Function at 0x14005e360
Capabilities:
Load ntoskrnl

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
and rsp, 0xffffffffffffffe0
mov r15, r8
mov r14, rdx
mov rax, qword [0x1400c1548]
xor rax, rbp
mov qword [rsp + 0x58], rax
cmp qword [rdx + 0x18], 0x10
jb 0x14005e396
mov r14, qword [r14]
vxorps xmm0, xmm0, xmm0
vmovaps ymmword [rsp + 0x20], ymm0
mov rcx, r14
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14005e62c
mov rbx, rax
cmp rax, 0xf
ja 0x14005e3e4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
add rbx, rsp
add rbx, 0x20
jmp 0x14005e444
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov esi, 0x16
cmovae rsi, rax
cmp rsi, 0xfff
jb 0x14005e418
lea rcx, [rsi + 0x28]
call fcn.140066fac
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005e424
lea rcx, [rsi + 1]
call fcn.140066fac
mov rdi, rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov byte [rbx], 0
lea r14, [rsp + 0x20]
mov rdx, r14
call fcn.14005c690
mov r12, rax
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x14005e498
mov rcx, qword [rsp + 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005e493
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14005e631
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.140066ff0
test r12, r12
je 0x14005e530
cmp qword [r15 + 0x18], 0x10
jb 0x14005e4ab
mov r15, qword [r15]
vxorps xmm0, xmm0, xmm0
vmovaps ymmword [rsp + 0x20], ymm0
mov rcx, r15
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14005e62c
mov rbx, rax
cmp rax, 0xf
ja 0x14005e4fc
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
add rbx, rsp
add rbx, 0x20
jmp 0x14005e587
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov esi, 0x16
cmovae rsi, rax
cmp rsi, 0xfff
jb 0x14005e55b
lea rcx, [rsi + 0x28]
call fcn.140066fac
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005e567
lea rdx, str.dependenciescommunicationedk.cpp
lea r9, str.failed_to_get_ntoskrnl._n
mov cl, 1
mov r8d, 0x59
call fcn.14005e040
cmp qword [r15 + 0x18], 0x10
jae 0x14005e4a8
jmp 0x14005e4ab
lea rcx, [rsi + 1]
call fcn.140066fac
mov rdi, rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov rcx, rdi
mov rdx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov byte [rbx], 0
lea rcx, str.ntoskrnl.exe
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14005e5ce
mov rdi, rax
cmp qword [rsp + 0x38], 0x10
jb 0x14005e5ac
mov r14, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005e5ce
sub r12, rdi
add r12, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14005e5d1
xor r12d, r12d
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x14005e60e
mov rcx, qword [rsp + 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14005e609
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14005e631
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.140066ff0
mov rcx, qword [rsp + 0x58]
xor rcx, rbp
call fcn.140067310
mov rax, r12
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.1400047b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3