Function at 0x140001960
Capabilities:
Create device object
Create thread
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov r15, rcx
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov eax, dword [rsp + 0xcc]
mov dword [0x14000df28], eax
xor r13d, r13d
mov word [rsp + 0x220], r13w
lea rdx, [rsp + 0x220]
lea rcx, [0x1400035a0]
call qword [sym.imp.ntoskrnl.exe_KeGenericCallDpc]
mov ecx, 0xffff
call qword [sym.imp.ntoskrnl.exe_KeQueryActiveProcessorCountEx]
movsx ecx, word [rsp + 0x220]
cmp ecx, eax
je 0x1400019da
mov eax, 0xc0000001
jmp 0x140001ed1
mov r9d, 0x59
lea r8, [0x140009660]
lea rdx, [0x140009670]
lea ecx, [r9 - 0x56]
call fcn.140003c60
call fcn.140008d50
test al, al
je 0x140001ecc
mov r9d, 0x5e
lea r8, [0x140009660]
lea rdx, [0x140009690]
lea ecx, [r9 - 0x5b]
call fcn.140003c60
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x228], r13
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x48]
lea rcx, [0x140009bf0]
call fcn.140008880
test al, al
je 0x140001ecc
mov r14, qword [rsp + 0x228]
movsxd rcx, dword [r14 + 0x3c]
movzx esi, word [rcx + r14 + 6]
movzx eax, word [rcx + r14 + 0x14]
lea rbx, [rcx + r14]
add rax, 0x18
add rbx, rax
lea rdx, [0x140009be0]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov edi, r13d
test esi, esi
je 0x140001ecc
mov r12d, 8
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
cmp word [rsp + 0x58], r12w
jbe 0x140001abc
mov word [rsp + 0x58], r12w
xor r8d, r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x140001ae5
add rbx, 0x28
inc edi
cmp edi, esi
jb 0x140001aa0
jmp 0x140001ecc
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 0xc]
add rcx, r14
lea r9, [0x14000a320]
lea r8, [0x14000a310]
call fcn.1400087d0
test rax, rax
je 0x140001ecc
mov ecx, dword [rax + 0xa]
add rax, 0xe
add rax, rcx
mov qword [0x14000e0b8], rax
add rax, 0x20
mov qword [0x14000e0c0], rax
mov r9d, 0x63
lea r8, [0x140009660]
lea rdx, [0x1400096b0]
lea ecx, [r9 - 0x60]
call fcn.140003c60
lea rax, [0x14000df68]
mov qword [0x14000df70], rax
mov qword [0x14000df68], rax
lea rcx, [0x14000df30]
call qword [sym.imp.ntoskrnl.exe_KeInitializeGuardedMutex]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x40], r13
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [0x140009bf0]
call fcn.140008880
test al, al
je 0x140001ea5
mov r14, qword [rsp + 0x40]
movsxd rcx, dword [r14 + 0x3c]
movzx esi, word [rcx + r14 + 6]
movzx eax, word [rcx + r14 + 0x14]
lea rbx, [rcx + r14]
add rax, 0x18
add rbx, rax
lea rdx, [0x140009be0]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov edi, r13d
test esi, esi
je 0x140001ea5
nop dword [rax]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
cmp word [rsp + 0x68], r12w
jbe 0x140001bec
mov word [rsp + 0x68], r12w
xor r8d, r8d
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x140001c15
add rbx, 0x28
inc edi
cmp edi, esi
jb 0x140001bd0
jmp 0x140001ea5
mov edi, dword [rbx + 8]
mov ebx, dword [rbx + 0xc]
add rbx, r14
lea r9, [0x140009c10]
lea r8, [0x140009c00]
mov edx, edi
mov rcx, rbx
call fcn.1400087d0
cmp rax, rbx
jb 0x140001e88
lea rcx, [rdi + rbx]
cmp rax, rcx
ja 0x140001e88
lfence
movsxd rcx, dword [rax + 3]
mov rax, qword [rcx + rax + 7]
mov qword [0x14000df88], rax
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [0x140009c20]
lea rdx, [0x140009c30]
lea ecx, [r9 - 0x19]
call fcn.140003c60
mov qword [rsp + 0x30], r13
lea rax, [0x1400039b0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x14000df78]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jns 0x140001cc2
lea rdx, [0x1400098f0]
mov r9d, 0x11a
jmp 0x140001eb2
mov r9d, 0x68
lea r8, [0x140009660]
lea rdx, [0x1400096d0]
lea ecx, [r9 - 0x65]
call fcn.140003c60
lea rcx, [0x140003df0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
test eax, eax
js 0x140001e81
mov r9d, 0x70
lea r8, [0x140009660]
lea rdx, [0x1400096f0]
lea ecx, [r9 - 0x6d]
call fcn.140003c60
xor edx, edx
lea rcx, [0x140003ee0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
test eax, eax
jns 0x140001d3b
call fcn.1400021f0
lea rcx, [0x140003df0]
call qword [sym.imp.ntoskrnl.exe_PsRemoveCreateThreadNotifyRoutine]
jmp 0x140001ecc
mov r9d, 0x79
lea r8, [0x140009660]
lea rdx, [0x140009730]
lea ecx, [r9 - 0x76]
call fcn.140003c60
call fcn.140007690
test al, al
je 0x140001e60
call fcn.140007dd0
test al, al
je 0x140001e60
call fcn.1400080b0
test al, al
je 0x140001e60
mov r9d, 0x84
lea r8, [0x140009660]
lea rdx, [0x140009770]
mov ecx, 3
call fcn.140003c60
lea rdx, [0x140009790]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400095f0]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r13b
mov dword [rsp + 0x20], 0x100
mov r9d, 0x22
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
lea rax, [0x1400018e0]
mov qword [r15 + 0x80], rax
lea rax, [0x140001930]
mov qword [r15 + 0x70], rax
lea rax, [0x140001350]
mov qword [r15 + 0xe0], rax
lea rax, [0x140001800]
mov qword [r15 + 0x68], rax
or dword [r15 + 0x10], 4
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov r9d, 0x94
lea r8, [0x140009660]
lea rdx, [0x1400097c0]
mov ecx, 3
call fcn.140003c60
xor eax, eax
jmp 0x140001ed1
call fcn.140003600
lea rcx, [0x140003df0]
call qword [sym.imp.ntoskrnl.exe_PsRemoveCreateThreadNotifyRoutine]
mov dl, 1
lea rcx, [0x140003ee0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
call fcn.1400021f0
jmp 0x140001ecc
mov r9d, 0x20
lea r8, [0x140009c20]
lea rdx, [0x140009c60]
lea ecx, [r9 - 0x1f]
call fcn.140003c60
lea rdx, [0x1400098c0]
mov r9d, 0x114
lea r8, [0x1400098b0]
mov ecx, 1
call fcn.140003c60
jmp 0x140001ecc
mov eax, 0xc0000001
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret