Function at 0x140001af0
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140057040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
cmp dword [0x14005dae8], 0
jne 0x1400029f3
lea r8, [rbp - 0x11]
mov edx, 0x28
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r15d, r15d
test eax, eax
je 0x140001ba7
lea r8, [rbp + 0xf]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140001ba7
mov dword [rbp - 9], 1
mov rax, qword [rbp + 0xf]
mov qword [rbp - 5], rax
mov dword [rbp + 3], 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rbp - 9]
xor edx, edx
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001ba7
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x17]
call fcn.140016170
mov r13, qword [rbp + 0x17]
mov r12, qword [rbp + 0x1f]
mov qword [rbp + 0xf], r12
cmp r13, r12
je 0x14000234a
lea rax, str.xxxxxx
mov qword [rbp - 0x11], rax
lea rax, str.xx_xxxx
mov qword [rbp - 0x29], rax
lea rax, str.xxx____x
mov qword [rbp - 0x21], rax
lea rax, str.xxx____xxx
mov qword [rbp - 0x19], rax
lea rax, str.xxxxxx____xxx
mov qword [rbp - 9], rax
mov edi, 0xf8
mov ebx, 0x8664
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140001c14
mov rcx, qword [rcx]
lea rdx, str.ntoskrnl.exe
call fcn.14002aa48
test eax, eax
jne 0x140001d36
mov rax, qword [r13 + 0x40]
mov qword [0x14005da70], rax
mov rdi, qword [0x14005db38]
mov r12, qword [0x14005db40]
cmp rdi, r12
je 0x140001cbc
nop word [rax + rax]
mov rax, qword [rdi]
mov r15, qword [rax]
mov r14, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001c68
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140001c7a
xor ebx, ebx
jmp 0x140001c9d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001c94
sub r14, rsi
add rbx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rdi]
mov qword [rax], rbx
mov rax, qword [rdi]
cmp qword [rax], 0
je 0x14000239e
add rdi, 8
cmp rdi, r12
jne 0x140001c50
xor r15d, r15d
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001cce
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400023da
lea r8, str.xxxxxxxxxxxx
lea rdx, [0x14004c808]
mov rcx, rax
call fcn.140001540
mov rbx, rax
test rax, rax
je 0x140001d04
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005dac8], rbx
test rbx, rbx
je 0x1400023e1
lea rax, [rbx + 0xc]
mov qword [0x14005dac8], rax
mov r12, qword [rbp + 0xf]
mov ebx, 0x8664
mov edi, 0xf8
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140001d44
mov rcx, qword [rcx]
lea rdx, str.pci.sys
call fcn.14002aa48
test eax, eax
jne 0x140001ff3
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140001d66
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140001e1e
mov ecx, dword [rax + 0x3c]
add rcx, rax
cmp rcx, rax
je 0x140001e1e
mov esi, 0x108
cmp word [rcx + 4], bx
cmovne rsi, rdi
add rsi, rcx
movzx ebx, r15w
movzx edi, word [rcx + 6]
cmp r15w, di
jae 0x140001e1e
nop word [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140001e16
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 6
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c858]
mov al, 0x78
lea rcx, str.xxxxxx
mov r8, r9
sub r8, qword [rbp - 0x11]
cmp al, 0x78
jne 0x140001e04
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001e5b
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140001df7
test r9, r9
jne 0x140001e6c
inc bx
cmp bx, di
jb 0x140001db0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x14004c6b0]
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.pci.sys_DriverObject_not_found_n
jmp 0x140002479
inc r10
inc r9
cmp r10, r11
jbe 0x140001de0
jmp 0x140001e16
mov eax, dword [r14 + 0x3c]
add rax, r14
mov edi, 0x108
mov ecx, 0x8664
cmp word [rax + 4], cx
mov ecx, 0xf8
cmovne edi, ecx
add rdi, rax
movzx ebx, r15w
movzx esi, word [rax + 6]
nop dword [rax]
nop dword [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rdi + rcx*8 + 0x24], 0x20
je 0x140001f06
mov r9d, dword [rdi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rdi + rcx*8 + 8]
sub r11, 7
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c868]
mov al, 0x78
lea rcx, str.xx_xxxx
