Function at 0x140097200
Capabilities:
Load ntoskrnl

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x140114500]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [rdx + 0x18], 0x10
jb 0x14009722c
mov rsi, qword [rsi]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x20], ymm0
mov rcx, rsi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400974c6
mov rbx, rax
cmp rax, 0xf
ja 0x14009727a
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, rsp
add rbx, 0x20
jmp 0x1400972db
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp r15, 0xfff
jb 0x1400972af
lea rcx, [r15 + 0x28]
call fcn.1400a1c64
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400972bb
lea rcx, [r15 + 1]
call fcn.1400a1c64
mov r14, rax
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r15
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rbx, r14
mov byte [rbx], 0
lea rbx, [rsp + 0x20]
mov rdx, rbx
call fcn.140095540
mov rsi, rax
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x14009732f
mov rcx, qword [rsp + 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14009732a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400974cb
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400a1ca8
test rsi, rsi
je 0x1400973c9
cmp qword [rdi + 0x18], 0x10
jb 0x140097342
mov rdi, qword [rdi]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x20], ymm0
mov rcx, rdi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x1400974c6
mov r14, rax
cmp rax, 0xf
ja 0x140097393
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
mov rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, rsp
add r14, 0x20
jmp 0x140097421
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x1400973f4
lea rcx, [r12 + 0x28]
call fcn.1400a1c64
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140097401
lea rdx, str.dependenciescommunicationedk.cpp
lea r9, str.failed_to_get_ntoskrnl._n
mov cl, 1
mov r8d, 0x59
call fcn.140096ee0
cmp qword [rdi + 0x18], 0x10
jae 0x14009733f
jmp 0x140097342
lea rcx, [r12 + 1]
call fcn.1400a1c64
mov r15, rax
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r12
mov rcx, r15
mov rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
mov byte [r14], 0
lea rcx, str.ntoskrnl.exe
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140097469
mov rdi, rax
cmp qword [rsp + 0x38], 0x10
jb 0x140097447
mov rbx, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140097469
sub rsi, rdi
add rsi, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14009746b
xor esi, esi
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x1400974a8
mov rcx, qword [rsp + 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400974a3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400974cb
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400a1ca8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a1e40
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140006a40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3