Function at 0x140003a6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rbx, rcx
mov dword [rbp + 7], 0x44005c
xor esi, esi
mov dword [rbp + 0xb], 0x690072
lea rcx, [rbp - 0x39]
mov word [rbp + 0x27], si
lea rdx, [rbp + 7]
mov dword [rbp + 0xf], 0x650076
mov dword [rbp + 0x13], 0x5c0072
mov dword [rbp + 0x17], 0x6f004d
mov dword [rbp + 0x1b], 0x430075
mov dword [rbp + 0x1f], 0x61006c
mov dword [rbp + 0x23], 0x730073
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp + 0x6f]
mov qword [rbp + 0x6f], rsi
mov qword [rsp + 0x38], rax
lea edx, [rsi + 0x40]
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov byte [rsp + 0x28], sil
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
test eax, eax
jns 0x140003b1e
lfence
jmp 0x140003c76
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x44005c
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x15], 0x690072
mov dword [rbp - 0x11], 0x650076
mov dword [rbp - 0xd], 0x5c0072
mov dword [rbp - 9], 0x6f004d
mov dword [rbp - 5], 0x480075
mov dword [rbp - 1], 0x440049
mov word [rbp + 3], si
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp + 0x77]
mov qword [rbp + 0x77], rsi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x28], sil
lea edx, [r9 + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
mov edi, eax
test eax, eax
jns 0x140003bba
lfence
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140003bb3
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
jmp 0x140003c76
mov rax, qword [rbp + 0x77]
mov r10, qword [rbp + 0x6f]
mov rcx, qword [rax + 8]
jmp 0x140003c37
cmp qword [rbx + 8], rsi
jne 0x140003c3c
mov rdx, qword [r10 + 8]
test rdx, rdx
je 0x140003c33
mov rax, rsi
test rax, rax
jne 0x140003c33
mov rax, rsi
cmp qword [rdx + 0x10], rsi
jne 0x140003bf4
cmp qword [rbx], rsi
jne 0x140003bf4
mov rax, qword [rbx + 8]
mov qword [rbx], rdx
mov r11, qword [rcx + 0x40]
mov r9, rsi
mov r8, qword [rcx + 0x138]
sub r8, r11
shr r8, 2
test r8, r8
je 0x140003c2a
cmp qword [r11 + r9*8], rdx
jne 0x140003c1e
mov rax, qword [r11 + r9*8 + 8]
cmp rax, r10
ja 0x140003c58
inc r9
cmp r9, r8
jb 0x140003c0e
mov rax, qword [rbx + 8]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x140003bda
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x140003bc8
cmp qword [rbx], rsi
jne 0x140003c61
mov rax, qword [r10 + 8]
test rax, rax
je 0x140003c61
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140003c5e
mov rax, rcx
jmp 0x140003c4a
mov qword [rbx + 8], rax
jmp 0x140003c2a
mov qword [rbx], rax
mov rcx, r10
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret