Function at 0x1401259e0
Capabilities:
Acquire debug privileges

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x100
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x140239c78], ecx
jne 0x1401260db
movzx r10d, word [0x1402157be]
mov r8d, 0x7d
movzx r9d, word [str.ntdll.dll]
mov edx, 0x18
mov qword [r11 - 0x10], rbx
xor r10w, r8w
movzx ebx, word [0x1402157ba]
xor r9w, r8w
mov qword [r11 - 0x18], rsi
xor bx, r8w
movzx esi, word [0x1402157b6]
mov eax, 0x14
mov qword [r11 - 0x20], rdi
xor si, r8w
movzx edi, word [0x1402157b8]
mov ecx, 0x1a
mov qword [r11 - 0x28], r12
xor di, r8w
movzx r12d, word [str.NtLoadDriver]
mov qword [r11 - 0x30], r13
xor r12w, r8w
movzx r13d, word [0x1402157ae]
xor r13w, r8w
mov word [rbp + 0x6f], ax
movzx eax, word [0x1402157aa]
mov word [rsp + 0x26], r13w
xor ax, r8w
mov qword [r11 - 0x38], r14
mov r13d, 0x2e
movzx r14d, word [0x1402157b4]
mov word [rsp + 0x22], ax
xor r14w, r8w
movzx eax, word [0x1402157ac]
xor ax, r8w
mov qword [r11 - 0x40], r15
movzx r15d, word [0x1402157b2]
movzx r11d, word [0x1402157bc]
xor r15w, r8w
mov word [rbp + 0x67], dx
xor r11w, r8w
mov word [rsp + 0x28], r12w
mov r12d, 0x7d
xor r13w, r12w
mov word [rbp - 0x69], r8w
movzx r8d, word [0x1402157c2]
mov word [rbp - 0x67], r13w
xor r8w, 0x7d
mov r13d, 0x18
mov word [rbp + 0x77], dx
xor r13w, r12w
mov word [rbp + 0x7f], cx
movzx ecx, word [0x1402157c6]
mov word [rbp - 0x65], r13w
xor cx, 0x7d
mov r13d, 0x39
mov word [rsp + 0x20], dx
movzx edx, word [0x1402157c4]
xor r13w, r12w
mov word [rbp - 0x63], r13w
xor dx, 0x7d
movzx r13d, word [rbp + 0x67]
xor r13w, r12w
mov word [rsp + 0x24], ax
movzx eax, word [0x1402157c8]
mov word [rbp - 0x61], r13w
xor ax, 0x7d
mov r13d, 0x1f
xor r13w, r12w
mov word [rbp - 0x5f], r13w
mov r13d, 8
xor r13w, r12w
mov word [rbp - 0x5d], r13w
mov r13d, 0x1a
xor r13w, r12w
mov word [rbp - 0x5b], r13w
mov r13d, 0x2d
xor r13w, r12w
mov word [rbp - 0x59], r13w
mov r13d, 0xf
xor r13w, r12w
mov word [rbp - 0x57], r13w
mov r13d, 0x14
xor r13w, r12w
mov word [rbp - 0x55], r13w
mov r13d, 0xb
xor r13w, r12w
mov word [rbp - 0x53], r13w
movzx r13d, word [rbp + 0x6f]
xor r13w, r12w
mov word [rbp - 0x51], r13w
mov r13d, 0x11
xor r13w, r12w
mov word [rbp - 0x4f], r13w
movzx r13d, word [rbp + 0x77]
xor r13w, r12w
mov word [rbp - 0x4d], r13w
movzx r13d, word [rbp + 0x7f]
xor r13w, r12w
mov word [rbp - 0x4b], r13w
movzx r13d, word [rsp + 0x20]
xor r13w, r12w
mov word [rbp - 0x49], r13w
movzx r13d, r12w
xor r13w, r12w
mov word [rbp - 0x47], r13w
movzx r13d, word [rsp + 0x22]
xor r13w, r12w
mov word [rbp - 0x45], r13w
movzx r13d, word [rsp + 0x24]
xor r13w, r12w
mov word [rbp - 0x43], r13w
movzx r13d, word [rsp + 0x26]
xor r13w, r12w
movzx r12d, word [rsp + 0x28]
mov word [rbp - 0x41], r13w
mov r13d, 0x7d
xor ax, r13w
xor dx, r13w
xor cx, r13w
mov word [rbp - 0x27], ax
xor eax, eax
mov word [rbp - 0x2b], dx
xor r11w, r13w
mov word [rbp - 0x29], cx
xor r10w, r13w
mov word [rbp - 0x25], ax
xor r9w, r13w
mov word [rbp - 0x33], r11w
xor r8w, r13w
mov word [rbp - 0x31], r10w
xor r12w, r13w
mov word [rbp - 0x2f], r9w
xor r15w, r13w
mov word [rbp - 0x3f], r12w
xor r14w, r13w
mov word [rbp - 0x3d], r15w
xor si, r13w
mov word [rbp - 0x3b], r14w
xor di, r13w
mov word [rbp - 0x39], si
xor bx, r13w
mov word [rbp - 0x37], di
lea rdx, [rbp - 0x67]
mov word [rbp - 0x35], bx
lea rcx, [rbp - 9]
mov word [rbp - 0x2d], r8w
call fcn.1401256e0
lea rcx, [rbp - 9]
call fcn.1401260f0
lea rcx, [rbp - 9]
call fcn.14002c6f0
lea edx, [r13 - 0x39]
mov r9d, 0x36
mov r8d, 0x53
mov word [rbp - 0x69], r9w
mov word [rbp + 0x67], r8w
lea ecx, [rdx + 0x1b]
mov word [rbp + 0x6f], dx
lea eax, [rdx - 4]
mov word [rbp + 0x7f], cx
mov word [rsp + 0x28], ax
mov word [rbp + 0x77], dx
movzx r13d, word [0x140215792]
movzx r12d, word [0x140215794]
xor r13w, r9w
movzx eax, word [0x140215784]
xor r12w, r9w
movzx r15d, word [0x140215796]
xor ax, r9w
movzx r14d, word [0x140215798]
xor r15w, r9w
movzx esi, word [0x14021579a]
xor r14w, r9w
movzx edi, word [0x14021579c]
xor si, r9w
movzx ebx, word [0x14021579e]
xor di, r9w
movzx r11d, word [0x1402157a0]
xor bx, r9w
movzx r10d, word [0x1402157a2]
xor r11w, r9w
movzx edx, word [0x1402157a8]
xor r10w, r9w
mov word [rbp - 0x73], r13w
xor dx, 0x36
mov word [rsp + 0x20], ax
mov r13d, 0x65
movzx eax, word [0x140215786]
xor ax, r9w
mov word [rbp - 0x71], r12w
mov word [rbp - 0x7f], ax
mov r12d, 0x36
movzx eax, word [str.SeDebugPrivilege]
xor r13w, r12w
mov word [rbp - 0x67], r13w
xor ax, r9w
mov word [rbp - 0x7d], ax
mov r13d, 0x53
movzx eax, word [0x14021578a]
xor r13w, r12w
mov word [rbp - 0x65], r13w
xor ax, r9w
mov word [rbp - 0x7b], ax
mov r13d, 0x7a
movzx eax, word [0x14021578c]
xor r13w, r12w
mov word [rbp - 0x63], r13w
xor ax, r9w
mov word [rbp - 0x79], ax
mov r13d, 0x59
movzx eax, word [0x14021578e]
xor r13w, r12w
mov word [rbp - 0x61], r13w
xor ax, r9w
mov word [rbp - 0x77], ax
mov r13d, 0x57
movzx eax, word [0x140215790]
xor r13w, r12w
mov word [rbp - 0x5f], r13w
xor ax, r9w
movzx r9d, word [0x1402157a4]
mov r13d, 0x52
xor r13w, r12w
mov word [rsp + 0x26], cx
movzx ecx, word [0x1402157aa]
xor r9w, 0x36
mov word [rbp - 0x5d], r13w
xor cx, 0x36
mov r13d, 0x72
mov word [rsp + 0x24], r8w
xor r13w, r12w
