Function at 0x140009918
Capabilities:
Check os version
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rcx
mov dword [rsp + 0x38], 0x320030
lea rax, [0x14000efb0]
mov dword [rsp + 0x50], 0x114
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rbp, rdx
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
jns 0x140009977
mov ebx, 5
xor edi, edi
jmp 0x14000997f
mov ebx, dword [rsp + 0x54]
mov edi, dword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov r14d, 1
test rax, rax
je 0x1400099bd
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, r14d
mov ecx, 0xe3
call qword [0x140010370]
test eax, eax
js 0x1400099bd
cmp byte [rsp + 0x30], 0
je 0x1400099bd
mov byte [0x140013068], r14b
cmp ebx, 6
ja 0x1400099c9
jne 0x1400099dd
cmp edi, 2
jb 0x1400099dd
mov dword [0x140013060], 0x200
mov dword [0x140013064], 0x40000000
lea rcx, [0x14000f070]
call sub.ntoskrnl.exe_DbgPrint
mov eax, r14d
mov rcx, rbp
xchg dword [0x140013128], eax
call fcn.140001430
mov r15d, 0x4d
test eax, eax
jns 0x140009a3d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000f090]
movzx r9d, al
mov edx, r14d
mov ecx, r15d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
call fcn.140001300
movzx ecx, al
xchg dword [0x140013128], ecx
mov rcx, rsi
call fcn.140005c64
test eax, eax
jns 0x140009a90
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000f0f0]
movzx r9d, al
mov edx, r14d
mov ecx, r15d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rdx, rbp
mov rcx, rsi
call fcn.140003978
test eax, eax
jns 0x140009ad8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000f150]
movzx r9d, al
mov edx, r14d
mov ecx, r15d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, rsi
call fcn.140007cc4
test eax, eax
jns 0x140009b1d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000f1c0]
movzx r9d, al
mov edx, r14d
mov ecx, r15d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, rsi
call fcn.140001d74
test eax, eax
jns 0x140009b62
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000f230]
movzx r9d, al
mov edx, r14d
mov ecx, r15d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rdx, rbp
mov rcx, rsi
call fcn.140009c28
test eax, eax
jns 0x140009baa
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
mov qword [rsp + 0x28], rdi
lea r8, [0x14000f290]
movzx r9d, al
mov edx, r14d
mov ecx, r15d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
call fcn.140001328
lea rax, [0x140009c00]
mov rcx, rbp
mov qword [rsi + 0x68], rax
mov qword [0x140013120], rsi
call fcn.140005050
call fcn.140009d00
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000a130
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret