Function at 0x436a0
Capabilities:
Link many functions at runtime

Disassembly:
add dword [rax], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d938], rax
jne 0x33735
and ebx, 0xfffffffd
test edi, edi
je 0x338cd
lea rdx, [0x000505f0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d940], rax
jne 0x33769
and ebx, 0xfffffffe
test edi, edi
je 0x338cd
lea rdx, [0x000505d0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d948], rax
jne 0x3379d
and ebx, 0xfffffffe
test edi, edi
je 0x338cd
lea rdx, [0x000505a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d950], rax
jne 0x337d1
and ebx, 0xfffffffe
test edi, edi
je 0x338cd
lea rdx, [0x00050570]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d958], rax
jne 0x33805
and ebx, 0xfffffffe
test edi, edi
je 0x338cd
lea rdx, [0x00050540]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
adc eax, 0x2489e
adc eax, 0x2489e
test rax, rax
mov qword [0x0005d960], rax
jne 0x33839
and ebx, 0xfffffffe
inc byte [rbp - 0x737bf001]
add byte [rax], al
add byte [rax - 0x73], cl
adc eax, 0x1ccd8
test edi, edi
je 0x338cd
lea rdx, [0x00050520]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jge 0x33899
add al, byte [rax]
jge 0x33899
add al, byte [rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d968], rax
jne 0x3386d
and ebx, 0xfffffffe
test edi, edi
je 0x338cd
lea rdx, [0x00050500]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d970], rax
jne 0x3389d
add eax, dword [rbx - 0x7a011d]
and ebx, 0xfffffffe
test edi, edi
je 0x338cd
lea rdx, [0x000504d0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d978], rax
jne 0x338cd
and ebx, 0xfffffffe
test esi, esi
je 0x3392d
lea rdx, [0x000504a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
and al, 0x20
and al, 0x20
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d980], rax
mov byte [rax + 0x3750002], ah
mov byte [rax + 0x3750002], ah
and ebx, 0xfffffffd
test esi, esi
je 0x3392d
lea rdx, [0x00050470]
adc eax, 0x1cb68
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add byte [rax - 0x73], cl
and al, 0x20
add byte [rax - 0x73], cl
and al, 0x20
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d988], rax
jne 0x3392d
and ebx, 0xfffffffd
test edi, edi
je 0x33bfd
invalid
add byte [rax - 0x73], cl
adc eax, 0x1caf4
lea rdx, [0x00050430]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rdi + 2], eax
add byte [rax - 0x73], cl
and al, 0x20
mov dword [rdi + 2], eax
add byte [rax - 0x73], cl
and al, 0x20
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d990], rax
jne case.0x4370c.1791478101
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x00050410]
lea rcx, [rsp + 0x20]
and bh, bh
adc eax, 0x24755
and bh, bh
adc eax, 0x24755
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d998], rax
jne 0x33995
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x000503e0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9a0], rax
jne 0x339c9
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x000503a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9a8], rax
jne 0x339fd
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x00050380]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9b0], rax
jne 0x33a31
and ebx, 0xfffffffe
jrcxz case.0x4370c.1791478268
test edi, edi
je 0x33bfd
lea rdx, [0x00050360]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9b8], rax
jne 0x33a65
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x00050340]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9c0], rax
jne 0x33a99
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x00050300]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9c8], rax
jne 0x33acd
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x000502e0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9d0], rax
jne 0x33b01
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x000502c0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9d8], rax
jne 0x33b35
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x000502a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9e0], rax
jne 0x33b69
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x00050270]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9e8], rax
jne 0x33b9d
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x00050240]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9f0], rax
jne 0x33bcd
and ebx, 0xfffffffe
test edi, edi
je 0x33bfd
lea rdx, [0x00050210]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005d9f8], rax
jne 0x33bfd
and ebx, 0xfffffffe
test esi, esi
je 0x33c2d
lea rdx, [0x000501d0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da00], rax
jne 0x33c2d
and ebx, 0xfffffffd
test edi, edi
je 0x33fcd
lea rdx, [0x000501a0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da08], rax
jne 0x33c61
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050180]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da10], rax
jne 0x33c95
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050150]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da18], rax
jne 0x33cc9
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050130]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da20], rax
jne 0x33cfd
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050100]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da28], rax
jne 0x33d31
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x000500d0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da30], rax
jne 0x33d65
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x000500b0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da38], rax
jne 0x33d99
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050090]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da40], rax
jne 0x33dcd
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050060]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da48], rax
jne 0x33e01
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050030]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da50], rax
jne 0x33e35
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x00050000]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da58], rax
jne 0x33e69
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x0004ffd0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da60], rax
jne 0x33e9d
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x0004ffa0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da68], rax
jne 0x33ed1
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x0004ff80]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da70], rax
jne 0x33f05
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x0004ff50]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da78], rax
jne 0x33f39
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x0004ff20]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da80], rax
jne 0x33f6d
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x0004fef0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da88], rax
jne 0x33f9d
and ebx, 0xfffffffe
test edi, edi
je 0x33fcd
lea rdx, [0x0004fed0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da90], rax
jne 0x33fcd
and ebx, 0xfffffffe
test esi, esi
je 0x33ffd
lea rdx, [0x0004feb0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005da98], rax
jne 0x33ffd
and ebx, 0xfffffffd
test edi, edi
je 0x34231
lea rdx, [0x0004fe80]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005daa0], rax
jne 0x34031
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fe40]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005daa8], rax
jne 0x34065
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fe00]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dab0], rax
jne 0x34099
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fdf0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dab8], rax
jne 0x340cd
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fdd0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dac0], rax
jne 0x34101
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fda0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dac8], rax
jne 0x34135
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fd70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dad0], rax
jne 0x34169
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fd50]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dad8], rax
jne 0x3419d
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fd30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dae0], rax
jne 0x341d1
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fd10]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005dae8], rax
jne 0x34201
and ebx, 0xfffffffe
test edi, edi
je 0x34231
lea rdx, [0x0004fcf0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005daf0], rax
jne 0x34231
and ebx, 0xfffffffe
test esi, esi
je 0x342f9
lea rdx, [0x0004fcc0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005daf8], rax
jne 0x34265
and ebx, 0xfffffffd
test esi, esi
je 0x342f9
lea rdx, [0x0004fc90]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db00], rax
jne 0x34299
and ebx, 0xfffffffd
test esi, esi
je 0x342f9
lea rdx, [0x0004fc50]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db08], rax
jne 0x342c9
and ebx, 0xfffffffd
test esi, esi
je 0x342f9
lea rdx, [0x0004fc10]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db10], rax
jne 0x342f9
and ebx, 0xfffffffd
test edi, edi
je 0x34329
lea rdx, [0x0004fbf0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db18], rax
jne 0x34329
and ebx, 0xfffffffe
test esi, esi
je 0x34359
lea rdx, [0x0004fbd0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db20], rax
jne 0x34359
and ebx, 0xfffffffd
and ebp, 0x10
je 0x3438a
lea rdx, [0x0004fbb0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db28], rax
jne 0x3438a
and ebx, 0xffffffef
test ebp, ebp
je 0x343ea
lea rdx, [0x0004fb80]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db30], rax
jne 0x343ba
and ebx, 0xffffffef
test ebp, ebp
je 0x343ea
lea rdx, [0x0004fb50]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db38], rax
jne 0x343ea
and ebx, 0xffffffef
test esi, esi
je 0x3441a
lea rdx, [0x0004fb20]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db40], rax
jne 0x3441a
and ebx, 0xfffffffd
test edi, edi
je 0x3444a
lea rdx, [0x0004faf0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db48], rax
jne 0x3444a
and ebx, 0xfffffffe
test esi, esi
je 0x344aa
lea rdx, [0x0004fac0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db50], rax
jne 0x3447a
and ebx, 0xfffffffd
test esi, esi
je 0x344aa
lea rdx, [0x0004faa0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
mov qword [0x0005db58], rax
jne 0x344aa
and ebx, 0xfffffffd
cmp qword [0x0005d828], 0
je 0x344be
cmp qword [0x0005d830], 0
jne 0x344ce
xor eax, eax
mov qword [0x0005d830], rax
mov qword [0x0005d828], rax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x70
mov rbx, r8
mov r12, rdx
mov rdi, rcx
call fcn.00018df0
mov esi, dword [rsp + 0xa0]
cmp esi, 0x95383763
ja case.default.0x4370c
cmp esi, 0x95383763
je 0x43994
lea eax, [rsi + 0x6ac7c9fd]
cmp eax, 0xd4
ja case.default.0x4370c
lea rdx, [0x00010000]
movzx eax, byte [rdx + rax + 0x33a9c]
mov ecx, dword [rdx + rax*4 + 0x33a60]
add rcx, rdx
jmp rcx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov esi, dword [rbx + 8]
mov ebx, dword [rbx + 4]
lea r8, [0x00055610]
mov r9d, ebx
mov edx, 0x8200
mov ecx, 4
mov dword [rsp + 0x20], esi
call fcn.00025960
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], r12
movzx r9d, bx
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
mov qword [rsp + 0x28], rdi
mov word [rsp + 0x20], si
call fcn.00029690
test eax, eax
jne 0x43a0e
lea r8, [0x000555c0]
lea ecx, [rax + 2]
mov r9d, ebx
mov edx, 0x240
mov dword [rsp + 0x20], esi
call fcn.00025960
mov r8d, 0x20000009
mov eax, r8d
jmp 0x4376d
lea r8, [0x000555a0]
mov edx, 0x8200
mov ecx, 4
call fcn.00025960
xor r8d, r8d
mov eax, r8d
jmp 0x4376d
mov eax, esi
lea r8, [0x00057c80]
mov r9d, esi
shr eax, 2
mov edx, 0x8000
mov ecx, 1
and eax, 0xfff
mov dword [rsp + 0x20], eax
call fcn.00025960
mov eax, 0x2000000a
jmp 0x4376d