Function at 0x140001920
Capabilities:
Create thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140016b20]
test rax, rax
jne 0x140001973
lea rdx, [0x140002c70]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140016b20], rax
test rax, rax
jne 0x140001973
mov eax, 0xc0000001
add rsp, 0xd0
pop rbp
ret
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xc0], rdi
lea rdi, [0x140004010]
mov rcx, rdi
call qword [0x1400030d0]
mov rbx, rax
test rax, rax
je 0x140001c74
mov edx, dword [rax + 0x50]
xor ecx, ecx
mov r8d, 0x5347
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, qword [0x140016b10]
mov qword [rcx + 0x30], rax
mov rcx, qword [0x140016b10]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140001c74
mov r8d, dword ds:[rbx + 0x50]
mov qword [rsp + 0xc8], rsi
test r8, r8
je 0x1400019ec
xor edx, edx
call fcn.140002b40
mov rax, qword [0x140016b10]
mov edx, dword [rbx + 0x54]
mov rcx, qword [rax + 0x30]
test rdx, rdx
je 0x140001a26
mov r8, rdi
sub r8, rcx
nop word [rax + rax]
movzx eax, byte ds:[r8 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140001a10
movsxd r10, dword [0x14000404c]
xor esi, esi
add r10, rdi
mov r9d, esi
cmp si, word [rbx + 6]
jae 0x140001a9d
nop dword [rax + rax]
mov eax, r9d
lea rcx, [rax + rax*4]
mov edx, dword [r10 + rcx*8 + 0x118]
mov r8d, dword [r10 + rcx*8 + 0x11c]
mov eax, dword [r10 + rcx*8 + 0x114]
add r8, rdi
mov rcx, qword [0x140016b10]
add rax, qword [rcx + 0x30]
test rdx, rdx
je 0x140001a91
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140001a80
movzx eax, word [rbx + 6]
inc r9d
cmp r9d, eax
jb 0x140001a40
mov rcx, qword [0x140016b10]
mov rcx, qword [rcx + 0x30]
call fcn.140001300
test eax, eax
js 0x140001c6d
mov rcx, qword [0x140016b10]
mov rcx, qword [rcx + 0x30]
call fcn.1400015a0
test eax, eax
js 0x140001c6d
lea rdx, [0x140002d00]
mov qword ds:[rbp + 0x67], rsi
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x50], esi
lea rax, [rbp - 9]
mov qword [rsp + 0x48], rsi
lea r9, [rbp + 7]
mov dword [rsp + 0x40], 0x20
lea r8, [rbp + 0x17]
mov dword [rsp + 0x38], 3
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x30], 3
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x10000000
mov qword [rsp + 0x20], rsi
mov dword [rbp + 0x17], 0x30
mov qword [rbp + 0x1f], rsi
mov dword [rbp + 0x2f], 0x240
mov qword [rbp + 0x27], rax
movdqu xmmword [rbp + 0x37], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edi, eax
test eax, eax
js 0x140001ba6
mov rcx, qword [rbp + 0x67]
xor eax, eax
mov qword [rbp + 0x6f], rax
xor r9d, r9d
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [0x140016b10]
mov dword [rsp + 0x30], 8
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword ds:[rbp + 0x67]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test edi, edi
js 0x140001c69
mov rax, qword [0x140016b10]
mov r9, 0xffffffffffffffff
mov ecx, dword [rbx + 0x28]
xor r8d, r8d
mov qword [rbp + 0x6f], rsi
mov edx, 0x1fffff
mov qword [rsp + 0x30], rsi
add rcx, qword [rax + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x6f]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
js 0x140001c48
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
mov qword [rbp + 0x67], rsi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x140001c3a
mov rcx, qword [rbp + 0x67]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x6f]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, ebx
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xc0]
add rsp, 0xd0
pop rbp
ret
mov eax, edi
jmp 0x140001c48
mov eax, 0xc0000001
jmp 0x140001c48
mov eax, 0xc0000001
jmp 0x140001c50