Function at 0x14027f3e0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x14036d768]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x14027f5a0
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rbx
mov qword [0x1406c8910], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c8908], rax
test rax, rax
je 0x14027f5b5
lea rdx, str.NtDeviceIoControlFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c8900], rax
test rax, rax
je 0x14027f5ca
lea rdx, str.NtQueryInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c88f8], rax
test rax, rax
je 0x14027f5df
lea rdx, str.NtSetInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c88f0], rax
test rax, rax
je 0x14027f5f4
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c88e8], rax
test rax, rax
je 0x14027f609
lea rdx, str.NtQueryDirectoryFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1406c88e8], 0
mov qword [0x1406c88e0], rax
je 0x14027f61e
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c88d8], rax
test rax, rax
je 0x14027f633
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c88d0], rax
test rax, rax
je 0x14027f648
lea rcx, [0x14036d878]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14027f65d
lea rdx, str.GetQueuedCompletionStatusEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.powrprof.dll
mov qword [0x1406c88c8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14027f571
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c88c0], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14027f59a
lea rdx, str.SetWinEventHook
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1406c88b8], rax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d778]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d7a8]
call fcn.14027e9e0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x14036d778]
call fcn.14027e9e0
int3