mov word [rsp + 0x22], r8w
movzx r8d, word [0x1402157a6]
mov word [rbp - 0x5b], r13w
xor r8w, 0x36
mov r13d, 0x44
mov word [rbp - 0x75], ax
movzx eax, word [0x1402157ac]
xor r13w, r12w
mov word [rbp - 0x59], r13w
xor ax, 0x36
mov r13d, 0x5f
xor r13w, r12w
mov word [rbp - 0x57], r13w
mov r13d, 0x40
xor r13w, r12w
mov word [rbp - 0x55], r13w
movzx r13d, word [rbp + 0x67]
xor r13w, r12w
mov word [rbp - 0x53], r13w
movzx r13d, word [rbp + 0x6f]
xor r13w, r12w
mov word [rbp - 0x51], r13w
mov r13d, 0x66
xor r13w, r12w
mov word [rbp - 0x4f], r13w
movzx r13d, word [rbp + 0x77]
xor r13w, r12w
mov word [rbp - 0x4d], r13w
movzx r13d, word [rbp + 0x7f]
xor r13w, r12w
mov word [rbp - 0x4b], r13w
movzx r13d, word [rsp + 0x28]
xor r13w, r12w
mov word [rbp - 0x49], r13w
movzx r13d, word [rsp + 0x26]
xor r13w, r12w
mov word [rbp - 0x47], r13w
mov r13d, 0x5a
xor r13w, r12w
mov word [rbp - 0x45], r13w
movzx r13d, word [rsp + 0x24]
xor r13w, r12w
mov word [rbp - 0x43], r13w
mov r13d, 0x51
xor r13w, r12w
mov word [rbp - 0x41], r13w
movzx r13d, word [rsp + 0x22]
xor r13w, r12w
mov word [rbp - 0x3f], r13w
movzx r13d, r12w
xor r13w, r12w
mov word [rbp - 0x3d], r13w
movzx r13d, word [rsp + 0x20]
xor r13w, r12w
mov word [rbp - 0x3b], r13w
movzx r13d, word [rbp - 0x7f]
xor r13w, r12w
mov word [rbp - 0x39], r13w
movzx r13d, word [rbp - 0x7d]
xor r13w, r12w
mov word [rbp - 0x37], r13w
movzx r13d, word [rbp - 0x7b]
xor r13w, r12w
mov word [rbp - 0x35], r13w
movzx r13d, word [rbp - 0x79]
xor r13w, r12w
mov word [rbp - 0x33], r13w
movzx r13d, word [rbp - 0x77]
xor r13w, r12w
mov word [rbp - 0x31], r13w
movzx r13d, word [rbp - 0x75]
xor r13w, r12w
mov word [rbp - 0x2f], r13w
movzx r13d, word [rbp - 0x73]
xor r13w, r12w
movzx r12d, word [rbp - 0x71]
mov word [rbp - 0x2d], r13w
mov r13d, 0x36
xor r12w, r13w
xor r15w, r13w
xor r14w, r13w
mov word [rbp - 0x2b], r12w
xor si, r13w
mov word [rbp - 0x29], r15w
xor di, r13w
mov word [rbp - 0x27], r14w
xor bx, r13w
mov word [rbp - 0x25], si
xor r11w, r13w
mov word [rbp - 0x23], di
mov word [rbp - 0x21], bx
xor r10w, r13w
mov word [rbp - 0x1f], r11w
xor ax, r13w
mov word [rbp - 0x1d], r10w
xor dx, r13w
mov word [rbp - 0x13], ax
xor cx, r13w
mov word [rbp - 0x17], dx
xor eax, eax
mov word [rbp - 0x15], cx
xor r9w, r13w
mov word [rbp - 0x11], ax
xor r8w, r13w
mov word [rbp - 0x1b], r9w
lea rdx, [rbp - 0x67]
mov word [rbp - 0x19], r8w
lea rcx, [rbp - 9]
call fcn.1401256e0
lea rcx, [rbp - 9]
call fcn.1401260f0
lea rcx, [rbp - 9]
call fcn.14002c6f0
call fcn.140126200
mov r15, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xf8]
mov al, 1
add rsp, 0x100
pop rbp
ret