Function at 0x140004490
Capabilities:
Attach user process memory
Complete processing asynchronous io request
Find process by pid
Inject apc
Map section object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x140010100]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xc0], rsp
mov rdi, rdx
mov qword [rsp + 0x90], rdx
mov esi, 0xc0000001
mov dword [rsp + 0x50], esi
xor r14d, r14d
mov qword [rsp + 0xa0], r14
cmp dword [0x14001acfc], r14d
jne 0x140004502
mov rax, qword [rdx + 0xb8]
mov qword [rsp + 0xa0], rax
mov ecx, dword [rax + 0x18]
jmp 0x140004505
mov ecx, dword [rdx + 0x10]
cmp ecx, 0x22e100
ja 0x1400051eb
je 0x1400051c1
add ecx, 0xffdd2000
cmp ecx, 0xfc
ja case.0x140005228.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x5d90]
mov ecx, dword [rdx + rax*4 + 0x5cc8]
add rcx, rdx
jmp rcx
mov rax, qword [rdi + 0x18]
movzx r9d, word [rax + 0x10]
mov qword [rsp + 0x20], rax
mov r8, qword [rax + 8]
xor edx, edx
mov ecx, dword [rax]
call fcn.140006eb0
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 0x12]
movzx r9d, word [rcx + 0x10]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 8]
xor edx, edx
mov ecx, dword [rcx]
call fcn.140007080
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140005228.2285861
mov qword [rsp + 0x70], r14
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov esi, ecx
call fcn.140007f50
mov qword [rsp + 0x78], rax
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], r14d
test rax, rax
jne 0x140004643
mov byte [rbx + 8], r14b
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x70]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004632
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1fffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x50], eax
jmp 0x140004647
mov byte [rbx + 8], 1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004657
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x78]
mov qword [rbx], rax
jmp case.0x140005228.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x58], r14
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x78], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xd0]
mov edx, 0x1fffff
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwOpenThread]
mov dword [rsp + 0x50], eax
jmp 0x1400046cc
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
jmp case.0x140005228.2285861
mov rbx, qword [rdi + 0x18]
lea r9, [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r8, qword [rbx + 8]
xor edx, edx
mov ecx, dword [rbx]
call fcn.140006a80
movzx eax, al
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
jmp case.0x140005228.2285861
cli
sti
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140007360
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
test ecx, ecx
je 0x140004787
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rdi + 0x18]
test eax, eax
jne 0x140004784
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov qword [rcx], r14
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
mov r8, rcx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.140006be0
jmp 0x140005c5d
movups xmm0, xmmword [0x14000dac0]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [0x14000dad0]
movups xmmword [rsp + 0x120], xmm1
movsd xmm0, qword [0x14000dae0]
movsd qword [rsp + 0x130], xmm0
mov eax, dword [0x14000dae8]
mov dword [rsp + 0x138], eax
movzx eax, word [0x14000daec]
mov word [rsp + 0x13c], ax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xd0], 0x30
mov qword [rsp + 0xd8], r14
mov dword [rsp + 0xe8], 0x40
lea rax, [rsp + 0x140]
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xd0]
mov edx, 0xf001f
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x140005228.2285861
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], 0x2000
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2000
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [r9 - 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140004902
mov rcx, qword [rbx]
sub rcx, qword [rsp + 0x70]
lea rdx, [rbx + 0x10]
add rcx, qword [rsp + 0x78]
mov r8, rdi
call fcn.14000d700
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp case.0x140005228.2285861
mov qword [rsp + 0x98], r14
mov ebx, r14d
mov dword [rsp + 0x50], ebx
mov rsi, qword [rdi + 0x18]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004994
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r14, rax
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400049af
test ebx, ebx
jne case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140005228.2285861
call fcn.1400029b0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
call fcn.1400029e0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002a70
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov dword [rsp + 0x50], r14d
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400049b7
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
call fcn.1400029d0
mov r14, rax
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140005228.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.1400025a0
xor ecx, ecx
mov rax, qword [rdi + 0x18]
mov qword [rax], rcx
mov word [rax + 8], cx
mov rcx, qword [rdi + 0x18]
movsd xmm0, qword [rsp + 0x58]
movsd qword [rcx], xmm0
movzx eax, word [rsp + 0x60]
mov word [rcx + 8], ax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.140001372
jmp 0x140004aa6
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call fcn.14000b8b0
mov ecx, dword [rbx + 8]
lea rax, [0x14000c5c0]
xor r9d, r9d
xor r8d, r8d
cmp ecx, 0xffffffff
jne 0x140004b2a
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x14000c560]
call fcn.140002610
call fcn.14000b780
jmp case.0x140005228.2285861
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rdx, [0x14000c560]
call fcn.140002900
jmp case.0x140005228.2285861
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140002e80]
call fcn.140002610
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov edx, dword [rax + 8]
movzx ecx, byte [rax]
call fcn.140004190
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov ebx, r14d
mov esi, 0x100
movzx ecx, bl
call fcn.140004330
inc ebx
cmp ebx, esi
jl 0x140004b91
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140003270
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400033e0
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
call fcn.140003420
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
cmp byte [rax], r14b
setne byte [0x1400100c8]
cmp byte [0x14001a7e8], r14b
je 0x140004c0b
cmp qword [0x1400101d8], r14
je 0x140004c0b
mov dword [rsp + 0x50], esi
jmp case.0x140005228.2285861
mov dl, 1
lea rcx, [0x14001a780]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov byte [0x14001a7f8], r14b
lea rcx, [0x14001a780]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call fcn.140007a50
cmp byte [0x14001a7e8], r14b
jne 0x140004c75
xor edx, edx
lea rcx, [0x140007ea0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
test eax, eax
sete byte [0x14001a7e8]
test eax, eax
jne 0x140004c6e
lea rcx, [0x140007eb0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
test eax, eax
sete byte [0x14001a2a5]
cmp byte [0x14001a7e8], r14b
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140005228.2285861
mov dl, 1
lea rcx, [0x14001a780]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x14001a7f8]
mov byte [rcx], al
movzx eax, byte [0x14001a7f8]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x14001a800]
call fcn.14000d700
mov byte [0x14001a7f8], r14b
lea rcx, [0x14001a780]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov dl, 1
lea rcx, [0x14001a780]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x14001a2b0]
mov byte [rcx], al
movzx eax, byte [0x14001a2b0]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x14001a2c0]
call fcn.14000d700
mov byte [0x14001a2b0], r14b
lea rcx, [0x14001a780]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 8]
mov ebx, dword [rax]
mov edx, 0x58
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov ecx, ebx
call fcn.140007360
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], r14b
lea rcx, [fcn.140003340]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
lea r9, [0x1400061f0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInitializeApc]
xor r9d, r9d
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400080a0
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140008000
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x140011448], r14
je 0x140004e23
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004e16
mov rax, qword [0x140011448]
mov rcx, qword [rsp + 0x68]
call qword [0x14000e3c0]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140005228.2285861
mov dword [rsp + 0x50], 0xc0000225
jmp case.0x140005228.2285861
mov dword [rsp + 0x50], 0xc0000002
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x140011440], r14
je 0x140004e23
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004e16
mov rax, qword [0x140011440]
jmp 0x140004df7
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x78], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140005228.2285861
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [r8 - 1]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140004ee7
cmp byte [0x14001a2a4], al
je 0x140004ee7
mov r8, qword [rsp + 0x78]
mov ecx, r14d
mov edx, r14d
mov dword [rsp + 0x70], ecx
cmp edx, dword [rsp + 0x68]
jge 0x140004ee7
movsxd rax, edx
mov byte [rax + r8], cl
lea ecx, [rdx + 1]
mov edx, ecx
jmp 0x140004ecf
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000577e
mov rax, qword [rdi + 0x18]
movsxd rcx, dword [rax]
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], r14
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
test rax, rax
jne 0x140004f43
mov dword [rsp + 0x50], esi
jmp case.0x140005228.2285861
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14000d600
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rdx, qword [rdi + 0x18]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rbx, qword [rdi + 0x18]
lea rdx, [0x14000daf0]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140014108], rax
test rax, rax
je case.0x140004542.2285616
mov rcx, qword [rbx]
call qword [0x14000e3c0]
mov qword [rbx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002b80
jmp 0x140005c5d
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400034c0
jmp 0x140005c5d
mov rcx, qword [rdi + 0x18]
call fcn.140002bb0
mov dword [rsp + 0x50], eax
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140002fc0
mov dword [rsp + 0x50], eax
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov dword [0x14001acc0], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax + 4]
cmp dword [rax], r14d
je 0x140005071
mov r9d, dword [rax + 0x14]
mov r8d, dword [rax + 0x10]
mov rdx, qword [rax + 8]
call fcn.140003240
jmp 0x140005c5d
call fcn.1400034a0
jmp 0x140005c5d
xor ecx, ecx
call fcn.140003490
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
call qword [0x14000e3c0]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov dword [rax], 0x1e849b
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov r8, qword [rdi + 0x18]
mov ecx, dword [r8]
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [r8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rbx, qword [rdi + 0x18]
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x28], r14
lea rax, [0x14001a7f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov qword [rsp + 0x28], r14
lea rax, [0x14001a2a8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140005228.2285861
mov dword [rsp + 0x50], r14d
mov rcx, qword [rdi + 0x18]
cmp dword [rcx], r14d
je 0x1400051b5
mov rax, qword [rcx + 4]
mov qword [0x14001a298], rax
mov eax, dword [rcx + 0xc]
mov dword [0x14001a290], eax
mov rax, qword [rcx + 0x10]
mov qword [0x14001a288], rax
call fcn.14000b430
mov dword [0x14001a280], eax
mov dword [0x14001a2a0], 1
jmp case.0x140005228.2285861
mov dword [0x14001a2a0], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rcx + 8]
mov rax, rdx
shr rdx, 0x20
mov ecx, dword [rcx]
wrmsr
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
cmp ecx, 0x22e23c
ja case.0x140005228.2285861
je 0x140005c24
add ecx, 0xffdd1efc
cmp ecx, 0x84
ja case.0x140005228.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x5f18]
mov ecx, dword [rdx + rax*4 + 0x5e90]
add rcx, rdx
jmp rcx
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
cmp qword [0x140010198], r14
jne 0x140005285
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
test rax, rax
je 0x14000527b
mov qword [0x140010198], rax
mov ecx, r14d
mov dword [rsp + 0x88], ecx
movsxd rdx, ecx
shl rdx, 4
cmp qword [rdx + rax + 8], 0
jne 0x140005277
cmp qword [rdx + rax], 0
jne 0x140005277
mov qword [0x1400101a0], rdx
jmp 0x14000527b
inc ecx
jmp 0x140005251
jmp 0x140005285
mov rax, qword [0x140010198]
mov qword [rbx], rax
mov rax, qword [0x1400101a0]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rbx, r14
mov qword [rsp + 0x80], rbx
mov rdi, qword [rdi + 0x18]
mov qword [rsp + 0x58], rdi
mov r15, rdi
mov dword [rsp + 0x50], esi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140005386
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400053e9
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000535d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400053e9
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400053bc
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x1400053e9
test rbx, rbx
je case.0x140005228.2285861
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140005498
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140005228.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 2]
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [r15 + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140005228.2285861
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 2]
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [r15 + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rcx]
mov rdx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rdi, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140005228.2285861
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x14000558e
xor r8d, r8d
mov dl, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x14000558e
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov qword [rdi], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
movzx ecx, byte [rax]
mov dword [0x14001acbc], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140003340
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x18]
lea r8, [rcx + 0xd8]
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 8]
mov edx, dword [rcx + 4]
mov ecx, dword [rcx]
call fcn.1400093d0
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
mov qword [rdx], r14
call fcn.14000afe0
jmp 0x140005c5d
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.14000a800
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.14000a880
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
call fcn.14000a7b0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
call fcn.14000a8c0
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.14000a910
jmp 0x140005c5d
call fcn.14000a9f0
jmp 0x140005c5d
call fcn.14000abe0
jmp 0x140005c5d
call fcn.14000ad60
jmp 0x140005c5d
call fcn.140008ed0
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x20]
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 0x18]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.140008490
jmp 0x140005c5d
call fcn.140008800
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
call fcn.140008c40
jmp 0x140005c5d
mov rcx, qword [rdi + 0x18]
call fcn.140008790
jmp 0x140005c5d
call fcn.140008970
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
call fcn.1400089b0
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
call fcn.1400089f0
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140005228.2285861
mov rcx, qword [rsp + 0x58]
call fcn.140007490
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004787
mov rcx, qword [rsp + 0x58]
call fcn.140007240
mov rcx, qword [rdi + 0x18]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rcx, qword [rdi + 0x18]
mov edx, dword [rcx]
call fcn.1400072d0
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [0x1400101a8]
test rcx, rcx
je 0x140005821
mov qword [rsp + 0x58], 0xfffffffffff85ee0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
lea edx, [r9 + 6]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x140005228.2285861
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x1400101a8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140005843
cmp rax, rcx
je 0x140005843
mov qword [0x1400101b0], rcx
cmp qword [0x140010190], r14
jne 0x140004740
mov ebx, dword [rbx]
test ebx, ebx
jne 0x14000588c
movabs rbx, 0xfffff78000000320
mov rbx, qword [rbx]
movabs rax, 0x29f16b11c6d1e109
imul rbx
sar rdx, 0xd
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0xc350
sub ebx, eax
add ebx, 0x3e8
mov r9d, ebx
lea r8, [0x14000db30]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.1400060b0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x110], 0x20100
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], r14
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 3
lea rax, [0x140006060]
mov qword [rsp + 0xe0], rax
lea rax, [fcn.140003340]
mov qword [rsp + 0xe8], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], 3
lea rax, [0x140006140]
mov qword [rsp + 0x100], rax
lea rax, [fcn.140003340]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x130], rax
lea rdx, [0x140010190]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
jne case.0x140005228.2285861
nop
cmp r14d, 0xa
jge case.0x140005228.2285861
inc ebx
mov r9d, ebx
lea r8, [0x14000db30]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.1400060b0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
inc r14d
lea rdx, [0x140010190]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
je 0x140005980
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x110]
xor edx, edx
lea rcx, [rdx - 1]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140005a41
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x118]
mov qword [rcx], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp case.0x140005228.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004aca
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140005ae3
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov r9d, dword [rbx + 0x18]
lea rcx, [rsp + 0x70]
mov edx, dword [rbx + 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffffffffffff
cmp qword [rbx + 8], 0
jne 0x140005aab
xor r8d, r8d
jmp 0x140005aaf
lea r8, [rbx + 0x10]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
movsxd rcx, eax
mov qword [rbx], rcx
mov eax, dword [rsp + 0x70]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140005aeb
mov dword [rsp + 0x50], 0xc0190060
jmp case.0x140005228.2285861
mov rax, qword [rdi + 0x18]
mov r9, qword [rax]
cmp dword [0x14001a2a0], r14d
jne 0x140005b1a
mov dword [rsp + 0x50], 0xc0000184
jmp case.0x140005228.2285861
shl r9, 0xc
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], 1
mov r8, r14
mov rdx, 0xffffffffffffffff
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmAllocatePagesForMdlEx]
mov r13, rax
test rax, rax
je 0x140005c1a
mov r15d, dword [rax + 0x28]
shr r15, 0xc
lea rdi, [rax + 0x30]
test rdi, rdi
je 0x140005c08
mov edx, 0x10
lea ecx, [rdx - 0xf]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140005c08
mov edx, 0x100
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx], rax
test rax, rax
je 0x140005bfd
mov dword [rbx + 8], r14d
mov esi, r14d
mov ecx, r14d
test r15, r15
je 0x140005be1
mov rdx, qword [rdi]
shl rdx, 0xc
movsxd rcx, ecx
mov rax, qword [rbx]
mov qword [rax + rcx*8], rdx
inc dword [rbx + 8]
mov ecx, dword [rbx + 8]
cmp ecx, 0x20
jne 0x140005bd0
mov edx, ecx
mov rcx, qword [rbx]
call fcn.14000b1f0
mov dword [rbx + 8], r14d
mov ecx, r14d
inc esi
add rdi, 8
movsxd rax, esi
cmp rax, r15
jb 0x140005ba3
mov rax, qword [rbx]
test ecx, ecx
je 0x140005bf2
mov edx, ecx
mov rcx, rax
call fcn.14000b1f0
mov rax, qword [rbx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x140005228.2285861
mov dword [rsp + 0x50], 0xc00000a0
jmp case.0x140005228.2285861
mov rax, qword [rdx + 0xb8]
cmp dword [rax + 0x10], 4
jae 0x140005c3f
mov dword [rsp + 0x50], 0xc0000023
mov qword [rdx + 0x38], r14
jmp case.0x140005228.2285861
mov rax, qword [rdx + 0x18]
test rax, rax
jne 0x140005c56
mov dword [rsp + 0x50], 0xc000000d
mov qword [rdx + 0x38], r14
jmp case.0x140005228.2285861
mov ecx, dword [rax]
call fcn.140001cf0
mov dword [rsp + 0x50], eax
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0x30], ebx
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x140005c96
test ebx, ebx
jne 0x140005c87
mov r14d, dword [rax + 8]
jmp 0x140005c8a
xor r14d, r14d
mov qword [rcx + 0x38], r14
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14000d510
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret