Function at 0x140002150
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rdx, [0x1400038e0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400050f8], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003900]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005100], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003930]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005108], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003960]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005110], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003990]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005118], rax
test rax, rax
je 0x14000256c
lea rdx, [0x1400039b0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005120], rax
test rax, rax
je 0x14000256c
lea rdx, [0x1400039e0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005128], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003a10]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005130], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003a40]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005138], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003a70]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005140], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003a90]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005148], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003ad0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005150], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003af0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005158], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003b10]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005160], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003b40]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005168], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003b60]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005170], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003ba0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005178], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003be0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005180], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003c20]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005188], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003c60]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005190], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003cb0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140005198], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003ce0]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400051a0], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003d00]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400051a8], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003d20]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400051b0], rax
test rax, rax
je 0x14000256c
lea rdx, [0x140003d40]
lea rcx, [rbp - 0x10]
call fcn.140002578
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400051b8], rax
neg rax
sbb eax, eax
not eax
and eax, 0xc0000001
jmp 0x140002571
mov eax, 0xc0000001
add rsp, 0x30
pop rbp
ret