Function at 0x140002900
Capabilities:
Load ntoskrnl

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rsi, rdx
mov r13d, ecx
cmp ecx, 2
jge 0x140002971
lea rbx, str.unprotect
mov qword [rsp + 0x30], rbx
lea rdi, str.protect
mov qword [rsp + 0x28], rdi
lea rbp, [0x1400067e0]
mov qword [rsp + 0x20], rbp
lea r9, [0x1400066b0]
lea r8, str.list
mov rdx, qword [rdx]
lea rcx, str.Usage:_n___ws__CMD___ARGS__n_nCommands:_n___ws_n___ws__PID__n___ws__PID___PPPPL___TYPE__n___ws__PID___PPPPL___TYPE__n___ws__PID__n_nSigner_Types:_n__Authenticode__CodeGen__Antimalware__Lsa__Windows__WinTcb__WinSystem_n_n
call fcn.140001010
lea rcx, str.Install_the_driver:_n__sc.exe_create_RTCore64_type_kernel_start_auto_binPath_C:PATHTORTCore64.sys_DisplayName__Micro___Star_MSI_Afterburner__n__net_start_RTCore64_n_nUninstall_the_driver:_n__net_stop_RTCore64_n__sc.exe_delete_RTCore64_n_n
call fcn.140001010
jmp 0x140002f3e
mov ecx, 0x18
call fcn.1400036c0
mov rdi, rax
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0xc8], rbx
xor r15d, r15d
mov qword [rsp + 0xc8], r15
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [rax + 0x28]
call fcn.1400036c0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, str.ntoskrnl.exe
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rdi], rax
lea ecx, [r15 + 0x10]
call fcn.1400036c0
mov rbx, rax
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], r15
mov qword [rax + 8], r15
lea ecx, [r15 + 0x10]
call fcn.1400036c0
mov r14, rax
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov rcx, rdi
call fcn.140001e10
test eax, eax
jne 0x140002a3f
lea rcx, str.____Failed_to_determine_the_required_offsets._r_n
call fcn.140001010
lea eax, [r15 + 2]
jmp 0x140002f43
lea rdx, str.list
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002be0
mov qword [rsp + 0xc0], r15
lea rdx, [rsp + 0xc0]
mov rcx, r14
call fcn.140001810
test eax, eax
je 0x140002d23
lea rcx, [0x1400053a0]
call fcn.140001010
lea rcx, str.___PID____Level_______Signer___________EXE_sig._level_________DLL_sig._level________Kernel_addr._____n
call fcn.140001010
lea rcx, str._____________________________________________________________________________________________________n
call fcn.140001010
mov r13d, r15d
mov rsi, qword [rsp + 0xc0]
cmp dword [rsi], r15d
jbe 0x140002baa
lea rbx, str.Unknown
nop word [rax + rax]
mov edi, r13d
shl rdi, 4
add rdi, rsi
mov qword [rsp + 0x60], rdi
movzx eax, byte [rdi + 0x14]
test al, al
je 0x140002b9e
mov edx, eax
mov ecx, eax
sub ecx, 1
je 0x140002b03
cmp ecx, 1
je 0x140002afa
lea rcx, str.____Failed_to_retrieve_the_Protection_level_associated_to_the_value__d._r_n
call fcn.140001010
mov r12, rbx
jmp 0x140002b0a
lea r12, [0x140006cf8]
jmp 0x140002b0a
lea r12, [0x140006cf0]
movzx r15d, byte [rdi + 0x17]
movzx ebx, byte [rdi + 0x16]
movzx edi, byte [rdi + 0x15]
movzx ecx, r15b
call fcn.140003550
mov rbp, rax
mov r14d, ebx
movzx ecx, bl
call fcn.140003550
mov rbx, rax
movzx ecx, dil
call fcn.140003370
mov rdx, qword [rsp + 0x60]
movzx r9d, byte [rdx + 0x14]
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r8, r12
mov edx, dword [rdx + 0x10]
lea rcx, str.__6d____3ws___d_____11ws___d_____14ws__0x_02x_____14ws__0x_02x___0x_016llx_n
call fcn.140001010
mov r15, qword [rsp + 0xc8]
inc r15d
mov qword [rsp + 0xc8], r15
lea rbx, str.Unknown
mov rsi, qword [rsp + 0xc0]
inc r13d
cmp r13d, dword [rsi]
jb 0x140002ac0
lea rcx, [0x1400053a0]
call fcn.140001010
mov edx, r15d
lea rcx, str.___Enumerated__d_protected_processes._r_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x140002f43
lea rdx, [0x1400066b0]
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea rbx, str.unprotect
test eax, eax
je 0x140002ddf
mov rdx, rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002ddf
lea rbp, [0x1400067e0]
mov rdx, rbp
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea rdi, str.protect
