Function at 0x140007b54
Capabilities:
Get common file path
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2e0
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r13, rcx
mov qword [rsp + 0x40], rcx
mov r15d, dword [0x7ffe0260]
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140008f2f
mov r12d, 0xf
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0xc
movsd xmm0, qword [0x14000c780]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x14000c788]
mov dword [rsp + 0x28], eax
xor r14d, r14d
mov byte [rsp + 0x2c], r14b
lea rcx, [rsp + 0x20]
call fcn.1400099a8
mov rdi, rax
mov esi, 0x1000
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140007c2a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rsi
jb 0x140007c25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
test rdi, rdi
je 0x140008f2f
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0xe
movsd xmm0, qword [0x14000ccd0]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x14000ccd8]
mov dword [rsp + 0x28], eax
movzx eax, word [0x14000ccdc]
mov word [rsp + 0x2c], ax
mov byte [rsp + 0x2e], r14b
lea rcx, [rsp + 0x20]
call fcn.1400099a8
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140007cb8
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rsi
jb 0x140007cb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007cb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
test rbx, rbx
je 0x140008f2f
mov edx, 0x104
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r12
mov byte [rbp + 0x70], r14b
lea rax, [rbp + 0xc0]
or rbx, 0xffffffffffffffff
mov rsi, rbx
inc rsi
cmp byte [rax + rsi], r14b
jne 0x140007cf7
lea rcx, [rbp + 0x70]
cmp rsi, r12
ja 0x140007d26
mov qword [rbp + 0x80], rsi
mov r8, rsi
lea rdx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x70], r14b
jmp 0x140007d36
lea r9, [rbp + 0xc0]
mov rdx, rsi
call fcn.140006200
nop
lea rdx, str.win32kfull.sys
lea rcx, [rbp + 0x70]
call fcn.140005744
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rcx, qword [rbp + 0x70]
mov esi, 1
mov r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r12, rax
test rax, rax
jne 0x140007d77
mov bl, r14b
jmp 0x140008eea
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], r14b
lea rax, [rbp + 0xc0]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140007d92
lea rcx, [rbp + 0x50]
cmp rbx, 0xf
ja 0x140007dbf
mov qword [rbp + 0x60], rbx
mov r8, rbx
lea rdx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx + 0x50], r14b
jmp 0x140007dcf
lea r9, [rbp + 0xc0]
mov rdx, rbx
call fcn.140006200
nop
lea rdx, str._ntoskrnl.exe
lea rcx, [rbp + 0x50]
call fcn.140005744
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rcx, qword [rbp + 0x50]
mov r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
xor eax, eax
test r14, r14
je 0x140008e96
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x90], xmm1
mov qword [rbp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov ebx, 0x18
mov r9d, ebx
lea r8, [rbp + 0xa8]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, ebx
lea r8, [rbp + 0x90]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor eax, eax
mov dword [rbp + 0x3c], eax
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.KeAcquireSpinLockAtDpcLevel
lea edx, [rax + 0x1b]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x70], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140007efb
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ef6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007ef6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.KeReleaseSpinLockFromDpcLevel
lea edx, [rax + 0x1d]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x68], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140007f90
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.IofCompleteRequest
lea edx, [rax + 0x12]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x60], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008025
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008020
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008020
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.IoReleaseRemoveLockEx
lea edx, [rax + 0x15]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x58], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400080ba
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400080b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.IoDriverObjectType
lea edx, [rax + 0x12]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x50], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000814f
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000814a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000814a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.KeQueryActiveProcessorCount
lea edx, [rax + 0x1b]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x48], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400081e4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400081df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.KeInterlockedSetProcessorAffinityEx
lea edx, [rax + 0x23]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x40], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008279
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008274
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008274
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.PsLookupProcessByProcessId
lea edx, [rax + 0x1a]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x30], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000830e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008309
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008309
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.ObfDereferenceObject
lea edx, [rax + 0x14]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x28], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400083a3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000839e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000839e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.PsGetProcessSectionBaseAddress
lea edx, [rax + 0x1e]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp + 8], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008438
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008433
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008433
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 6
mov ecx, dword [0x14000c8b8]
mov dword [rsp + 0x20], ecx
movzx ecx, word [0x14000c8bc]
mov word [rsp + 0x24], cx
mov byte [rsp + 0x26], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp - 0x20], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400084cf
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 0xc
movsd xmm0, qword [str.MmCopyMemory]
movsd qword [rsp + 0x20], xmm0
mov ecx, dword [0x14000cff8]
mov dword [rsp + 0x28], ecx
mov byte [rsp + 0x2c], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp - 0x18], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008561
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000855c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000855c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 0xe
movsd xmm0, qword [str.MmMapIoSpaceEx]
movsd qword [rsp + 0x20], xmm0
mov ecx, dword [0x14000d008]
mov dword [rsp + 0x28], ecx
movzx ecx, word [0x14000d00c]
mov word [rsp + 0x2c], cx
mov byte [rsp + 0x2e], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp - 0x10], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400085ff
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400085fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 0xe
movsd xmm0, qword [str.MmUnmapIoSpace]
movsd qword [rsp + 0x20], xmm0
mov ecx, dword [0x14000d018]
mov dword [rsp + 0x28], ecx
movzx ecx, word [0x14000d01c]
mov word [rsp + 0x2c], cx
mov byte [rsp + 0x2e], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp - 8], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000869d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008698
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008698
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov ecx, 0xf
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
movsd xmm0, qword [str.PsGetProcessPeb]
movsd qword [rsp + 0x20], xmm0
mov ecx, dword [0x14000d028]
mov dword [rsp + 0x28], ecx
movzx ecx, word [0x14000d02c]
mov word [rsp + 0x2c], cx
mov cl, byte [0x14000d02e]
mov byte [rsp + 0x2e], cl
mov byte [rsp + 0x2f], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008742
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000873d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000873d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.MmIsAddressValid
lea edx, [rax + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp - 0x38], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400087d7
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400087d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400087d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.ObReferenceObjectByName
lea edx, [rax + 0x17]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp + 0x10], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000886c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008867
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008867
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], al
lea r9, str.RtlInitUnicodeString
lea edx, [rax + 0x14]
lea rcx, [rsp + 0x20]
call fcn.140006200
nop
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.140002fec
mov qword [rbp + 0x18], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008901
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400088fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400088fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 0xb
movsd xmm0, qword [str.KfRaiseIrql]
movsd qword [rsp + 0x20], xmm0
movzx ecx, word [0x14000d050]
mov word [rsp + 0x28], cx
mov cl, byte [0x14000d052]
mov byte [rsp + 0x2a], cl
xor ebx, ebx
mov byte [rsp + 0x2b], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp + 0x20], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400089a1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000899c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000899c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 0xb
movsd xmm0, qword [str.KeLowerIrql]
movsd qword [rsp + 0x20], xmm0
movzx ecx, word [0x14000d060]
mov word [rsp + 0x28], cx
mov cl, byte [0x14000d062]
mov byte [rsp + 0x2a], cl
mov byte [rsp + 0x2b], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp + 0x28], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008a3f
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008a3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140006e0c
mov qword [rsp + 0x38], 0xf
mov qword [rsp + 0x30], 0xa
movsd xmm0, qword [str.DbgPrintEx]
movsd qword [rsp + 0x20], xmm0
movzx ecx, word [0x14000d070]
mov word [rsp + 0x28], cx
mov byte [rsp + 0x2a], bl
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rax
call fcn.140002fec
mov qword [rbp + 0x30], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140008ad3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ace
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
cmp r15d, 0x42ee
je 0x140008b00
cmp r15d, 0x4563
je 0x140008b00
lea eax, [r15 - 0x47ba]
mov ecx, 0x280
mov edx, 0x388
cmp eax, esi
cmova ecx, edx
mov dword [rbp + 0x38], ecx
jmp 0x140008b07
mov dword [rbp + 0x38], 0x278
mov edx, dword [rbp + 0xb0]
lea r9, str.xxx____xxxxxxxxxxxx
lea r8, [0x14000d090]
mov rcx, r12
call fcn.140009c7c
test rax, rax
je 0x140008e96
movsxd rcx, dword [rax + 3]
sub rcx, r12
add rcx, qword [rsp + 0x48]
add rax, 7
add rax, rcx
mov qword [rsp + 0x70], rax
cmp r15d, 0x55f0
je 0x140008b85
cmp r15d, 0x57b1
je 0x140008b85
mov edx, dword [rbp + 0x98]
lea r9, str.xx________x____x____xxx____x
lea r8, [0x14000d0f8]
mov rcx, r14
call fcn.140009c7c
test rax, rax
je 0x140008e96
movsxd rdx, dword [rax + 0x17]
add rdx, 0x1b
jmp 0x140008bb2
mov edx, dword [rbp + 0x98]
lea r9, str.xxxxx____xxx____xxxxx
lea r8, [0x14000d0c0]
mov rcx, r14
call fcn.140009c7c
test rax, rax
je 0x140008e96
movsxd rdx, dword [rax + 0xc]
add rdx, 0x10
add rdx, rax
sub rdi, r14
add rdi, rdx
mov qword [rsp + 0x78], rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [r13]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008e96
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
cmp dword [rbx], 0x4550
jne 0x140008e96
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x140008e96
mov edi, dword [rbx + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140008e96
movzx ecx, word [rbx + 0x14]
mov r13d, dword [rcx + rbx + 0x24]
mov dword [rsp + 0x64], r13d
lea rdx, [rbp - 0x80]
mov ecx, edi
call fcn.140007964
mov r15, rax
test rax, rax
je 0x140008e96
lea rdx, [rbp - 0x78]
mov ecx, 0xd0
call fcn.140007964
mov r12, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140008e96
call fcn.140006e0c
mov r9d, edi
mov rdx, r15
mov rcx, rax
call fcn.140002ce8
call fcn.140006e0c
mov r14d, 0xd0
mov r9d, r14d
mov rdx, r12
mov rcx, rax
call fcn.140002ce8
call fcn.140006e0c
mov r9d, r14d
lea r8, [rsp + 0x70]
mov rdx, r12
mov rcx, rax
call fcn.140002a10
test eax, eax
je 0x140008e96
mov r8d, dword [rbx + 0x54]
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx r14d, word [rbx + 0x14]
add r14, 0x28
xor edx, edx
mov r12d, edx
cmp dx, word [rbx + 6]
jae 0x140008d19
add r14, rbx
mov r13, qword [rsp + 0x40]
mov ecx, dword [r14 - 4]
add rcx, rsi
mov r8d, dword [r14]
mov edx, dword [r14 + 4]
add rdx, qword [r13]
call sub.VCRUNTIME140.dll_memcpy
inc r12d
lea r14, [r14 + 0x28]
movzx eax, word [rbx + 6]
cmp r12d, eax
jl 0x140008ceb
mov r13d, dword [rsp + 0x64]
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x40], rcx
mov eax, r13d
sub r15, rax
sub edi, r13d
mov r14, rcx
mov r12d, edx
shr edi, 0xc
test edi, edi
je 0x140008d6e
sub r13, rcx
add r13, rsi
call fcn.140006e0c
lea r8, [r14 + r13]
mov r9d, 0x1000
mov rdx, r14
mov rcx, rax
call fcn.140002a10
test eax, eax
je 0x140008e2f
add r14, 0x1000
inc r12d
cmp r12d, edi
jb 0x140008d3d
mov ebx, dword [rbx + 0x28]
add rbx, r15
call fcn.140006e0c
mov rdi, rax
mov dword [rsp + 0x50], 0x25ff
xor r15d, r15d
mov word [rsp + 0x54], r15w
mov qword [rsp + 0x56], rbx
lea r12d, [r15 + 0xe]
mov r9d, r12d
lea r8, [rbp + 0x40]
mov rdx, qword [0x140018198]
mov rcx, rax
call fcn.1400029c0
mov r9d, r12d
lea r8, [rsp + 0x50]
mov rdx, qword [0x140018198]
mov rcx, rdi
call fcn.140002a10
mov rax, qword [0x140018190]
mov r14, qword [rsp + 0x48]
mov rcx, r14
call rax
mov bl, al
mov r9d, r12d
lea r8, [rbp + 0x40]
mov rdx, qword [0x140018198]
mov rcx, rdi
call fcn.140002a10
test bl, bl
je 0x140008e37
call fcn.140006e0c
xor r8d, r8d
mov rdx, qword [rbp - 0x80]
mov rcx, rax
call fcn.140002a60
call fcn.140006e0c
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, rax
call fcn.140002a60
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea ebx, [r15 + 1]
jmp 0x140008e9c
mov r14, qword [rsp + 0x48]
xor r15d, r15d
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.140006e0c
mov r8, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.140002c48
call fcn.140006e0c
mov rdx, qword [rbp - 0x80]
mov rcx, rax
call fcn.140002b08
call fcn.140006e0c
mov r8, qword [rbp - 0x78]
mov rdx, r14
mov rcx, rax
call fcn.140002c48
call fcn.140006e0c
mov rdx, qword [rbp - 0x78]
mov rcx, rax
call fcn.140002b08
jmp 0x140008e99
xor r15d, r15d
mov bl, r15b
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140008eda
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ed5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ed5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], r15b
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140008f2b
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008f26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009d90
mov al, bl
jmp 0x140008f31
xor al, al
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140009d70
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret