Function at 0x140126200
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov edx, 0x45
mov dword [rbp + 0x6f], edx
mov word [rbp - 0x49], dx
lea edi, [rdx - 0x24]
mov eax, 0x29
movzx ebx, ax
movzx esi, ax
movzx r14d, ax
movzx r15d, dx
movzx eax, word [0x1402157d4]
xor ax, dx
mov word [rbp + 0x67], ax
movzx r12d, word [0x1402157d6]
xor r12w, dx
movzx r11d, word [str.RtlDosPathNameToNtPathName_U]
xor r11w, dx
movzx r10d, word [0x1402157da]
xor r10w, dx
movzx r9d, word [0x1402157dc]
xor r9w, dx
movzx r8d, word [0x1402157de]
xor r8w, dx
movzx edx, word [0x1402157e0]
xor dx, r15w
movzx ecx, word [0x1402157e2]
xor cx, r15w
movzx eax, word [0x1402157e4]
xor ax, r15w
mov r13d, 0x2b
xor r13w, word [rbp + 0x6f]
mov word [rbp - 0x47], r13w
mov r13d, 0x31
xor r13w, word [rbp + 0x6f]
mov word [rbp - 0x45], r13w
mov r13d, edi
xor r13w, word [rbp + 0x6f]
mov word [rbp - 0x43], r13w
mov r13d, 0x29
xor r13w, word [rbp + 0x6f]
mov word [rbp - 0x41], r13w
xor bx, r15w
mov word [rbp - 0x3f], bx
mov r13d, 0x6b
xor r13w, r15w
mov word [rbp - 0x3d], r13w
mov r13d, 0x45
xor di, r13w
mov word [rbp - 0x3b], di
xor si, r13w
mov word [rbp - 0x39], si
xor r14w, r13w
mov word [rbp - 0x37], r14w
xor r15w, r13w
mov word [rbp - 0x35], r15w
movzx ebx, word [rbp + 0x67]
xor bx, r13w
mov word [rbp - 0x33], bx
xor r12w, r13w
mov word [rbp - 0x31], r12w
xor r11w, r13w
mov word [rbp - 0x2f], r11w
xor r10w, r13w
mov word [rbp - 0x2d], r10w
xor r9w, r13w
mov word [rbp - 0x2b], r9w
xor r8w, r13w
mov word [rbp - 0x29], r8w
xor dx, r13w
mov word [rbp - 0x27], dx
xor cx, r13w
mov word [rbp - 0x25], cx
xor ax, r13w
mov word [rbp - 0x23], ax
xor eax, eax
mov word [rbp - 0x21], ax
lea rcx, [rbp - 0x47]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
call fcn.140125830
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
lea r8d, [r13 - 0x39]
lea rdx, str.NtLoadDriver
lea rcx, [rbp - 0x69]
call fcn.1400297e0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x67], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140126412
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x19]
call fcn.14002a3b0
mov qword [rbp + 7], r14
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.140126730
nop
lea rcx, [rbp - 0x19]
call fcn.140029420
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x69]
call fcn.140029420
call fcn.140125830
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x69]
call fcn.1400297e0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x67], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1401264b0
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x19]
call fcn.14002a3b0
mov qword [rbp + 7], r14
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.140126730
nop
lea rcx, [rbp - 0x19]
call fcn.140029420
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x69]
call fcn.140029420
call fcn.140125830
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
mov r8d, 0x1c
lea rdx, str.RtlDosPathNameToNtPathName_U
lea rcx, [rbp - 0x69]
call fcn.1400297e0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x67], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14012654e
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x19]
call fcn.14002a3b0
mov qword [rbp + 7], r14
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.140126730
nop
lea rcx, [rbp - 0x19]
call fcn.140029420
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x69]
call fcn.140029420
call fcn.140125830
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
mov r8d, 0x14
lea rdx, [0x140215820]
lea rcx, [rbp - 0x69]
call fcn.1400297e0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x67], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1401265ec
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x19]
call fcn.14002a3b0
mov qword [rbp + 7], r14
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.140126730
nop
lea rcx, [rbp - 0x19]
call fcn.140029420
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x69]
call fcn.140029420
call fcn.140125830
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x59], xmm1
mov r8d, 0x14
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x69]
call fcn.1400297e0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x67], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0xf
cmova rdx, qword [rbp - 0x69]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14012668a
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x19]
call fcn.14002a3b0
mov qword [rbp + 7], rdi
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.140126730
nop
lea rcx, [rbp - 0x19]
call fcn.140029420
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x69]
call fcn.140029420
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret