x1400000
jmp 0x5d7c01
cmp ecx, ebx
jne 0x5e4dda
cmp dword [0x4839f8], 0x690057
je 0x5e4dda
mov esi, 0x20000000
sub esi, eax
sub esi, edx
mov ecx, 0x2000000
cmp esi, ecx
jb 0x5e4dda
add eax, 0x1000000
jmp 0x5d7c57
mov ecx, 0x1000000
jmp 0x5d7c5c
mov dword [0x487f38], 0x1400000
mov dword [0x487f34], 0x1000000
mov dword [0x487f20], 0x800000
mov dword [0x487f30], 0xbf800000
jmp 0x5d7c8f
push 0x5e5432
push eax
call sym.ntoskrnl.exe_strstr
cmp eax, ebx
pop ecx
pop ecx
je 0x5e4e3e
inc eax
push eax
call sym.ntoskrnl.exe_atol
mov esi, eax
add esi, 3
and esi, 0xfffffffc
cmp esi, 0x810
pop ecx
ja 0x5d7cc3
xor esi, esi
jmp 0x5d7cc3
mov ecx, dword [0x48375c]
cmp ecx, 0x1000000
jbe 0x5e4e64
mov eax, dword [0x47a15c]
lea eax, [eax + ecx - 0x1000000]
mov dword [0x47a15c], eax
cmp esi, 0x800
jbe 0x5e4e88
cmp esi, 0xc00
jae 0x5e4e88
add esi, 0xfffff800
shl esi, 0x14
cmp esi, ecx
mov dword [ebp - 0x24], esi
jae 0x5e4e90
mov esi, ecx
jmp 0x5e4e8d
mov esi, 0x40000000
mov dword [ebp - 0x24], esi
mov eax, dword [sym.ntoskrnl.exe_MmHighestUserAddress]
add dword [sym.ntoskrnl.exe_MmSystemRangeStart], esi
add dword [sym.ntoskrnl.exe_MmUserProbeAddress], esi
add eax, esi
shr esi, 0xc
add dword [0x47a160], esi
mov esi, 0x40000000
cmp dword [ebp - 0x24], esi
mov dword [sym.ntoskrnl.exe_MmHighestUserAddress], eax
je 0x5e4ed1
mov edi, dword [sym.ntoskrnl.exe_MmSystemRangeStart]
mov dword [0x483778], edi
mov dword [0x483774], 0xc0000000
mov edi, eax
shr eax, 0x14
and eax, 0xffc
sub eax, 0x3fd00000
shr edi, 0xa
mov dword [0x4884c0], eax
mov eax, dword [0x487f50]
and edi, 0x3ffffc
sub edi, esi
shr eax, 0xc
mov esi, edx
shr esi, 0xc
add eax, esi
mov esi, dword [0x487f34]
shr ecx, 0xc
add eax, ecx
sub dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
shl eax, 0xc
add eax, dword [0x479e10]
mov dword [0x4884c4], edi
lea ecx, [eax + edx]
shr edx, 0x16
mov dword [0x487f3c], edx
add esi, eax
mov edx, ecx
sub edx, dword [0x487f20]
mov dword [0x487f6c], eax
mov dword [0x487f54], ecx
mov dword [0x487f4c], eax
mov dword [0x487f48], esi
mov dword [0x487f40], esi
mov dword [0x487f44], ecx
mov dword [0x487f2c], ecx
mov dword [0x487f30], edx
jmp 0x5d7cef
mov ecx, 0x800
cmp esi, ecx
jae 0x5d7cde
mov edx, dword [sym.ntoskrnl.exe_MmSystemRangeStart]
mov eax, dword [sym.ntoskrnl.exe_MmHighestUserAddress]
sub ecx, esi
shl ecx, 0x14
sub dword [sym.ntoskrnl.exe_MmUserProbeAddress], ecx
sub dword [0x4882a4], ecx
sub edx, ecx
sub eax, ecx
mov esi, ecx
mov dword [sym.ntoskrnl.exe_MmSystemRangeStart], edx
mov dword [0x483778], edx
add edx, ecx
mov ecx, eax
mov dword [sym.ntoskrnl.exe_MmHighestUserAddress], eax
shr ecx, 0xa
shr eax, 0x14
shr esi, 0xc
sub dword [0x47a160], esi
and ecx, 0x3ffffc
sub ecx, 0x40000000
and eax, 0xffc
sub eax, 0x3fd00000
mov dword [0x483774], edx
mov dword [0x4884c4], ecx
mov dword [0x4884c0], eax
jmp 0x5d7cde
or dword [0x47a064], 0xffffffff
or dword [0x48380c], 0xffffffff
mov dword [0x487e60], ebx
mov dword [0x5ddd78], ebx
mov dword [0x47a068], esi
mov dword [0x479df4], ebx
mov dword [0x48847c], ebx
mov dword [0x47a0a0], ebx
mov dword [0x48834c], ebx
mov dword [0x47c310], esi
mov dword [0x47c28c], ebx
mov byte [0xffdf02ec], 1
jmp 0x5d8033
cmp dword [ebp - 0x24], 0x1300
jae 0x5e504a
mov eax, 0x1b58
jmp 0x5d8066
cmp dword [ebp - 0x24], edx
mov eax, 0x2af8
jbe 0x5d8066
cmp dword [0x5e04f8], esi
mov eax, 0x55f0
jne 0x5d8066
jmp 0x5e5071
or dword [0x488338], eax
mov eax, 0xc350
jmp 0x5d8066
mov eax, ecx
jmp 0x5d8066
cmp ecx, 0xffffffff
je 0x5d80c6
jmp 0x5cad03
mov dword [0x4839e4], 0x4000
jmp 0x5d812f
shl eax, 0xa
add eax, 0xfff
and eax, 0xfffff000
cmp eax, edi
mov dword [0x4839e4], eax
jbe 0x5e50c0
mov dword [0x4839e4], edi
jmp 0x5d812f
mov ecx, 0x1000
cmp eax, ecx
jae 0x5d812f
mov dword [0x4839e4], ecx
jmp 0x5d812f
push 0x100
jmp 0x5e50f8
mov eax, dword [0x487f6c]
add eax, 0x80000000
mov dword [0x488530], eax
jmp 0x5d81da
push 0x101
push dword [0x488524]
push dword [0x479d3c]
push dword [0x488528]
push 0x7d
call sym.ntoskrnl.exe_KeBugCheckEx
mov eax, dword [0x488520]
add eax, 0x20
shr eax, 5
mov edi, 0x20206d4d
push edi
lea eax, [eax*4 + 8]
push eax
push ebx
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
cmp eax, ebx
mov dword [0x483570], eax
je 0x5d8277
mov ecx, dword [0x488520]
inc ecx
push ecx
lea ecx, [eax + 8]
push ecx
push eax
call sym.ntoskrnl.exe_RtlInitializeBitMap
cmp dword [0x483570], ebx
je 0x5d8277
mov eax, dword [0x488520]
add eax, 0x20
shr eax, 5
push edi
lea eax, [eax*4 + 8]
push eax
push ebx
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
cmp eax, ebx
mov dword [0x48356c], eax
je 0x5e519c
mov ecx, dword [0x488520]
inc ecx
push ecx
lea ecx, [eax + 8]
push ecx
push eax
call sym.ntoskrnl.exe_RtlInitializeBitMap
cmp dword [0x48356c], ebx
jne 0x5d8277
push ebx
push dword [0x483570]
call sym.ntoskrnl.exe_ExFreePoolWithTag
mov dword [0x483570], ebx
jmp 0x5d8277
mov dword [0x483a00], ebx
mov dword [0x479e20], ebx
mov dword [0x488018], 0x28
mov dword [0x48801c], 0x64
mov dword [0x483ad4], ebx
mov dword [0x483ad0], esi
mov dword [0x479e3c], edi
mov dword [0x47a0b0], edi
jmp 0x5d8301
add dword [0x479e18], 0x64
mov eax, 0x96
add dword [0x479e1c], eax
mov dword [0x483a00], ebx
mov dword [0x479e20], edi
mov dword [0x488018], 0x50
mov dword [0x48801c], eax
mov dword [0x483ad4], esi
mov dword [0x483ad0], edi
mov dword [0x479e3c], 4
mov dword [0x47a0b0], 3
jmp 0x5d8301
mov dword [0x479e18], 0x20
jmp 0x5d830e
cmp ecx, 0x6e00
jbe 0x5d8384
mov eax, 0x1000
jmp 0x5d836f
xor eax, eax
jmp 0x5d83aa
mov eax, 0x7f00
cmp eax, ecx
sbb eax, eax
and eax, 4
add eax, 4
jmp 0x5d83aa
xor ecx, ecx
cmp eax, 0x61004c
setne cl
add ecx, edi
mov dword [0xffdf0264], ecx
add dword [0x47a0b0], 8
mov dword [0x4839f8], esi
mov dword [0x488518], 0x1c2
mov dword [0x488514], 0x50
mov dword [0x479e24], 0x51
jmp 0x5d841b
mov eax, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x2c]
shl eax, 0xc
lea eax, [eax + edx - 1]
mov edx, dword [0x483764]
shl ecx, 0xc
lea ecx, [edx + ecx - 1]
mov dword [0x4882c8], eax
mov dword [0x48376c], edx
mov dword [0x483768], ecx
jmp 0x5d851d
cmp dword [0x488528], 0x7ff0
jbe 0x5c8af0
mov eax, dword [0x479e1c]
mov ecx, dword [0x48851c]
lea edx, [eax + 0x4000]
cmp ecx, edx
jbe 0x5c8af5
lea eax, [ecx - 0x2000]
mov dword [0x479e1c], eax
jmp 0x5c8af5
mov eax, ecx
mov dword [0x479e1c], eax
jmp 0x5c8b06
mov edx, dword [0x479e18]
add edx, 0x1f4
cmp edx, ecx
mov eax, ecx
mov dword [0x479e1c], eax
jbe 0x5c8b14
add ecx, 0xfffffe0c
mov dword [0x479e18], ecx
jmp 0x5c8b14
mov dword [0x487fbc], ecx
jmp 0x5c8ba2
push 5
pop ecx
cmp eax, ecx
jb 0x5e5382
push 0x64
pop ecx
cmp eax, ecx
jbe 0x5c8bf0
mov dword [0x488158], ecx
jmp 0x5c8bf0
mov edx, esi
mov ecx, esi
call fcn.004114d9
mov ecx, dword [0x4884d4]
and ecx, dword [0x487fb8]
inc dword [0x487fb8]
call fcn.004109e7
mov ecx, dword [ebp - 0x2c]
mov edx, eax
push esi
and ecx, 0xfff
shl edx, 0xc
or ecx, edx
push edi
push eax
mov dword [ebp - 0x2c], ecx
mov dword [edi], ecx
call fcn.0041094e
add edi, 4
add dword [ebp - 0x24], 0x400
jmp 0x5c8c26
mov eax, dword [0x483794]
add dword [0x48833c], esi
inc eax
shr eax, 0xa
and eax, 0x3ffffc
sub eax, 0x40000000
push ebx
mov ecx, eax
push esi
shl ecx, 0xa
push eax
mov dword [0x488480], ecx
call fcn.00439ec9
push esi
call fcn.0043de30
jmp 0x5c8c43
mov eax, dword [0x483ae0]
or dword [eax], 4
mov eax, 0xc03007fc
or dword [eax], 4
mov eax, dword [0x483ae0]
mov eax, dword [eax]
mov dword [0xc01fff80], eax
jmp 0x5c9de7