Function at 0x499a6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xbc
push 0x4162c8
call fcn.0040ba92
and dword [ebp - 0x64], 0
mov byte [ebp - 0x32], 0
mov eax, dword fs:[0x124]
mov ebx, eax
mov dword [ebp - 0xa0], ebx
mov edi, dword [ebp + 0x24]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x2c]
and dword [eax], 0
test edi, edi
je 0x507906
cmp word [edi], 8
jne 0x507906
cmp word [edi + 2], 0x60
jne 0x507906
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
cmp byte [edi + 0x50], 0
jne 0x510a16
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x49b452
push dword [ebp - 0x28]
push edi
call fcn.00416279
mov dword [ebp - 0x20], eax
test eax, eax
jl 0x5033ab
lea eax, [esi + 0x10]
mov ecx, dword [sym.ntoskrnl.exe_IoFileObjectType]
add ecx, 0x68
push ecx
push eax
call sym.ntoskrnl.exe_RtlMapGenericMask
mov eax, dword [sym.ntoskrnl.exe_IoFileObjectType]
add eax, 0x68
push eax
lea eax, [esi + 0x18]
push eax
call sym.ntoskrnl.exe_RtlMapGenericMask
mov eax, dword [sym.ntoskrnl.exe_IoFileObjectType]
add eax, 0x68
push eax
push esi
call sym.ntoskrnl.exe_SeSetAccessStateGenericMapping
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x3c], eax
cmp byte [ebp + 0x14], 0
je 0x49b21d
mov byte [ebp - 0x74], 1
lea eax, [edi + 0x20]
push dword [edi + 0x34]
push dword [ebp - 0x74]
push eax
push esi
call fcn.0049a080
mov cl, byte [edi + 0x48]
test cl, cl
jne 0x5033b3
test byte [esi + 0xc], 0x10
je 0x499b5a
mov eax, dword [esi + 0x14]
or dword [ebp - 0x3c], eax
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x49b4e3
cmp byte [ebp + 0x14], 0
je 0x49b20e
test eax, eax
jne 0x49b4f2
test cl, cl
jne 0x499c46
mov byte [ebp - 0x31], cl
mov eax, dword [ebp + 0x20]
cmp word [eax], 0
je 0x4a8d47
test byte [esi + 0xc], 1
je 0x499ba4
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x2c]
cmp eax, 7
jne 0x4a6d07
dec dword [ebx + 0xd4]
push 1
push 0x481520
call sym.ntoskrnl.exe_ExAcquireResourceSharedLite
test byte [esi + 0xc], 0x10
je 0x49a860
mov byte [ebp - 0x36], 0
cmp byte [ebp - 0x36], 0
jne 0x499c17
and dword [ebp - 0x58], 0
lea eax, [esi + 0x1c]
push eax
call sym.ntoskrnl.exe_SeLockSubjectContext
mov byte [ebp - 0x31], 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x78]
push eax
push 1
mov eax, dword [sym.ntoskrnl.exe_IoFileObjectType]
add eax, 0x68
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0x20
push 1
lea eax, [esi + 0x1c]
push eax
mov eax, dword [ebp - 0x28]
push dword [eax + 0x98]
call sym.ntoskrnl.exe_SeAccessCheck
mov byte [ebp - 0x36], al
cmp dword [ebp - 0x58], 0
jne 0x510a6f
mov ecx, 0x481520
call sym.ntoskrnl.exe_ExReleaseResourceLite
inc dword [ebx + 0xd4]
je 0x49a87a
cmp byte [ebp - 0x31], 0
je 0x499c3c
lea eax, [esi + 0x1c]
push eax
call sym.ntoskrnl.exe_SeUnlockSubjectContext
cmp byte [ebp - 0x36], 0
je 0x4c2761
cmp byte [edi + 0x49], 0
jne 0x49aebd
cmp byte [edi + 0x4a], 0
mov byte [ebp - 0x19], 1
jne 0x49aebd
xor ecx, ecx
mov eax, dword [ebp + 0x20]
cmp word [eax], cx
je 0x4a8cf4
mov byte [ebp - 0x29], 0
mov dword [ebp - 0x24], ecx
mov eax, dword [edi + 0x14]
cmp eax, ecx
jne 0x49b4b5
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmp dword [eax + 0x24], ecx
je 0x499cb3
cmp byte [ebp - 0x29], 0
jne 0x499cb3
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x20]
push dword [ebp - 0x28]
push edi
call fcn.0041635c
mov dword [ebp - 0x24], eax
test eax, eax
je 0x49ae8a
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov dword [ebp - 0x30], eax
test byte [edi + 0x54], 1
jne 0x4a2da6
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10], 0
je 0x499ccf
push eax
call sym.ntoskrnl.exe_IoGetAttachedDevice
mov dword [ebp - 0x30], eax
cmp byte [edi + 0x50], 0
jne 0x510b0e
mov eax, dword [ebp - 0x30]
test byte [eax + 0x21], 1
jne 0x4a8e14
push 1
mov eax, dword [ebp - 0x30]
movsx eax, byte [eax + 0x30]
push eax
call sym.ntoskrnl.exe_IoAllocateIrp
mov esi, eax
test esi, esi
je 0x510b61
mov dword [esi + 0x50], ebx
mov al, byte [ebp + 0x14]
mov byte [esi + 0x20], al
mov dword [esi + 8], 0x884
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xac], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0xa8], eax
mov eax, dword [esi + 0x60]
sub eax, 0x24
mov dword [ebp - 0x70], eax
mov byte [eax + 3], 0
mov ecx, dword [edi + 0x40]
xor edx, edx
cmp ecx, edx
jne 0x4a9fba
mov byte [eax], dl
mov ecx, dword [edi + 0x2c]
mov dword [eax + 0x10], ecx
mov cl, byte [edi + 0x30]
mov byte [eax + 2], cl
test byte [ebp + 0x18], 0x40
je 0x510b82
mov ecx, dword [edi + 0x18]
mov dword [esi + 0x30], ecx
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x34], ecx
mov ecx, dword [edi + 0x28]
mov dword [esi + 0xc], ecx
mov ecx, dword [edi + 0x20]
and ecx, 0xffffff
mov ebx, dword [edi + 0x34]
shl ebx, 0x18
or ecx, ebx
mov dword [eax + 8], ecx
mov cx, word [edi + 0x24]
mov word [eax + 0xc], cx
mov cx, word [edi + 0x26]
mov word [eax + 0xe], cx
lea ecx, [ebp - 0xb4]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x48]
mov dword [esi + 0x28], eax
mov dword [esi + 4], edx
mov byte [esi + 0x21], 0
mov byte [esi + 0x24], 0
mov dword [esi + 0x2c], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x54], edx
cmp byte [ebp - 0x19], 0
je 0x49ae92
mov dword [ebp - 0xcc], 0x18
xor eax, eax
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov cl, byte [edi + 0x54]
and cl, 7
neg cl
sbb ecx, ecx
and ecx, 0xc
add ecx, 0x70
lea edx, [ebp - 0x88]
push edx
push eax
push eax
push ecx
push eax
push dword [ebp + 0x14]
lea ecx, [ebp - 0xcc]
push ecx
push dword [sym.ntoskrnl.exe_IoFileObjectType]
push eax
call sym.ntoskrnl.exe_ObCreateObject
mov ebx, dword [ebp - 0x88]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x20], eax
test eax, eax
jl 0x510b8d
push dword [ebp + 0x1c]
