Function at 0x1312c
Capabilities:
Attach user process memory
Create thread
Packed with generic packer

Disassembly:
push 0x2b8
push 0x1eb38
call fcn.000195f0
mov eax, dword [0x1f3a4]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xf0], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc8], eax
mov ebx, dword [ebp + 0x1c]
mov dword [ebp - 0xd4], ebx
call dword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x13173
cmp dword [ebp - 0xc8], edi
je 0x1317e
mov edx, dword [ebp + 0xc]
cmp edx, edi
je 0x131ac
cmp esi, edi
jne 0x131ac
mov dword [ebx + 4], edi
mov dword [ebx], 0xc000000d
cmp dword [ebp + 0x18], 0x8899e800
jb 0x14728
cmp dword [ebp + 0x18], 0x8899e834
ja 0x14728
mov dword [ebx], 0xe000000d
jmp 0x14728
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov ecx, dword [ebp + 0x18]
cmp ecx, 0x88992888
jb 0x13201
cmp ecx, 0x8899288c
ja 0x13201
mov eax, dword [0x1f458]
mov edi, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp eax, dword [edi]
jbe 0x131ff
xor edi, edi
cmp dword [0x1f3e0], edi
jne 0x13201
xor edx, edx
inc edx
mov edi, 0x1f3e0
xor eax, eax
lock cmpxchg dword [edi], edx
mov eax, dword [0x1f458]
mov edx, dword [eax]
mov dword [0x1f3e4], edx
xor edx, edx
xchg dword [eax], edx
mov edx, dword [ebp + 0xc]
xor edi, edi
mov eax, 0x8899e804
cmp ecx, eax
ja 0x13a9f
je 0x13a74
mov eax, 0x88992898
cmp ecx, eax
ja 0x134d7
je 0x1348a
cmp ecx, 0x88992880
je 0x1339a
cmp ecx, 0x88992884
je 0x13388
cmp ecx, 0x88992888
je 0x13344
cmp ecx, 0x8899288c
je 0x13317
cmp ecx, 0x88992890
je 0x132a1
cmp ecx, 0x88992894
jne 0x143e0
cmp byte [0x1f3ea], 0
jne 0x139db
cmp edx, 0x14
jb 0x143e0
cmp esi, edi
je 0x143e0
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.00015c4c
jmp 0x1337b
cmp byte [0x1f3ea], 0
jne 0x139db
cmp edx, 0x18
jb 0x143e0
cmp esi, edi
je 0x143e0
mov eax, dword [0x1f5cc]
cmp eax, 5
jne 0x132d2
cmp dword [0x1f874], 2
je 0x132e0
cmp eax, 6
jne 0x132fc
cmp dword [0x1f874], 1
jne 0x132fc
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call dword [0x1f434]
jmp 0x146cb
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.00015e34
jmp 0x146cb
cmp byte [0x1f3ea], 0
jne 0x139db
cmp edx, 0xc
jb 0x143e0
cmp esi, edi
je 0x143e0
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.00015976
jmp 0x1337b
cmp byte [0x1f3ea], 0
jne 0x139db
cmp edx, 0x1c
jb 0x143e0
cmp esi, edi
je 0x143e0
push dword [esi + 0x18]
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.0001565c
test eax, eax
jge 0x146cd
jmp 0x146cb
cmp byte [0x1f3ea], 0
je 0x146cd
jmp 0x139db
cmp byte [0x1f3ea], 0
jne 0x139db
mov dword [ebp - 0x14c], edi
cmp edx, 4
jb 0x143e0
cmp esi, edi
je 0x143e0
mov esi, dword [esi]
mov dword [ebp - 0x190], esi
mov dword [ebp - 4], 2
push 4
push 0x1000
push esi
call dword [sym.imp.ntoskrnl.exe_ProbeForWrite]
or dword [ebp - 4], 0xffffffff
jmp 0x13405
xor eax, eax
cmp edi, eax
jne 0x13468
push eax
push eax
push eax
push eax
push 0x1f5b0
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
pushal
mov dword [ebp - 4], 3
push dword [ebp - 0x190]
call fcn.00016840
mov dword [ebp - 0x14c], eax
jmp 0x1343c
or dword [ebp - 4], 0xffffffff
popal
xor esi, esi
push esi
push esi
push 0x1f5b0
call dword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov ebx, dword [ebp - 0xd4]
cmp dword [ebp - 0x14c], esi
jne 0x1346e
mov eax, ebx
mov dword [eax], 0xc0000001
jmp 0x1346e
mov dword [ebx], 0xc0000001
mov eax, dword [0x1f45c]
cmp eax, dword [0x1f4e4]
je 0x13480
mov dword [0x1f4e4], eax
call fcn.000115da
jmp 0x146cd
cmp byte [0x1f3ea], 0
jne 0x139db
cmp edx, 0x18
jb 0x143e0
cmp esi, edi
je 0x143e0
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
cmp dword [0x1f5cc], 6
jne 0x134cd
call dword [0x1f438]
jmp 0x146cb
call fcn.00015fba
jmp 0x146cb
cmp ecx, 0x8899289c
je 0x13a2c
cmp ecx, 0x889928a0
je 0x13a06
cmp ecx, 0x889928a4
je 0x139d2
cmp ecx, 0x88992940
je 0x1385a
cmp ecx, 0x889929c0
je 0x136f0
cmp ecx, 0x8899e800
jne 0x143e0
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 0x38
jb 0x143e0
cmp dword [ebp + 0x14], 0x38
jb 0x143e0
mov word [ebp - 0x104], di
mov word [ebp - 0x102], di
mov dword [ebp - 0x100], edi
mov dword [ebp - 4], edi
push 4
push 0x18
push dword [esi + 0x18]
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x230], ecx
and ecx, 0x5f2
mov edi, ecx
mov dword [ebp - 0x210], edi
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x135d5
lea eax, [ebp - 0x104]
push eax
push ecx
push 1
call fcn.0001e240
mov dword [ebx], eax
test eax, eax
jl 0x14488
mov dword [ebp - 0x18c], 0x18
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x180], edi
lea eax, [ebp - 0x104]
mov dword [ebp - 0x184], eax
and dword [ebp - 0x17c], 0
and dword [ebp - 0x178], 0
jmp 0x13602
mov dword [ebp - 0x18c], 0x18
mov eax, dword [eax + 4]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x180], edi
xor eax, eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
or dword [ebp - 4], 0xffffffff
lea eax, [esi + 0x10]
lea ecx, [esi + 8]
xor edx, edx
push edx
push 2
mov edi, 0x300
push edi
push edx
push edx
push dword [esi + 0x30]
push dword [esi + 0x2c]
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push eax
push esi
lea eax, [ebp - 0x18c]
push eax
push dword [esi + 0xc]
push ecx
call fcn.000198eb
mov dword [ebx], eax
cmp eax, 0xc00000ca
jne 0x13678
push edi
push 0
push 0
push dword [esi + 0x30]
push dword [esi + 0x2c]
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x1c]
lea eax, [esi + 0x10]
push eax
push esi
lea eax, [ebp - 0x18c]
push eax
push dword [esi + 0xc]
lea eax, [esi + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov dword [ebx], eax
cmp dword [ebp - 0x100], 0
je 0x1368f
push 0
push dword [ebp - 0x100]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, dword [ebp - 0xc8]
je 0x136a8
push 0xe
pop ecx
mov esi, dword [ebp - 0xf0]
mov edi, dword [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0x38
jmp 0x146cd
push 0x1f410
call fcn.00010634
test eax, eax
jl 0x146cd
cmp dword [0x1f408], 0
je 0x146cd
xor esi, esi
mov dword [ebp - 0xec], esi
mov dword [ebp - 0x108], esi
mov word [ebp - 0x1a0], si
xor eax, eax
lea edi, [ebp - 0x19e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x1dc], esi
xor eax, eax
lea edi, [ebp - 0x1d8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x130da
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x1dc], 0x18
mov dword [ebp - 0x1d8], esi
mov dword [ebp - 0x1d0], 0x240
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1cc], esi
mov dword [ebp - 0x1c8], esi
lea eax, [ebp - 0x1dc]
push eax
push 1
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x146cd
push esi
lea eax, [ebp - 0xec]
push eax
push esi
push esi
push 0x80000000
push dword [ebp - 0x108]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jl 0x13849
mov eax, dword [0x1f408]
cmp eax, esi
je 0x1383d
mov ecx, dword [0x1f40c]
cmp ecx, esi
je 0x1381c
mov edx, dword [0x1f75c]
cmp edx, 0x10
jne 0x137f3
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + 0x14]
jmp 0x13835
cmp edx, 2
jne 0x1380e
mov eax, dword [ebp - 0xec]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x10]
cmp dword [eax + 4], ecx
je 0x1383d
mov dword [eax + 4], ecx
jmp 0x1383d
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + 0x10]
jmp 0x13835
cmp eax, esi
je 0x1383d
cmp dword [0x1f75c], 1
jne 0x1383d
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
cmp dword [ecx + 4], eax
je 0x1383d
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xec]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0x108]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x146cd
cmp edx, 0xc
jb 0x143e0
xor ecx, ecx
mov dword [ebp - 0x174], ecx
xor eax, eax
lea edi, [ebp - 0x170]
stosd dword es:[edi], eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x204], ecx
lea edi, [ebp - 0x200]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
push ecx
push ecx
push ecx
push 0x1f5d0
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
jl 0x146cb
mov dword [ebp - 0x204], 0x18
xor edi, edi
mov dword [ebp - 0x200], edi
mov dword [ebp - 0x1f8], 0x240
mov dword [ebp - 0x1fc], edi
mov dword [ebp - 0x1f4], edi
mov dword [ebp - 0x1f0], edi
mov eax, dword [esi + 8]
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], edi
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x204]
push eax
push 0x1f0fff
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
cmp eax, edi
jl 0x139be
mov ax, word [esi]
mov word [0x1f3f8], ax
mov eax, dword [esi + 4]
mov dword [0x1f3fc], eax
mov dword [0x1f404], 0xc0000001
mov dword [0x1f3f4], edi
push 0x1f3f8
push reloc.ntoskrnl.exe_IoGetDeviceObjectPointer
push edi
push dword [ebp - 0x114]
push edi
push edi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [ebp - 0x110], eax
cmp eax, edi
jl 0x139ac
mov dword [ebp - 0x1e4], 0xfd050f80
or dword [ebp - 0x1e0], 0xffffffff
lea eax, [ebp - 0x1e4]
push eax
push edi
push dword [ebp - 0x10c]
call dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov dword [ebp - 0x110], eax
cmp eax, edi
jl 0x139a0
xor ecx, ecx
mov edx, 0x1f3f4
xor eax, eax
inc eax
lock cmpxchg dword [edx], ecx
mov eax, dword [0x1f404]
mov dword [ebp - 0x110], eax
push dword [ebp - 0x10c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push dword [ebp - 0x114]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0x110]
mov dword [ebx], eax
push edi
push edi
push 0x1f5d0
call dword [sym.imp.ntoskrnl.exe_KeSetEvent]
jmp 0x146cd
cmp byte [0x1f3ea], 0
je 0x139e6
mov dword [ebx], 0xc0000001
jmp 0x146cd
cmp edx, 8
jb 0x143e0
cmp esi, edi
je 0x143e0
push dword [esi + 4]
push dword [esi]
call fcn.000163ce
jmp 0x146cb
cmp byte [0x1f3ea], 0
jne 0x139db
cmp edx, 4
jb 0x143e0
cmp esi, edi
je 0x143e0
push dword [esi]
call fcn.000162ca
jmp 0x146cb
cmp byte [0x1f3ea], 0
jne 0x139db
cmp edx, 0x18
jb 0x143e0
cmp esi, edi
je 0x143e0
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
cmp dword [0x1f4f8], edi
jne 0x13a6a
call dword [0x1f43c]
jmp 0x146cb
call fcn.000160ce
jmp 0x146cb
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 0x1c
jb 0x143e0
cmp dword [ebp + 0x14], 0x1c
jb 0x143e0
push esi
call fcn.00011cb6
jmp 0x13c72
mov eax, 0x8899e820
cmp ecx, eax
ja 0x143a8
je 0x13c99
cmp ecx, 0x8899e808
je 0x13c4c
cmp ecx, 0x8899e80c
je 0x13bd9
cmp ecx, 0x8899e810
je 0x13b9f
cmp ecx, 0x8899e814
je 0x13b4f
cmp ecx, 0x8899e818
je 0x13b14
cmp ecx, 0x8899e81c
jne 0x143e0
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 4
jb 0x143e0
push dword [esi]
call fcn.0001d01e
jmp 0x146cb
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 0xf8
jb 0x143e0
cmp byte [0x1f3f0], 0
jne 0x143e0
mov byte [0x1f3f0], 1
push esi
call fcn.0001e3a5
and dword [ebx], 0
jmp 0x146cd
cmp byte [0x1f3eb], 0
jne 0x139db
push 0x20
pop edi
cmp edx, edi
jb 0x143e0
cmp dword [ebp + 0x14], edi
jb 0x143e0
xor eax, eax
mov al, byte [esi + 0x1c]
push eax
push dword [esi + 0x18]
xor eax, eax
mov al, byte [esi + 0x14]
push eax
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
xor eax, eax
push eax
push eax
push eax
push dword [esi]
call fcn.0001baa2
mov dword [ebx + 4], edi
jmp 0x146cb
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 0xc
jb 0x143e0
mov eax, dword [esi + 4]
lea ecx, [eax + 0xc]
cmp edx, ecx
jb 0x143e0
cmp eax, 0x7fff0000
ja 0x143e0
push esi
call fcn.0001215a
jmp 0x146cb
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 0x10
jb 0x143e0
cmp dword [ebp + 0x14], 0x10
jb 0x143e0
mov eax, dword [esi + 4]
lea ecx, [eax + 0x10]
cmp dword [ebp + 0x14], ecx
jb 0x143e0
cmp eax, 0x7fff0000
ja 0x143e0
cmp esi, dword [ebp - 0xc8]
je 0x13c31
mov esi, dword [ebp - 0xf0]
mov edi, dword [ebp - 0xc8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xf0]
