Function at 0x140001e10
Capabilities:
Resolve ntoskrnl gadgets

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, rcx
lea r14, [rcx + 8]
mov rax, qword [r14]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x140001e5a
cmp dword [rcx + 0x1c], 0
jge 0x140001e4e
mov rcx, qword [rcx + 0x10]
jmp 0x140001e54
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140001e42
cmp byte [rdx + 0x19], 0
jne 0x140001e6f
cmp dword [rdx + 0x1c], 0
jg 0x140001e6f
cmp rdx, rax
jne 0x140001f49
lea rdx, [0x140006200]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140001e9f
lea rdx, str.PsInitialSystemProcess
lea rcx, str.____The_procedure__ws_was_not_found._r_n
call fcn.140001010
jmp 0x140002251
sub ebx, dword [rsi]
mov rdi, qword [r14]
mov rax, qword [rdi + 8]
mov qword [rbp - 0x20], rax
xor r15d, r15d
mov dword [rbp - 0x18], r15d
mov rcx, rdi
cmp byte [rax + 0x19], r15b
jne 0x140001ee7
nop dword [rax]
mov qword [rbp - 0x20], rax
cmp dword [rax + 0x1c], r15d
jge 0x140001ed4
mov dword [rbp - 0x18], r15d
mov rax, qword [rax + 0x10]
jmp 0x140001ee1
mov dword [rbp - 0x18], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r15b
je 0x140001ec0
cmp byte [rcx + 0x19], r15b
jne 0x140001ef3
cmp dword [rcx + 0x1c], r15d
jle 0x140001f49
movabs rax, 0x666666666666666
cmp qword [r14 + 8], rax
je 0x14000226d
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r15
mov ecx, 0x28
call fcn.1400036c0
nop
mov dword [rax + 0x1c], r15d
mov dword [rax + 0x20], ebx
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], 0
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp - 0x30], xmm0
mov r8, rax
lea rdx, [rbp - 0x30]
mov rcx, r14
call fcn.140002680
mov rax, qword [r14]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x140001f78
nop dword [rax]
cmp dword [rcx + 0x1c], 2
jge 0x140001f6c
mov rcx, qword [rcx + 0x10]
jmp 0x140001f72
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140001f60
cmp byte [rdx + 0x19], 0
jne 0x140001f8d
cmp dword [rdx + 0x1c], 2
jg 0x140001f8d
cmp rdx, rax
jne 0x140002010
lea rdx, [0x140006318]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001fba
lea rdx, str.PsGetProcessId
lea rcx, str.____The_procedure__ws_was_not_found_r_n
call fcn.140001010
jmp 0x140002251
lea rbx, [rax + 3]
test rbx, rbx
je 0x140001fe3
movzx ebx, word [rbx]
mov eax, 0xfff
cmp bx, ax
jbe 0x140001ff5
mov edx, ebx
lea rcx, str.____The_offset_value_of_UniqueProcessId_is_greater_than_the_maximum_allowed__0x_04x_._r_n
call fcn.140001010
jmp 0x140002251
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov dword [rbp - 0x40], 2
mov word [rbp - 0x3c], bx
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x30]
mov rcx, r14
call fcn.140002590
mov rcx, rsi
call fcn.140002280
test eax, eax
je 0x140002251
mov rax, qword [r14]
mov rcx, qword [rax + 8]
mov r8, rax
movzx r9d, byte [rcx + 0x19]
test r9b, r9b
jne 0x14000204f
mov rdx, rcx
cmp dword [rdx + 0x1c], 1
jge 0x140002043
mov rdx, qword [rdx + 0x10]
jmp 0x140002049
mov r8, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x140002037
cmp byte [r8 + 0x19], 0
jne 0x140002062
cmp dword [r8 + 0x1c], 1
jg 0x140002062
cmp r8, rax
jne 0x1400020da
mov rdx, rax
test r9b, r9b
jne 0x140002088
nop word [rax + rax]
cmp dword [rcx + 0x1c], 2
jge 0x14000207c
mov rcx, qword [rcx + 0x10]
jmp 0x140002082
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140002070
cmp byte [rdx + 0x19], 0
jne 0x140002245
cmp dword [rdx + 0x1c], 2
jg 0x140002245
cmp rdx, rax
je 0x140002245
mov dword [rbp - 0x40], 2
mov dword [rbp - 0x30], 1
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.140002490
movzx ecx, word [rax]
add cx, 8
mov word [rbp - 0x2c], cx
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.140002590
mov rax, qword [r14]
mov rcx, qword [rax + 8]
mov r8, rax
movzx r9d, byte [rcx + 0x19]
test r9b, r9b
jne 0x140002109
mov rdx, rcx
cmp dword [rdx + 0x1c], 4
jge 0x1400020fd
mov rdx, qword [rdx + 0x10]
jmp 0x140002103
mov r8, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1400020f1
cmp byte [r8 + 0x19], 0
jne 0x14000211c
cmp dword [r8 + 0x1c], 4
jg 0x14000211c
cmp r8, rax
jne 0x14000218e
mov rdx, rax
test r9b, r9b
jne 0x14000213c
cmp dword [rcx + 0x1c], 3
jge 0x140002130
mov rcx, qword [rcx + 0x10]
jmp 0x140002136
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x140002124
cmp byte [rdx + 0x19], 0
jne 0x14000223c
cmp dword [rdx + 0x1c], 3
jg 0x14000223c
cmp rdx, rax
je 0x14000223c
mov dword [rbp - 0x40], 3
mov dword [rbp - 0x30], 4
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.140002490
movzx ecx, word [rax]
sub cx, 2
mov word [rbp - 0x2c], cx
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.140002590
mov rax, qword [r14]
mov rcx, qword [rax + 8]
mov r8, rax
movzx r9d, byte [rcx + 0x19]
test r9b, r9b
jne 0x1400021bd
mov rdx, rcx
cmp dword [rdx + 0x1c], 5
jge 0x1400021b1
mov rdx, qword [rdx + 0x10]
jmp 0x1400021b7
mov r8, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1400021a5
cmp byte [r8 + 0x19], 0
jne 0x1400021d0
cmp dword [r8 + 0x1c], 5
jg 0x1400021d0
cmp r8, rax
jne 0x140002235
mov rdx, rax
test r9b, r9b
jne 0x1400021f0
cmp dword [rcx + 0x1c], 3
jge 0x1400021e4
mov rcx, qword [rcx + 0x10]
jmp 0x1400021ea
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1400021d8
cmp byte [rdx + 0x19], 0
jne 0x14000223c
cmp dword [rdx + 0x1c], 3
jg 0x14000223c
cmp rdx, rax
je 0x14000223c
mov dword [rbp - 0x40], 3
mov dword [rbp - 0x30], 5
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.140002490
movzx ecx, word [rax]
dec cx
mov word [rbp - 0x2c], cx
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.140002590
mov eax, 1
jmp 0x140002253
lea rcx, str.____The_offset_Protection_is_not_defined._r_n
jmp 0x14000224c
lea rcx, str.____The_offset_UniqueProcessId_is_not_defined._r_n
call fcn.140001010
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001d10
int3