push ebx
call fcn.004162e5
push 0x1c
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x24]
add eax, 0x20
mov edi, dword [ebp + 0x24]
test byte [eax], 0x30
je 0x499e6f
mov dword [ebx + 0x2c], 2
mov eax, edi
add eax, 0x20
test byte [eax], 0x10
jne 0x49d031
test byte [edi + 0x54], 7
jne 0x4a4287
test byte [ebx + 0x2c], 2
je 0x499e9d
mov byte [ebx + 0x4c], 1
mov byte [ebx + 0x4e], 4
xor ecx, ecx
mov dword [ebx + 0x50], ecx
lea eax, [ebx + 0x54]
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], ecx
lea eax, [edi + 0x20]
test byte [eax], 8
jne 0x4c2735
test byte [eax], 2
jne 0x4ac946
test byte [eax], 4
jne 0x49c0ba
test byte [eax + 1], 8
jne 0x4a2316
cmp byte [ebp - 0x29], 0
jne 0x4a93f0
test byte [ebp + 0x18], 0x40
je 0x510bb4
mov word [ebx], 5
mov word [ebx + 2], 0x70
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 4], eax
mov dword [esi + 0x64], ebx
mov eax, dword [ebp - 0x70]
mov dword [eax + 0x18], ebx
mov eax, dword [ebp + 0x20]
mov ax, word [eax]
test ax, ax
je 0x499f3a
cmp ax, 0x38
jb 0x49a074
cmp ax, 0x78
jae 0x49a27d
push 0x78
pop eax
mov word [ebx + 0x32], ax
push 0x6d4e6f49
movzx eax, ax
push eax
push 1
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
mov dword [ebx + 0x34], eax
test eax, eax
je 0x510bbd
lea eax, [ebx + 0x30]
push dword [ebp + 0x20]
push eax
call sym.ntoskrnl.exe_RtlCopyUnicodeString
cmp byte [edi + 0x49], 0
jne 0x49adda
mov byte [ebx + 0x5c], 0
mov byte [ebx + 0x5e], 4
and dword [ebx + 0x60], 0
lea eax, [ebx + 0x64]
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [ebp + 0x24]
mov dword [eax + 4], ebx
mov cl, 1
call dword [sym.imp.HAL.dll_KfRaiseIrql]
lea edi, [esi + 0x10]
mov edx, dword [esi + 0x50]
add edx, 0x210
mov ecx, dword [edx]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [ecx + 4], edi
mov dword [edx], edi
mov cl, al
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov edx, esi
mov ecx, dword [ebp - 0x30]
call sym.ntoskrnl.exe_IofCallDriver
mov dword [ebp - 0x20], eax
cmp eax, 0x103
je 0x504efa
cmp dword [esi + 0x18], 0x104
je 0x4b44d8
mov cl, 1
call dword [sym.imp.HAL.dll_KfRaiseIrql]
mov byte [ebp - 0x37], al
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x48], eax
mov ecx, dword [esi + 0x1c]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x20], eax
mov dword [ebx + 0x60], 1
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov dword [edi + 4], edi
mov dword [edi], edi
mov eax, dword [esi + 8]
test al, 0x10
jne 0x510c43
push esi
call sym.ntoskrnl.exe_IoFreeIrp
mov cl, byte [ebp - 0x37]
call dword [sym.imp.HAL.dll_KfLowerIrql]
xor edi, edi
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp + 0x24]
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x20], edi
jl 0x49b364
cmp dword [ebp - 0x20], 0x104
je 0x4b4449
push ebx
call sym.ntoskrnl.exe_IoGetRelatedDeviceObject
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x30], eax
jne 0x510cef
cmp byte [ebp - 0x19], 0
je 0x4aa07b
mov eax, dword [ebp + 0x2c]
mov dword [eax], ebx
mov dword [esi + 0x10], 0xbeaa0251
mov ecx, ebx
call sym.ntoskrnl.exe_ObfReferenceObject
mov eax, dword [ebx + 0x20]
cmp eax, edi
jne 0x4a29d7
cmp word [ebx + 0x30], di
je 0x4a8d1c
mov eax, dword [ebp - 0x48]
mov dword [esi + 8], eax
call fcn.0040bad2
ret 0x28
push 0x38
jmp 0x499f1a
cmp ax, 0xf8
jae 0x49fa77
mov eax, 0xf8
jmp 0x499f1b
push 1
push 0x20
mov eax, dword [ebp - 0x28]
push dword [eax + 0x98]
call fcn.0049a7b8
mov byte [ebp - 0x36], al
jmp 0x499bc4
lea eax, [ebx + 0x34]
cmp dword [eax], eax
jne 0x510a85
jmp 0x499c2d
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x499f50
cmp dword [eax], 0x60
jbe 0x499f50
cmp dword [eax + 0x60], 0
je 0x499f50
dec byte [esi + 0x23]
add dword [esi + 0x60], 0xffffffdc
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x70]
mov dword [edx + 0x14], ecx
push ecx
push dword [edi + 0x3c]
push esi
call dword [eax + 0x60]
test al, al
je 0x5033c5
mov eax, dword [esi + 0x18]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0x104
je 0x510bee
cmp word [ebx + 0x30], 0
je 0x49ae48
push 0
push dword [ebx + 0x34]
call sym.ntoskrnl.exe_ExFreePoolWithTag
xor ebx, ebx
push ebx
push ebx
push dword [ebp - 0x28]
call fcn.00411f70
cmp dword [ebp - 0x24], ebx
je 0x49ae61
push dword [ebp - 0x24]
call fcn.0041643d
push esi
call sym.ntoskrnl.exe_IoFreeIrp
mov dword [edi + 0x10], 0xbeaa0251
mov dword [ebp - 0x20], ebx
cmp byte [edi + 0x4b], 0
jne 0x49ae8a
mov dword [ebp - 4], ebx
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x38]
mov eax, dword [eax + 0x30]
mov dword [ecx + 0x20], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
jmp 0x49a06c
mov eax, dword [ebp + 0x24]
mov edx, dword [eax + 0x4c]
push 0x24
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
lea ebx, [edx + 0x18]
mov dword [ebp - 0x6c], ebx
mov eax, dword [sym.ntoskrnl.exe_IoFileObjectType]
mov dword [edx + 8], eax
mov dword [edx], 1
mov edi, dword [ebp + 0x24]
jmp 0x499ec5
mov byte [ebp - 0x19], 0
jmp 0x499c5e
test byte [edi + 0x30], 1
jne 0x499b6f
jmp 0x499c46
test byte [edi + 0x30], 1
mov byte [ebp - 0x74], 0
jne 0x499b2f
jmp 0x499b33
mov dword [esi + 4], edi
mov eax, dword [ebp - 0x20]
jmp 0x49a069
test byte [ebx + 0x2e], 0x20
jne 0x510c5a
cmp word [ebx + 0x30], di
je 0x49b381
push edi
push dword [ebx + 0x34]
call sym.ntoskrnl.exe_ExFreePoolWithTag
mov word [ebx + 0x30], di
mov dword [ebx + 4], edi
cmp byte [ebp - 0x19], 0
je 0x49b391
mov ecx, ebx
call sym.ntoskrnl.exe_ObfDereferenceObject
push edi
push edi
push dword [ebp - 0x28]
call fcn.00411f70
cmp dword [ebp - 0x24], edi
je 0x49b359
push dword [ebp - 0x24]
call fcn.0041643d
jmp 0x49b359
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
jmp 0x499ad7
test byte [eax + 0x2d], 8
jne 0x499c7e
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [eax + 8]
cmp eax, ecx
je 0x499ccf
mov dword [ebp - 0x24], eax
lea edx, [eax + 0x14]
push 9
pop ecx
call fcn.004163e2
jmp 0x499ccf
test byte [eax + 0x2e], 0x40
jne 0x510a3e
jmp 0x499b65
cmp byte [ebp - 0x32], 0
jne 0x499b77
jmp 0x499c46
or dword [ebx + 0x2c], 0x20
jmp 0x499ebb
or dword [ebx + 0x2c], 4
jmp 0x499e6f
movzx eax, ax
jmp 0x499f1b
or byte [ebx + 0x2e], 0x10
jmp 0x499ec5
test byte [eax + 0x2e], 0x40
jne 0x49a05c
jmp 0x49a066
cmp byte [ebp - 0x29], 0
jne 0x510af6
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x2c]
cmp eax, 8
jne 0x510a9a
push dword [edi + 0x58]
push dword [ebp - 0x30]
call fcn.00427bd1
test al, al
je 0x510abf
mov eax, dword [edi + 0x58]
jmp 0x499ccc
or byte [ebx + 0x2e], 0x80
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], eax
test byte [edi + 0x54], 1
je 0x4a42a2
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x74], eax
test byte [edi + 0x54], 2
je 0x499e79
mov dword [ebx + 0x70], 1
jmp 0x499e79
cmp eax, 2
je 0x499ba4
mov byte [ebp - 0x36], 1
jmp 0x499c2d
cmp dword [edi + 0x14], ecx
jne 0x499c6c
test dword [ebp - 0x3c], 0xfee1ff7f
jne 0x499c6c
cmp byte [ebp - 0x19], cl
mov byte [ebp - 0x29], 1
je 0x499c6c
jmp 0x499c70
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x2c]
cmp eax, 3
je 0x4a8d3e
cmp eax, 7
jbe 0x49a066
cmp eax, 9
jbe 0x4a8d3e
cmp eax, 0x20
jne 0x49a066
or byte [ebx + 0x2e], 0x40
jmp 0x49a066
and dword [ebp - 0x5c], 0
dec dword [ebx + 0xd4]
push 1
push 0x481520
call sym.ntoskrnl.exe_ExAcquireResourceSharedLite
lea eax, [esi + 0x1c]
push eax
call sym.ntoskrnl.exe_SeLockSubjectContext
mov byte [ebp - 0x31], 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x78]
push eax
push 1
mov eax, dword [sym.ntoskrnl.exe_IoFileObjectType]
add eax, 0x68
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push dword [ebp - 0x3c]
push 1
lea eax, [esi + 0x1c]
push eax
mov eax, dword [ebp - 0x28]
push dword [eax + 0x98]
call sym.ntoskrnl.exe_SeAccessCheck
mov byte [ebp - 0x36], al
cmp dword [ebp - 0x5c], 0
jne 0x510a54
cmp byte [ebp - 0x36], 0
je 0x4a8dc1
mov eax, dword [ebp - 0x78]
or dword [esi + 0x14], eax
or eax, 0x2000000
not eax
and dword [esi + 0x10], eax
mov byte [edi + 0x48], 1
mov word [ebp - 0x90], 8
mov word [ebp - 0x8e], 8
mov dword [ebp - 0x8c], 0x4a8e08
lea eax, [esi + 0xa]
push eax
push 1
push dword [ebp - 0x36]
push 0
push esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x98]
push dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x90]
push eax
call sym.ntoskrnl.exe_SeOpenObjectAuditAlarm
jmp 0x499c17
cmp dword [edi + 0x14], 0
jne 0x4a8e27
mov eax, dword [ebp + 0x20]
cmp word [eax], 0
je 0x499ce6
cmp byte [ebp - 0x32], 0
jne 0x499ce6
and dword [ebp - 0x50], 0
dec dword [ebx + 0xd4]
push 1
push 0x481520
call sym.ntoskrnl.exe_ExAcquireResourceSharedLite
lea eax, [esi + 0x1c]
mov dword [ebp - 0x7c], eax
push eax
call sym.ntoskrnl.exe_SeLockSubjectContext
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x84]
push eax
push 1
mov eax, dword [sym.ntoskrnl.exe_IoFileObjectType]
add eax, 0x68
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push dword [ebp - 0x3c]
push 1
push dword [ebp - 0x7c]
mov eax, dword [ebp - 0x28]
push dword [eax + 0x98]
call sym.ntoskrnl.exe_SeAccessCheck
mov byte [ebp - 0x68], al
cmp dword [ebp - 0x50], 0
jne 0x510b17
cmp byte [ebp - 0x68], 0
je 0x4a8eab
mov eax, dword [ebp - 0x84]
or dword [esi + 0x14], eax
or eax, 0x2000000
not eax
and dword [esi + 0x10], eax
mov word [ebp - 0x9c], 8
mov word [ebp - 0x9a], 8
mov dword [ebp - 0x98], 0x4a8f1c
lea eax, [esi + 0xa]
push eax
push 1
push dword [ebp - 0x68]
push 0
push esi
mov eax, dword [ebp - 0x28]
push dword [eax + 0x98]
push dword [ebp + 0x1c]
push dword [ebp - 0x30]
lea eax, [ebp - 0x9c]
push eax
call sym.ntoskrnl.exe_SeOpenObjectAuditAlarm
push dword [ebp - 0x7c]
call sym.ntoskrnl.exe_SeUnlockSubjectContext
mov ecx, 0x481520
call sym.ntoskrnl.exe_ExReleaseResourceLite
inc dword [ebx + 0xd4]
je 0x4c764d
cmp byte [ebp - 0x68], 0
jne 0x499ce6
jmp 0x510b3e
or byte [ebx + 0x2d], 8
jmp 0x499ecf
cmp ecx, 1
jne 0x5033a3
mov byte [eax], cl
mov ecx, dword [edi + 0x44]
mov dword [eax + 0x10], ecx
jmp 0x499d65
cmp byte [esi + 0x49], 0
je 0x4aa115
xor al, al
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx + 0x28]
cmp byte [esi + 0x4b], al
jne 0x510d7a
mov dword [ebp - 0x40], edi
xor edx, edx
inc edx
mov dword [ebp - 4], edx
cmp ecx, edi
je 0x4aa0b1
mov ecx, dword [ecx + 0x10]
cmp ecx, edi
jne 0x510d17
test al, al
jne 0x5033ed
push 0x20206f49
push 0x28
push edi
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
mov dword [ebp - 0x40], eax
cmp eax, edi
je 0x5033e1
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x40]
push 0x28
push 4
push ebx
call sym.ntoskrnl.exe_IoQueryFileInformation
mov dword [ebp - 0x20], eax
cmp eax, edi
jl 0x4aa108
mov ecx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp + 0x24]
mov edi, dword [eax + 0x38]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x24]
xor edi, edi
push edi
push dword [ebp - 0x40]
call sym.ntoskrnl.exe_ExFreePoolWithTag
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x10], 0xbeaa0251
push ebx
call fcn.00493ede
jmp 0x49b359
or dword [ebx + 0x2c], 0x10
jmp 0x499eb2
cmp eax, edi
jne 0x5033d1
mov ax, word [ebx + 0x30]
mov edi, dword [ebp + 0x1c]
cmp word [edi + 2], ax
jb 0x510c70
lea eax, [ebx + 0x30]
push eax
push edi
call sym.ntoskrnl.exe_RtlCopyUnicodeString
cmp dword [ebp - 0x44], 0xa0000003
je 0x510cb9
xor edi, edi
cmp word [ebx + 0x30], di
je 0x4b448e
push edi
push dword [ebx + 0x34]
call sym.ntoskrnl.exe_ExFreePoolWithTag
mov word [ebx + 0x30], di
mov dword [ebx + 4], edi
cmp byte [ebp - 0x19], 0
je 0x4b449e
mov ecx, ebx
