Function at 0x7ff668d70720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x7ff668dcc3e4], ecx
jne 0x7ff668d70b54
mov ecx, 0x14
mov dword [rsp + 0x20], 0x470014
mov dword [rsp + 0x24], 0x500071
mov dword [rsp + 0x28], 0x760071
mov dword [rsp + 0x2c], 0x730061
mov dword [rsp + 0x30], 0x660044
mov dword [rsp + 0x34], 0x62007d
mov dword [rsp + 0x38], 0x78007d
mov dword [rsp + 0x3c], 0x730071
mov dword [rsp + 0x40], 0x140071
movzx eax, word [0x7ff668db52ca]
xor ax, cx
mov word [rsp + 0x44], ax
movzx eax, word [0x7ff668db52cc]
xor ax, cx
mov word [rsp + 0x46], ax
movzx eax, word [0x7ff668db52ce]
xor ax, cx
mov word [rsp + 0x48], ax
movzx eax, word [str.SeLoadDriverPrivilege]
xor ax, cx
mov word [rbp - 0x7f], ax
movzx eax, word [0x7ff668db52d2]
xor ax, cx
mov word [rbp - 0x7d], ax
movzx eax, word [0x7ff668db52d4]
xor ax, cx
mov word [rbp - 0x7b], ax
movzx eax, word [0x7ff668db52d6]
xor ax, cx
mov word [rbp - 0x79], ax
movzx eax, word [0x7ff668db52d8]
xor ax, cx
mov word [rbp - 0x77], ax
movzx eax, word [0x7ff668db52da]
xor ax, cx
mov word [rbp - 0x75], ax
movzx eax, word [0x7ff668db52dc]
xor ax, cx
mov word [rbp - 0x73], ax
movzx eax, word [0x7ff668db52de]
xor ax, cx
mov word [rbp - 0x71], ax
movzx eax, word [0x7ff668db52e0]
xor ax, cx
mov word [rbp - 0x6f], ax
movzx eax, word [0x7ff668db52e2]
xor ax, cx
mov word [rbp - 0x6d], ax
movzx eax, word [0x7ff668db52e4]
xor ax, cx
mov word [rbp - 0x6b], ax
movzx eax, word [0x7ff668db52e6]
xor ax, cx
mov word [rbp - 0x69], ax
movzx eax, word [0x7ff668db52e8]
xor ax, cx
mov word [rbp - 0x67], ax
xor eax, eax
mov word [rbp - 0x65], ax
xor edi, edi
xor word [rsp + rax*2 + 0x22], cx
inc rax
cmp rax, 0x21
jae 0x7ff668d708a6
movzx ecx, word [rsp + 0x20]
jmp 0x7ff668d70891
mov word [rbp - 0x65], di
mov qword [rbp - 9], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], 7
lea rax, [rsp + 0x22]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff668d708d0
lea rdx, [rsp + 0x22]
lea rcx, [rbp - 9]
call fcn.7ff668d61ca0
lea rcx, [rbp - 9]
call fcn.7ff668d70b90
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x7ff668d70932
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668d7092d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff668d70b7d
call fcn.7ff668d73fb8
mov ecx, 0x31
mov dword [rbp - 0x63], 0x620031
mov dword [rbp - 0x5f], 0x7d0054
mov dword [rbp - 0x5b], 0x50005e
mov dword [rbp - 0x57], 0x750055
mov dword [rbp - 0x53], 0x580043
mov dword [rbp - 0x4f], 0x540047
mov dword [rbp - 0x4b], 0x610043
mov dword [rbp - 0x47], 0x580043
mov dword [rbp - 0x43], 0x580047
mov dword [rbp - 0x3f], 0x54005d
mov dword [rbp - 0x3b], 0x540056
mov word [rbp - 0x37], cx
movzx eax, word [0x7ff668db52fc]
xor ax, cx
mov word [rbp - 0x35], ax
movzx eax, word [0x7ff668db52fe]
xor ax, cx
mov word [rbp - 0x33], ax
movzx eax, word [str.ntdll.dll]
xor ax, cx
mov word [rbp - 0x31], ax
movzx eax, word [0x7ff668db5302]
xor ax, cx
mov word [rbp - 0x2f], ax
movzx eax, word [0x7ff668db5304]
xor ax, cx
mov word [rbp - 0x2d], ax
movzx eax, word [0x7ff668db5306]
xor ax, cx
mov word [rbp - 0x2b], ax
movzx eax, word [0x7ff668db5308]
xor ax, cx
mov word [rbp - 0x29], ax
movzx eax, word [0x7ff668db530a]
xor ax, cx
mov word [rbp - 0x27], ax
movzx eax, word [0x7ff668db530c]
xor ax, cx
mov word [rbp - 0x25], ax
movzx eax, word [0x7ff668db530e]
xor ax, cx
mov word [rbp - 0x23], ax
movzx eax, word [0x7ff668db5310]
xor ax, cx
mov word [rbp - 0x21], ax
movzx eax, word [0x7ff668db5312]
xor ax, cx
mov word [rbp - 0x1f], ax
movzx eax, word [0x7ff668db5314]
xor ax, cx
mov word [rbp - 0x1d], ax
movzx eax, word [0x7ff668db5316]
xor ax, cx
mov word [rbp - 0x1b], ax
movzx eax, word [str.RtlDosPathNameToNtPathName_U]
xor ax, cx
mov word [rbp - 0x19], ax
movzx eax, word [0x7ff668db531a]
xor ax, cx
mov word [rbp - 0x17], ax
movzx eax, word [0x7ff668db531c]
xor ax, cx
mov word [rbp - 0x15], ax
movzx eax, word [0x7ff668db531e]
xor ax, cx
mov word [rbp - 0x13], ax
movzx eax, word [0x7ff668db5320]
xor ax, cx
mov word [rbp - 0x11], ax
movzx eax, word [0x7ff668db5322]
xor ax, cx
mov word [rbp - 0xf], ax
movzx eax, word [0x7ff668db5324]
xor ax, cx
mov word [rbp - 0xd], ax
xor eax, eax
mov word [rbp - 0xb], ax
mov rax, rdi
nop word [rax + rax]
xor word [rbp + rax*2 - 0x61], cx
inc rax
cmp rax, 0x2b
jae 0x7ff668d70ad4
movzx ecx, word [rbp - 0x63]
jmp 0x7ff668d70ac0
mov word [rbp - 0xb], di
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], 7
lea rax, [rbp - 0x61]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x7ff668d70af0
mov r8, rbx
lea rdx, [rbp - 0x61]
lea rcx, [rbp + 0x17]
call fcn.7ff668d61ca0
lea rcx, [rbp + 0x17]
call fcn.7ff668d70b90
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x7ff668d70b4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff668d70b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff668d70b77
call fcn.7ff668d73fb8
call fcn.7ff668d70c80
mov al, 1
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.7ff668d81620
int3
call fcn.7ff668d81620
int3