mov r8, r9
sub r8, qword [rbp - 0x29]
cmp al, 0x78
jne 0x140001ef4
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001f13
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140001ee7
test r9, r9
jne 0x140001f20
inc bx
cmp bx, si
jb 0x140001ea0
jmp 0x140001e1e
inc r10
inc r9
cmp r10, r11
jbe 0x140001ed0
jmp 0x140001f06
mov eax, dword [r14 + 0x3c]
add rax, r14
mov esi, 0x108
mov ecx, 0x8664
cmp word [rax + 4], cx
mov ecx, 0xf8
cmovne esi, ecx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140001e1e
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x140001fb6
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 8
mov r10, r15
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x14004c880]
mov al, 0x78
lea rcx, str.xxx____x
mov r8, r9
sub r8, qword [rbp - 0x21]
cmp al, 0x78
jne 0x140001fa4
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001fc3
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140001f97
test r9, r9
jne 0x140001fd0
inc bx
cmp bx, di
jb 0x140001f52
jmp 0x140001e1e
inc r10
inc r9
cmp r10, r11
jbe 0x140001f80
jmp 0x140001fb6
mov rbx, qword [r13 + 0x40]
sub rbx, r14
add rbx, r9
mov qword [0x14005dab8], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x140001e27
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140002001
mov rcx, qword [rcx]
lea rdx, str.acpi.sys
call fcn.14002aa48
test eax, eax
jne 0x140002072
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140002023
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140002412
lea r8, str.xxx____x_xxx
lea rdx, [0x14004c8d0]
mov rcx, rax
call fcn.140001540
mov rbx, rax
test rax, rax
je 0x140002059
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005da98], rbx
test rbx, rbx
je 0x140002419
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140002080
mov rcx, qword [rcx]
lea rdx, str.usbccgp.sys
call fcn.14002aa48
test eax, eax
jne 0x140002233
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1400020a2
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140002217
mov eax, dword [rax + 0x3c]
add rax, r14
cmp rax, r14
je 0x140002217
mov esi, 0x108
mov ecx, 0x8664
cmp word [rax + 4], cx
mov edx, 0xf8
cmovne esi, edx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140002170
nop
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x14000215e
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 0xa
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c928]
mov al, 0x78
lea rcx, str.xxx____xxx
mov r8, r9
sub r8, qword [rbp - 0x19]
cmp al, 0x78
jne 0x140002148
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x1400022cc
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140002137
test r9, r9
jne 0x1400022f8
inc bx
cmp bx, di
jb 0x1400020f0
mov ecx, 0x8664
mov edx, 0xf8
mov eax, dword [r14 + 0x3c]
add rax, r14
cmp rax, r14
je 0x140002217
mov esi, 0x108
cmp word [rax + 4], cx
cmovne rsi, rdx
add rsi, rax
movzx ebx, r15w
movzx edi, word [rax + 6]
cmp r15w, di
jae 0x140002217
nop
movzx eax, bx
lea rcx, [rax + rax*4]
test byte [rsi + rcx*8 + 0x24], 0x20
je 0x14000220f
mov r9d, dword [rsi + rcx*8 + 0xc]
add r9, r14
mov r11d, dword [rsi + rcx*8 + 8]
sub r11, 0xd
mov r10, r15
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004c948]
mov cl, 0x78
lea rax, str.xxxxxx____xxx
mov r8, r9
sub r8, qword [rbp - 9]
cmp cl, 0x78
jne 0x1400021f9
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x1400022e0
inc rdx
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x1400021e7
test r9, r9
jne 0x1400022f4
inc bx
cmp bx, di
jb 0x1400021a0
mov rbx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14000244a
mov qword [0x14005daf8], rbx
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140002241
mov rcx, qword [rcx]
lea rdx, str.hidusb.sys
call fcn.14002aa48
test eax, eax
jne 0x14000225c
mov rax, qword [r13 + 0x40]
mov qword [0x14005dac0], rax
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x14000226a
mov rcx, qword [rcx]
lea rdx, str.mouhid.sys
call fcn.14002aa48
test eax, eax
jne 0x140002285
mov rax, qword [r13 + 0x40]
mov qword [0x14005daf0], rax
lea rcx, [r13 + 0x20]
cmp qword [rcx + 0x18], 0xf
jbe 0x140002293
mov rcx, qword [rcx]
lea rdx, str.win32kfull.sys
call fcn.14002aa48
test eax, eax
jne 0x14000233d
mov rsi, qword [r13 + 0x40]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1400022b9
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14000230f
mov rbx, r15
jmp 0x140002336
inc r10
inc r9
cmp r10, r11
jbe 0x140002120
jmp 0x14000215e
inc r10
inc r9
cmp r10, r11
jbe 0x1400021d0
jmp 0x14000220f
add r9, 3
movsxd rbx, dword [r9 + 3]
add rbx, qword [r13 + 0x40]
sub rbx, r14
add rbx, 7
add rbx, r9
jmp 0x14000221a
lea rdx, str.memmove
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000232d
sub rsi, rdi
add rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14005db00], rbx
add r13, 0x50
cmp r13, r12
jne 0x140001bfc
lea rcx, [rbp + 0x17]
call fcn.140004340
mov rdi, r15
mov ecx, 0x10
call fcn.14001af30
mov rbx, rax
mov qword [rbp - 9], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rsi, vtable.cl::clrt.0
mov qword [rax], rsi
mov qword [rax + 8], r15
mov rcx, rax
mov rax, qword [vtable.cl::clrt.0]
call rax
test eax, eax
je 0x1400024aa
mov rdi, rbx
mov qword [0x14005da78], rbx
jmp 0x1400024ba
lea rcx, [0x14004c6b0]
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, r15
lea rcx, str.ntoskrnl.exe_export__s_not_found_n
call fcn.140001350
jmp 0x14000247e
mov qword [0x14005dac8], r15
lea rcx, [0x14004c6b0]
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.ntoskrnl.exe_Offset_InterruptObject_not_found_n
jmp 0x140002479
mov qword [0x14005da98], r15
lea rcx, [0x14004c6b0]
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.acpi.sys_AcpiDriverObject_not_found_n
jmp 0x140002479
lea rcx, [0x14004c6b0]
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.usbccgp.sys_UsbccgpDriverObject_not_found_n
call fcn.140001350
mov ebx, 7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx edx, bx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp + 0x17]
call fcn.140004340
xor eax, eax
jmp 0x1400029f8
mov qword [rbx], rsi
mov edx, 0x10
mov rcx, rbx
call fcn.14001b1ac
mov dword [0x14005dae8], 1
test rdi, rdi
je 0x1400029f3
cmp qword [0x14005da70], 0
jne 0x14000252e
lea rcx, [0x14004c6b0]
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Run_as_Administrator_n
call fcn.140001350
mov ebx, 7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor eax, eax
jmp 0x1400029f8
cmp qword [0x14005dab8], 0
je 0x1400024a3
cmp qword [0x14005da98], 0
je 0x1400024a3
cmp qword [0x14005db00], 0
je 0x1400024a3
cmp qword [0x14005daf8], 0
je 0x1400024a3
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r9, [0x14005daa8]
xor r8d, r8d
lea rdx, str.NtGdiGetUFI
mov rcx, rdi
call fcn.140001670
mov qword [0x14005db20], rax
lea r9, [0x14005dab0]
mov r8, qword [0x14005db00]
lea rdx, str.NtGdiGetEmbUFI
mov rcx, rdi
call fcn.140001670
mov qword [0x14005db18], rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiGetEmbUFI
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005daa0], rax
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.NtGdiGetUFI
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14005dad0], rax
cmp qword [0x14005db20], 0
je 0x140002a31
mov rdx, qword [0x14005db18]
test rdx, rdx
je 0x140002a31
mov rax, qword [rdi]
mov r10, qword [rax + 0x10]
lea rax, [method.cl::clrt.virtual_16]
mov r9d, 8
lea r8, [0x14005db00]
cmp r10, rax
jne 0x140002648
mov rcx, qword [rdi + 8]
call fcn.140004f10
jmp 0x14000264e
mov rcx, rdi
call r10
mov dword [0x14005daec], 1
mov qword [rdi], rsi
mov edx, 0x10
mov rcx, rdi
call fcn.14001b1ac
mov qword [0x14005da78], r15
mov dword [0x14005daec], 1
mov rdx, qword [str.HalPrivateDispatchTable]
add rdx, 0xa0
mov ebx, 4
mov ecx, ebx
call fcn.140004450
mov rdi, rax
lea rdx, [rax + 0x1c]
mov r9d, ebx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d30
test eax, eax
mov eax, r15d
je 0x1400026b2
mov eax, dword [rbp - 0x11]
cdqe
add rdi, 0x20
add rdi, rax
mov esi, 0xc084
mov rdx, rdi
mov ecx, ebx
call fcn.140004450
cmp al, 0xe8
jne 0x1400026d7
shr rax, 0x28
cmp ax, si
je 0x1400026dc
inc rdi
jmp 0x1400026c0
lea rdx, [rdi + 1]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d30
test eax, eax
mov eax, r15d
je 0x1400026f8
mov eax, dword [rbp - 0x11]
cdqe
add rdi, 5
add rdi, rax
mov esi, 0xd8b
nop word [rax + rax]
mov r9, rbx
lea r8, [rbp - 0x11]
mov rdx, rdi
mov ecx, ebx
call fcn.140002d30
test eax, eax
jne 0x14000272d
mov eax, r15d
mov dword [rbp - 0x11], eax
jmp 0x140002730
mov eax, dword [rbp - 0x11]
cmp al, 0x4c
jne 0x14000273c
shr eax, 8
cmp ax, si
je 0x140002741
inc rdi
jmp 0x140002710
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d30
test eax, eax
mov eax, r15d
je 0x14000275d
mov eax, dword [rbp - 0x11]
cdqe
add rdi, 7
add rax, rdi
mov qword [0x14005da80], rax
add rax, 0xffffffffffffffe8
mov qword [0x14005db28], rax
mov rdx, qword [str.MmGetVirtualForPhysical]
add rdx, 0x10
mov ecx, ebx
call fcn.140004450
sub rax, 8
mov qword [0x14005db08], rax
mov rdx, qword [str.MmGetVirtualForPhysical]
add rdx, 0x22
mov ecx, ebx
call fcn.140004450
mov qword [0x14005da88], rax
mov rdi, qword [0x14005da98]
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d30
test eax, eax
mov eax, r15d
je 0x1400027d1
mov eax, dword [rbp - 0x11]
movsxd rdx, eax
add rdi, 7
add rdx, rdi
mov ecx, ebx
call fcn.140004450
mov qword [0x14005da98], rax
mov rdi, qword [0x14005dab8]
lea rdx, [rdi + 3]
mov r9, rbx
lea r8, [rbp - 0x11]
mov ecx, ebx
call fcn.140002d30
test eax, eax
mov eax, r15d
je 0x14000280c
mov eax, dword [rbp - 0x11]
movsxd rdx, eax
add rdx, 7
add rdx, rdi
mov ecx, ebx
call fcn.140004450
mov qword [0x14005dab8], rax
mov rdx, qword [0x14005daf8]
mov ecx, ebx
call fcn.140004450
mov qword [0x14005daf8], rax
mov r9, rbx
lea r8, [rbp - 0x11]
mov rdx, qword [0x14005dac8]
mov ecx, ebx
call fcn.140002d30
test eax, eax
mov eax, r15d
je 0x140002858
mov eax, dword [rbp - 0x11]
mov qword [0x14005dac8], rax
mov rdx, qword [str.PsInitialSystemProcess]
mov ecx, ebx
call fcn.140004450
lea rdx, [rax + 0x28]
mov ecx, ebx
call fcn.140004450
mov qword [0x14005dae0], rax
xor edx, edx
xor ecx, ecx
call fcn.140003280
mov qword [0x14005dad8], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rax
lea rcx, [rbp - 9]
call fcn.140004030
nop
mov rax, qword [rbp - 1]
mov r14, qword [rbp - 9]
sub rax, r14
test rax, 0xfffffffffffffff8
je 0x1400028c3
mov r15, qword [r14]
and r15, 0xfffffffffffff000
mov rcx, r15
call fcn.140002a70
test rax, 0xfffffffffffff000
je 0x1400028fc
cmp qword [0x14005dad8], rax
je 0x1400028f5
add r15, 0x1000
mov rcx, r15
call fcn.140002a70
test rax, 0xfffffffffffff000
jne 0x1400028d3
jmp 0x1400028fc
mov qword [0x14005db10], r15
mov rcx, qword [0x14005daf8]
add rcx, 8
call fcn.140004510
mov rsi, rax
nop
lea rdx, [rsi + 0x18]
mov ecx, ebx
call fcn.140004450
test rax, rax
je 0x14000295a
mov rdi, rax
lea rdx, [rax + 0x18]
mov ecx, ebx
call fcn.140004450
test rax, rax
jne 0x140002920
test rdi, rdi
je 0x14000295a
lea rcx, [rdi + 8]
call fcn.140004510
mov rdi, rax
lea rcx, [rax + 0x18]
call fcn.140004510
cmp rax, qword [0x14005dac0]
je 0x140002a25
lea rcx, [rsi + 0x10]
call fcn.140004510
mov rsi, rax
test rax, rax
jne 0x140002910
mov rdi, qword [0x14005da90]
lea rcx, [rdi + 8]
call fcn.140004510
mov rbx, rax
nop
lea rcx, [rbx + 0x18]
call fcn.140004510
test rax, rax
je 0x1400029a9
lea rcx, [rax + 8]
call fcn.140004510
lea rcx, [rax + 0x18]
call fcn.140004510
cmp rax, qword [0x14005daf0]
je 0x1400029ba
lea rcx, [rbx + 0x10]
call fcn.140004510
mov rbx, rax
test rax, rax
jne 0x140002980
test r14, r14
je 0x1400029f3
mov rdx, qword [rbp + 7]
sub rdx, r14
and rdx, 0xfffffffffffffff8
mov rax, r14
cmp rdx, 0x1000
jb 0x1400029eb
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a65
mov rcx, r14
call fcn.14001b1ac
mov eax, 1
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14001adf0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [0x14005da90], rdi
jmp 0x140002972
lea rcx, [0x14004c6b0]
call fcn.140001350
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Failed_to_locate_win32k_functions_n
jmp 0x140002506
call fcn.1400248b8
int3