call sym.ntoskrnl.exe_ObfDereferenceObject
mov dword [esi + 4], edi
push edi
push edi
push dword [ebp - 0x28]
call fcn.00411f70
cmp dword [ebp - 0x24], edi
jne 0x510cc2
cmp dword [ebp - 0x44], 1
je 0x510ccf
mov dword [esi + 0x14], edi
cmp dword [ebp - 0x44], 0xa0000003
je 0x510ce6
mov eax, 0x104
jmp 0x49a06c
cmp dword [esi + 0x1c], 0xa0000003
je 0x510c34
jmp 0x499fb7
or dword [ebx + 0x2c], 8
jmp 0x499ea9
mov esi, 0xc0000022
push 0
push 0
push dword [ebp - 0x28]
call fcn.00411f70
mov eax, esi
jmp 0x49a06c
lea eax, [ebx + 0x34]
cmp dword [eax], eax
jne 0x510b2d
jmp 0x4a8f0c
mov byte [eax], 0x13
jmp 0x4a9fc5
mov dword [edi + 8], eax
jmp 0x49a06c
mov eax, dword [ebp + 0x20]
cmp word [eax], 0
je 0x499b54
jmp 0x499b4e
add dword [esi + 0x60], 0x24
inc byte [esi + 0x23]
jmp 0x499f50
cmp eax, 0xa0000003
jne 0x4b447b
jmp 0x4b4451
mov dword [ebp - 0x20], 0xc000009a
jmp 0x4aa111
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
jmp 0x4aa111
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [ebx + 0x5c]
push eax
call sym.ntoskrnl.exe_KeWaitForMutexObject
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
jmp 0x49a003
mov eax, 0xc0000024
jmp 0x49a06c
mov ebx, dword [ebp - 0xa0]
jmp 0x499a93
mov eax, dword [eax + 0x2c]
cmp eax, 7
je 0x499acc
cmp eax, 2
je 0x499acc
cmp eax, 0x1f
je 0x499acc
mov eax, 0xc0000278
jmp 0x5033ab
mov edx, dword [ebp + 0x20]
cmp word [edx], 0
jne 0x499b65
mov byte [ebp - 0x32], 1
jmp 0x499b65
push dword [ebp - 0x5c]
push esi
call sym.ntoskrnl.exe_SeAppendPrivileges
push dword [ebp - 0x5c]
call sym.ntoskrnl.exe_SeFreePrivileges
jmp 0x4a8da7
push dword [ebp - 0x58]
push esi
call sym.ntoskrnl.exe_SeAppendPrivileges
push dword [ebp - 0x58]
call sym.ntoskrnl.exe_SeFreePrivileges
jmp 0x499c17
mov cl, 1
mov byte [ebx + 0x49], cl
call dword [sym.imp.HAL.dll_HalRequestSoftwareInterrupt]
jmp 0x499c2d
cmp eax, 3
je 0x4a2dbf
cmp eax, 0x20
je 0x4a2dbf
cmp eax, 0x14
je 0x4a2dbf
cmp eax, 0x35
jne 0x510af6
jmp 0x4a2dbf
xor esi, esi
cmp dword [ebp - 0x24], esi
je 0x510ace
push dword [ebp - 0x24]
call fcn.0041643d
push esi
push esi
push dword [ebp - 0x28]
call fcn.00411f70
cmp byte [edi + 0x50], 0
je 0x510aec
mov byte [edi + 0x50], 0
mov eax, 0xc0000368
jmp 0x49a06c
mov eax, 0xc0000369
jmp 0x49a06c
cmp dword [ebp - 0x24], 0
je 0x510b04
push dword [ebp - 0x24]
call fcn.0041643d
mov esi, 0xc000000d
jmp 0x4c2766
mov byte [edi + 0x50], 0
jmp 0x499cd9
push dword [ebp - 0x50]
push esi
call sym.ntoskrnl.exe_SeAppendPrivileges
push dword [ebp - 0x50]
call sym.ntoskrnl.exe_SeFreePrivileges
jmp 0x4a8e92
mov byte [ebx + 0x49], 1
mov cl, 1
call dword [sym.imp.HAL.dll_HalRequestSoftwareInterrupt]
jmp 0x4a8f0c
xor esi, esi
push esi
push esi
push dword [ebp - 0x28]
call fcn.00411f70
cmp dword [ebp - 0x24], esi
je 0x510b57
push dword [ebp - 0x24]
call fcn.0041643d
mov eax, 0xc0000022
jmp 0x49a06c
push esi
push esi
push dword [ebp - 0x28]
call fcn.00411f70
cmp dword [ebp - 0x24], esi
je 0x510b78
push dword [ebp - 0x24]
call fcn.0041643d
mov eax, 0xc000009a
jmp 0x49a06c
or cl, 0x80
mov byte [eax + 2], cl
jmp 0x499d65
push esi
call sym.ntoskrnl.exe_IoFreeIrp
xor esi, esi
push esi
push esi
push dword [ebp - 0x28]
call fcn.00411f70
cmp dword [ebp - 0x24], esi
je 0x510bac
push dword [ebp - 0x24]
call fcn.0041643d
mov eax, dword [ebp - 0x20]
jmp 0x5033ab
or byte [ebx + 0x2e], 2
jmp 0x499ed9
push esi
call sym.ntoskrnl.exe_IoFreeIrp
xor esi, esi
push esi
push esi
push dword [ebp - 0x28]
call fcn.00411f70
cmp dword [ebp - 0x24], esi
je 0x510bdc
push dword [ebp - 0x24]
call fcn.0041643d
mov dword [ebx + 4], esi
cmp byte [ebp - 0x19], 0
je 0x510b78
mov ecx, ebx
call sym.ntoskrnl.exe_ObfDereferenceObject
jmp 0x510b78
mov eax, dword [esi + 0x54]
test eax, eax
je 0x49ae37
push 0
push eax
call sym.ntoskrnl.exe_ExFreePoolWithTag
and dword [esi + 0x54], 0
and dword [edi + 0x14], 0
jmp 0x49ae37
push dword [esi + 0x54]
push ebx
push esi
call fcn.0053dc8c
jmp 0x499fb7
test al, 0x20
je 0x499ff2
push 0
push dword [esi + 0xc]
call sym.ntoskrnl.exe_ExFreePoolWithTag
jmp 0x499ff2
cmp byte [ebp - 0x19], 0
je 0x49b36e
mov ecx, ebx
call sym.ntoskrnl.exe_ObfDereferenceObject
jmp 0x49b359
push 0x63466f49
movzx eax, ax
push eax
push 1
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
mov dword [ebp - 0x94], eax
test eax, eax
jne 0x510c94
mov eax, 0xc000009a
jmp 0x49a069
mov eax, dword [edi + 4]
test eax, eax
je 0x510ca3
push 0
push eax
call sym.ntoskrnl.exe_ExFreePoolWithTag
mov eax, dword [ebp - 0x94]
mov dword [edi + 4], eax
mov ax, word [ebx + 0x30]
mov word [edi + 2], ax
jmp 0x4b4462
and dword [esi + 0x14], 0
jmp 0x4b4479
push dword [ebp - 0x24]
call fcn.0041643d
jmp 0x4b44b4
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0x20
jbe 0x510a0b
mov eax, 0xc0000001
jmp 0x49a06c
mov byte [esi + 0x50], 1
jmp 0x4b44ce
cmp dword [ebp - 0x24], edi
je 0x510cfc
push dword [ebp - 0x24]
call fcn.0041643d
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x49a034
lea edx, [eax + 0x14]
push 9
pop ecx
call fcn.004163e2
jmp 0x49a034
push dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
push dword [esi + 0x38]
push edx
push ebx
call ecx
mov byte [ebp - 0x5d], al
jmp 0x4aa0b1
cmp ecx, edi
je 0x510d99
cmp dword [ecx], 0x38
jbe 0x510d99
mov ecx, dword [ecx + 0x38]
cmp ecx, edi
je 0x510d99
push dword [ebp - 0x54]
lea eax, [ebp - 0x48]
push eax
push dword [esi + 0x3c]
push 1
push ebx
call ecx
test al, al
jne 0x4aa115
lea eax, [ebp - 0x4c]
push eax
push dword [esi + 0x3c]
push 0x38
push 0x22
push ebx
call sym.ntoskrnl.exe_IoQueryFileInformation
mov dword [ebp - 0x20], eax
cmp eax, edi
jge 0x4aa115
cmp eax, 0xc000000d
je 0x510dcf
cmp eax, 0xc0000002
jne 0x4aa115
push esi
push ebx
call fcn.00541a7c
mov dword [ebp - 0x20], eax
jmp 0x4aa115