test eax, eax
je 0x140002c49
mov rdx, rdi
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002f2e
lea eax, [r13 - 1]
cmp eax, 4
jge 0x140002c5e
lea rcx, str.____Missing_argument_s__for_command:__ws_r_n
jmp 0x140002f35
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov ebx, eax
test eax, eax
jne 0x140002c84
mov rdx, qword [rsi + 0x10]
lea rcx, str.____Failed_to_parse_argument_as_an_unsigned_integer:__ws_r_n
jmp 0x140002f39
mov rdx, rbp
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002cb2
mov r9, qword [rsi + 0x20]
mov r8, qword [rsi + 0x18]
mov edx, ebx
mov rcx, r14
call fcn.140001070
test eax, eax
je 0x140002d23
xor eax, eax
jmp 0x140002f43
mov rdx, rdi
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002f2e
mov rdi, qword [rsi + 0x20]
mov rbp, qword [rsi + 0x18]
lea r8, [rsp + 0xc0]
mov edx, ebx
mov rcx, r14
call fcn.140001740
test eax, eax
je 0x140002d23
mov edx, 3
mov rcx, qword [r14 + 8]
call fcn.140001d30
mov edx, eax
mov rsi, qword [rsp + 0xc0]
add rdx, rsi
lea r8, [rsp + 0xb0]
mov rcx, qword [r14]
call fcn.140002fc0
test eax, eax
jne 0x140002d2d
mov rdx, rsi
lea rcx, str.____Failed_to_retrieve_Protection_attribute_of_process___0x_016llx._r_n
call fcn.140001010
mov eax, 2
jmp 0x140002f43
movzx eax, byte [rsp + 0xb0]
test al, al
je 0x140002da8
movzx esi, al
shr sil, 4
and al, 7
movzx edx, al
mov ecx, edx
je 0x140002d7a
sub ecx, 1
je 0x140002d71
cmp ecx, 1
je 0x140002d68
lea rcx, str.____Failed_to_retrieve_the_Protection_level_associated_to_the_value__d._r_n
call fcn.140001010
lea rdi, str.Unknown
jmp 0x140002d81
lea rdi, [0x140006cf8]
jmp 0x140002d81
lea rdi, [0x140006cf0]
jmp 0x140002d81
lea rdi, str.None
movzx ecx, sil
call fcn.140003370
mov r9, rax
mov r8, rdi
mov edx, ebx
lea rcx, str.____The_process_with_PID__d_is_already_protected__current_protection_is__ws__ws._r_n
call fcn.140001010
mov eax, 2
jmp 0x140002f43
mov r9, rdi
mov r8, rbp
mov edx, ebx
mov rcx, r14
call fcn.140001070
test eax, eax
je 0x140002d23
mov r8, rdi
mov edx, ebx
mov rcx, r14
call fcn.140001420
test eax, eax
jne 0x140002eff
mov eax, 2
jmp 0x140002f43
lea eax, [r13 - 1]
cmp eax, 2
jl 0x140002c52
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov ebp, eax
test eax, eax
je 0x140002c74
lea rdx, [0x1400066b0]
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002f03
lea r8, [rsp + 0xc0]
mov edx, ebp
mov rcx, r14
call fcn.140001740
test eax, eax
je 0x140002d23
mov edx, 3
mov rcx, qword [r14 + 8]
call fcn.140001d30
mov edx, eax
mov rbx, qword [rsp + 0xc0]
add rdx, rbx
lea r8, [rsp + 0xb0]
mov rcx, qword [r14]
call fcn.140002fc0
test eax, eax
jne 0x140002e70
mov rdx, rbx
jmp 0x140002d17
movzx esi, byte [rsp + 0xb0]
test sil, sil
je 0x140002ef1
movzx eax, sil
and al, 7
shr sil, 4
movzx edx, al
mov ecx, edx
test al, al
je 0x140002ec1
sub ecx, 1
je 0x140002eb8
cmp ecx, 1
je 0x140002eaf
lea rcx, str.____Failed_to_retrieve_the_Protection_level_associated_to_the_value__d._r_n
call fcn.140001010
lea rdi, str.Unknown
jmp 0x140002ec8
lea rdi, [0x140006cf8]
jmp 0x140002ec8
lea rdi, [0x140006cf0]
jmp 0x140002ec8
lea rdi, str.None
movzx ebx, sil
movzx ecx, sil
call fcn.140003370
mov r9, rax
mov dword [rsp + 0x20], ebx
mov r8, rdi
mov edx, ebp
lea rcx, str.___The_process_with_PID__d_is_a__ws_with_the_Signer_type__ws___d_._r_n
call fcn.140001010
xor eax, eax
jmp 0x140002f43
mov edx, ebp
lea rcx, str.___The_process_with_PID__d_is_not_protected._r_n
call fcn.140001010
xor eax, eax
jmp 0x140002f43
mov rdx, rbx
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140002f2e
mov edx, ebp
mov rcx, r14
call fcn.140001580
mov ecx, 2
test eax, eax
cmove r15d, ecx
mov eax, r15d
jmp 0x140002f43
lea rcx, str.____Unknown_command:__ws_r_n
mov rdx, qword [rsi + 8]
call fcn.140001010
mov eax, 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret