Function at 0x14001f600
Capabilities:
Print debug messages

Disassembly:
push rbx
xor eax, eax
sub rsp, 0x40
mov qword [rsp + 0x38], 0
test rcx, rcx
je 0x140020338
mov edx, 0x8cfcc776
call sym.LdrFunctionAddr
mov rbx, qword [0x14002d650]
test rax, rax
mov rcx, rax
je 0x14001f67a
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 1
call sym.SysExtract
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14001f65a
mov rdx, qword [rbx]
mov qword [rdx + 0x7f8], rax
jmp 0x14001f67a
lea r9, str.Failed_to_resolve_SysIndirectAddr
mov r8d, 0x20
lea rdx, str.SysInitialize
lea rcx, [0x14002abc0]
call sym.printf.constprop.0_12
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1f0]
test rcx, rcx
je 0x14001f6d7
xor r9d, r9d
lea r8, [rax + 0x804]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtOpenThread
mov r8d, 0x2c
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x1f0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x804]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1f8]
test rcx, rcx
je 0x14001f734
xor r9d, r9d
lea r8, [rax + 0x806]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtOpenThreadToken
mov r8d, 0x2d
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x1f8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x806]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x208]
test rcx, rcx
je 0x14001f791
xor r9d, r9d
lea r8, [rax + 0x80a]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtOpenProcess
mov r8d, 0x2e
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x208]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x80a]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x200]
test rcx, rcx
je 0x14001f7ee
xor r9d, r9d
lea r8, [rax + 0x808]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtTerminateProcess
mov r8d, 0x2f
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x200]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x808]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x210]
test rcx, rcx
je 0x14001f84b
xor r9d, r9d
lea r8, [rax + 0x80c]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtOpenProcessToken
mov r8d, 0x30
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x210]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x80c]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x218]
test rcx, rcx
je 0x14001f8a8
xor r9d, r9d
lea r8, [rax + 0x80e]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtDuplicateToken
mov r8d, 0x31
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x218]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x80e]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x220]
test rcx, rcx
je 0x14001f905
xor r9d, r9d
lea r8, [rax + 0x810]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtQueueApcThread
mov r8d, 0x32
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x220]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x810]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x228]
test rcx, rcx
je 0x14001f962
xor r9d, r9d
lea r8, [rax + 0x812]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtSuspendThread
mov r8d, 0x33
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x228]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x812]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x230]
test rcx, rcx
je 0x14001f9bf
xor r9d, r9d
lea r8, [rax + 0x814]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtResumeThread
mov r8d, 0x34
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x230]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x814]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x238]
test rcx, rcx
je 0x14001fa1c
xor r9d, r9d
lea r8, [rax + 0x816]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtCreateEvent
mov r8d, 0x35
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x238]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x816]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x240]
test rcx, rcx
je 0x14001fa79
xor r9d, r9d
lea r8, [rax + 0x818]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtCreateThreadEx
mov r8d, 0x36
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x240]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x818]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x248]
test rcx, rcx
je 0x14001fad6
xor r9d, r9d
lea r8, [rax + 0x81a]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtDuplicateObject
mov r8d, 0x37
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x248]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x81a]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x250]
test rcx, rcx
je 0x14001fb33
xor r9d, r9d
lea r8, [rax + 0x81c]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtGetContextThread
mov r8d, 0x38
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x250]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x81c]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x258]
test rcx, rcx
je 0x14001fb90
xor r9d, r9d
lea r8, [rax + 0x81e]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtSetContextThread
mov r8d, 0x39
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x258]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x81e]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x260]
test rcx, rcx
je 0x14001fbed
xor r9d, r9d
lea r8, [rax + 0x820]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtQueryInformationProcess
mov r8d, 0x3a
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x260]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x820]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x268]
test rcx, rcx
je 0x14001fc4a
xor r9d, r9d
lea r8, [rax + 0x822]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtQuerySystemInformation
mov r8d, 0x3b
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x268]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x822]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x270]
test rcx, rcx
je 0x14001fca7
xor r9d, r9d
lea r8, [rax + 0x824]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtWaitForSingleObject
mov r8d, 0x3c
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x270]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x824]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x280]
test rcx, rcx
je 0x14001fd04
xor r9d, r9d
lea r8, [rax + 0x826]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtAllocateVirtualMemory
mov r8d, 0x3d
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x280]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x826]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x288]
test rcx, rcx
je 0x14001fd61
xor r9d, r9d
lea r8, [rax + 0x828]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtWriteVirtualMemory
mov r8d, 0x3e
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x288]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x828]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x290]
test rcx, rcx
je 0x14001fdbe
xor r9d, r9d
lea r8, [rax + 0x82a]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtReadVirtualMemory
mov r8d, 0x3f
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x290]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x82a]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x298]
test rcx, rcx
je 0x14001fe1b
xor r9d, r9d
lea r8, [rax + 0x82c]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtFreeVirtualMemory
mov r8d, 0x40
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x298]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x82c]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2a0]
test rcx, rcx
je 0x14001fe78
xor r9d, r9d
lea r8, [rax + 0x82e]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtUnmapViewOfSection
mov r8d, 0x41
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2a0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x82e]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2a8]
test rcx, rcx
je 0x14001fed5
xor r9d, r9d
lea r8, [rax + 0x830]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtProtectVirtualMemory
mov r8d, 0x42
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2a8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x830]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2b0]
test rcx, rcx
je 0x14001ff32
xor r9d, r9d
lea r8, [rax + 0x832]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtTerminateThread
mov r8d, 0x43
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2b0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x832]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2c0]
test rcx, rcx
je 0x14001ff8f
xor r9d, r9d
lea r8, [rax + 0x834]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtAlertResumeThread
mov r8d, 0x44
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2c0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x834]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2c8]
test rcx, rcx
je 0x14001ffec
xor r9d, r9d
lea r8, [rax + 0x836]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtSignalAndWaitForSingleObject
mov r8d, 0x45
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2c8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x836]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2d0]
test rcx, rcx
je 0x140020049
xor r9d, r9d
lea r8, [rax + 0x838]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtQueryVirtualMemory
mov r8d, 0x46
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2d0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x838]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2d8]
test rcx, rcx
je 0x1400200a6
xor r9d, r9d
lea r8, [rax + 0x83a]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtQueryInformationToken
mov r8d, 0x47
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2d8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x83a]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2e0]
test rcx, rcx
je 0x140020103
xor r9d, r9d
lea r8, [rax + 0x83c]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtQueryInformationThread
mov r8d, 0x48
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2e0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x83c]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x2e8]
test rcx, rcx
je 0x140020160
xor r9d, r9d
lea r8, [rax + 0x83e]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtQueryObject
mov r8d, 0x49
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x2e8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x83e]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rbx, qword [0x14002d650]
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1c8]
test rcx, rcx
je 0x1400201c4
xor r9d, r9d
lea r8, [rax + 0x840]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtClose
mov r8d, 0x4a
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x1c8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x840]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1d0]
test rcx, rcx
je 0x140020221
xor r9d, r9d
lea r8, [rax + 0x842]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtSetEvent
mov r8d, 0x4b
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x1d0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x842]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1d8]
test rcx, rcx
je 0x14002027e
xor r9d, r9d
lea r8, [rax + 0x844]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtSetInformationThread
mov r8d, 0x4c
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x1d8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x844]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1e0]
test rcx, rcx
je 0x1400202db
xor r9d, r9d
lea r8, [rax + 0x846]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtSetInformationVirtualMemory
mov r8d, 0x4d
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x1e0]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x846]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
mov rax, qword [rbx]
mov rcx, qword [rax + 0x1e8]
test rcx, rcx
je 0x140020338
xor r9d, r9d
lea r8, [rax + 0x848]
mov edx, 1
call sym.SysExtract
mov rax, qword [rbx]
lea r9, str.NtGetNextThread
mov r8d, 0x4e
lea rcx, str._DEBUG::_s::_d__Extracted___s_:__Ssn:__x__Ptr:__p__n
mov rdx, qword [rax + 0x1e8]
mov qword [rsp + 0x28], rdx
movzx eax, word [rax + 0x848]
lea rdx, str.SysInitialize
mov dword [rsp + 0x20], eax
call sym.DbgPrint
add rsp, 0x40
pop rbx
ret