push dword [ebp - 0xc8]
call fcn.00012056
mov dword [ebx], eax
mov eax, dword [esi + 0xc]
add eax, 0x10
mov dword [ebx + 4], eax
jmp 0x146cd
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 0x1c
jb 0x143e0
cmp dword [ebp + 0x14], 0x1c
jb 0x143e0
push esi
call fcn.00011e4c
mov dword [ebx], eax
cmp esi, dword [ebp - 0xc8]
je 0x13c8d
push 7
pop ecx
mov esi, dword [ebp - 0xf0]
mov edi, dword [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0x1c
jmp 0x146cd
mov byte [ebp - 0xc9], 0
xor ecx, ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0x228], ecx
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0x128], ecx
mov word [ebp - 0x20c], cx
xor eax, eax
lea edi, [ebp - 0x20a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x1ec], cx
xor eax, eax
lea edi, [ebp - 0x1ea]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x1ac], cx
xor eax, eax
lea edi, [ebp - 0x1aa]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x1c4], ecx
xor eax, eax
lea edi, [ebp - 0x1c0]
stosd dword es:[edi], eax
mov dword [ebp - 0x148], ecx
lea edi, [ebp - 0x144]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x120], ecx
xor eax, eax
lea edi, [ebp - 0x11c]
stosd dword es:[edi], eax
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0xe8], ecx
cmp byte [0x1f3eb], al
jne 0x139db
cmp edx, 4
jb 0x143e0
xor edi, edi
push edi
lea eax, [ebp - 0xd0]
push eax
push 1
mov eax, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push dword [eax]
push edi
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, edi
jl 0x146cb
lea eax, [ebp - 0xc4]
push eax
push 8
lea eax, [ebp - 0x1ec]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov esi, eax
cmp esi, 0x80000005
jne 0x13f0a
mov eax, dword [ebp - 0xc4]
cmp eax, edi
je 0x13f0a
mov esi, 0x5a544157
push esi
add eax, 8
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xd8], eax
cmp eax, edi
je 0x13f33
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
push dword [ebp - 0xd8]
push dword [ebp - 0xd0]
call dword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x14371
push 0x1310e
lea eax, [ebp - 0x1ac]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x148], 0x18
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x13c], 0x240
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
push edi
push edi
push 0x300
push edi
push edi
push edi
push edi
push edi
push 1
push 1
push 0x80
push edi
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x148]
push eax
push 0x100000
lea eax, [ebp - 0xfc]
push eax
call fcn.000198eb
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x14371
push edi
lea eax, [ebp - 0x128]
push eax
push edi
mov eax, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push dword [eax]
push 0x80000000
push dword [ebp - 0xfc]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x1435a
call fcn.00012818
mov dword [ebp - 0x118], eax
cmp eax, edi
je 0x1434e
lea ecx, [eax + 4]
mov dword [ebp - 0x1b8], ecx
mov dword [ebp - 0xe4], edi
mov eax, dword [eax]
cmp eax, edi
jbe 0x13f64
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0x128]
je 0x13f5b
inc dword [ebp - 0xe4]
add ecx, 0x10
cmp dword [ebp - 0xe4], eax
jb 0x13eec
jmp 0x13f64
cmp esi, 0xc0000004
jne 0x14395
mov esi, 0x5a544157
push esi
push 0x2000
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xd8], eax
cmp eax, edi
jne 0x13f4a
mov ecx, dword [ebp - 0xd0]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [ebx], 0xc000009a
jmp 0x146cd
lea eax, [ebp - 0xc4]
push eax
push 0x2000
jmp 0x13dee
mov cl, byte [ecx + 4]
mov byte [ebp - 0xc9], cl
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xe4], edi
cmp eax, edi
jbe 0x14341
mov eax, dword [ebp - 0xf8]
mov cl, byte [ebp - 0xc9]
cmp cl, byte [eax + 4]
jne 0x14320
mov dword [ebp - 0x148], 0x18
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x13c], 0x240
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
mov eax, dword [eax]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], edi
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x148]
push eax
push 0x1f0fff
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x14320
mov dword [ebp - 0x148], 0x18
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x13c], 0x240
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
call sub.ntoskrnl.exe_PsGetCurrentProcessId
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], edi
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x148]
push eax
push 0x1f0fff
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x14314
push 2
push edi
push edi
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x124]
mov eax, dword [ebp - 0xf8]
movzx eax, word [eax + 6]
push eax
push dword [ebp - 0xf4]
call dword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x14308
push edi
lea eax, [ebp - 0xe8]
push eax
push edi
mov eax, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push dword [eax]
push 0x80000000
push dword [ebp - 0x150]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x14308
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 4]
cmp dword [ecx + 0x2c], 7
jne 0x142fc
mov dword [ebp - 0xc4], edi
lea ecx, [ebp - 0xc4]
push ecx
push 8
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov dword [ebp - 0xc0], eax
cmp eax, 0x80000005
jne 0x141fd
mov eax, dword [ebp - 0xc4]
cmp eax, edi
je 0x141fd
push esi
add eax, 8
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xe0], eax
cmp eax, edi
je 0x141fd
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
push dword [ebp - 0xe0]
push dword [ebp - 0xe8]
call dword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x141f0
push 1
push dword [ebp - 0xd8]
push dword [ebp - 0xe0]
call dword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x141f0
push edi
lea eax, [ebp - 0xdc]
push eax
push edi
mov eax, dword [sym.imp.ntoskrnl.exe_PsProcessType]
push dword [eax]
push 0x80000000
push dword [ebp - 0xf4]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x141f0
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp dword [ebp - 0xdc], eax
je 0x141e4
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push dword [ebp - 0xe8]
call fcn.0001a600
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0xdc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push esi
push dword [ebp - 0xe0]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0xc0], 0xc0000004
jne 0x142fc
cmp dword [ebp - 0xc4], edi
jne 0x142fc
push esi
push 0x2000
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xe0], eax
cmp eax, edi
je 0x142fc
lea eax, [ebp - 0xc4]
push eax
push 0x2000
push dword [ebp - 0xe0]
push dword [ebp - 0xe8]
call dword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x142ef
push 1
push dword [ebp - 0xd8]
push dword [ebp - 0xe0]
call dword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x142ef
push edi
lea eax, [ebp - 0xdc]
push eax
push edi
mov eax, dword [sym.imp.ntoskrnl.exe_PsProcessType]
push dword [eax]
push 0x80000000
push dword [ebp - 0xf4]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 0xc0], eax
cmp eax, edi
jl 0x142ef
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp dword [ebp - 0xdc], eax
je 0x142e3
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push dword [ebp - 0xe8]
call fcn.0001a600
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0xdc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push esi
push dword [ebp - 0xe0]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0xe8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0x124]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push dword [ebp - 0xf4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
inc dword [ebp - 0xe4]
add dword [ebp - 0xf8], 0x10
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0xe4]
cmp ecx, dword [eax]
jb 0x13f7e
push esi
push dword [ebp - 0x118]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x128]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0xfc]
call fcn.0001d01e
push dword [ebp - 0xfc]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push esi
push dword [ebp - 0xd8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0xd0]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [ebp - 0xc0]
jmp 0x146cb
mov ecx, dword [ebp - 0xd0]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [ebx], esi
jmp 0x146cd
cmp ecx, 0x8899e824
je 0x146a3
cmp ecx, 0x8899e828
je 0x1466b
cmp ecx, 0x8899e82c
je 0x1464d
cmp ecx, 0x8899e830
je 0x14623
cmp ecx, 0x8899e834
je 0x143eb
mov dword [ebx], 0xc000000d
jmp 0x146cd
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 0x30
jb 0x143e0
cmp dword [ebp + 0x14], 0x30
jb 0x143e0
xor edx, edx
mov word [ebp - 0x290], dx
push 0x17
pop ecx
xor eax, eax
lea edi, [ebp - 0x28e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x130], dx
xor eax, eax
lea edi, [ebp - 0x12e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x16c], edx
xor eax, eax
lea edi, [ebp - 0x168]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], 1
push 4
push 0x18
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x22c], ecx
and ecx, 0x5f2
mov dword [ebp - 0x154], ecx
mov ecx, dword [eax + 8]
xor edi, edi
cmp ecx, edi
je 0x144c0
lea eax, [ebp - 0x130]
push eax
push ecx
push 1
call fcn.0001e240
mov dword [ebx], eax
cmp eax, edi
jge 0x14491
or dword [ebp - 4], 0xffffffff
jmp 0x146cd
mov dword [ebp - 0x16c], 0x18
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x164], eax
jmp 0x144e5
mov dword [ebp - 0x16c], 0x18
mov eax, dword [eax + 4]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x158], edi
or dword [ebp - 4], 0xffffffff
mov word [ebp - 0x290], 8
mov word [ebp - 0x28e], 0x60
mov word [ebp - 0x26a], 7
mov dword [ebp - 0x25c], 1
mov dword [ebp - 0x270], 0x204000
lea eax, [esi + 8]
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x254], eax
mov byte [ebp - 0x247], 1
mov byte [ebp - 0x240], 0
lea eax, [ebp - 0xbc]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x80
push edi
push edi
push edi
lea eax, [ebp - 0x16c]
push eax
call fcn.0001de1c
cmp dword [ebp - 0x28c], 0xbeaa0251
je 0x14599
cmp eax, edi
jl 0x145a1
push dword [ebp - 0x194]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebx], 0xc0000024
jmp 0x145a1
mov eax, dword [ebp - 0x284]
mov dword [ebx], eax
cmp dword [ebp - 0x12c], edi
je 0x145b6
push edi
push dword [ebp - 0x12c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, dword [ebp - 0xc8]
je 0x145cf
push 0xc
pop ecx
mov esi, dword [ebp - 0xf0]
mov edi, dword [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0x30
jmp 0x146cd
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 4
jb 0x143e0
mov dword [ebp - 0x1bc], esi
lea eax, [ebp - 0x1bc]
push eax
call fcn.00012ed0
jmp 0x146cb
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 4
jb 0x143e0
push esi
call fcn.00012fd6
jmp 0x146cb
cmp byte [0x1f3eb], 0
jne 0x139db
push 0xc
pop edi
cmp edx, edi
jb 0x143e0
cmp dword [ebp + 0x14], edi
jb 0x143e0
push esi
call fcn.00012f3a
mov dword [ebx], eax
test eax, eax
jl 0x1469d
mov dword [ebx + 4], edi
jmp 0x146cd
and dword [ebx + 4], 0
jmp 0x146cd
cmp byte [0x1f3eb], 0
jne 0x139db
cmp edx, 4
jb 0x143e0
mov dword [ebp - 0x198], esi
lea eax, [ebp - 0x198]
push eax
call fcn.00012e4a
mov dword [ebx], eax
mov ecx, dword [ebp + 0x18]
cmp ecx, 0x88992888
jb 0x14714
cmp ecx, 0x8899288c
ja 0x14714
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov eax, dword [0x1f458]
cmp eax, dword [edx]
jbe 0x14714
cmp dword [0x1f3e0], 0
je 0x14714
mov edx, dword [0x1f3e4]
xchg dword [eax], edx
mov dword [0x1f3e4], edx
xor edx, edx
mov esi, 0x1f3e0
xor eax, eax
inc eax
lock cmpxchg dword [esi], edx
cmp ecx, 0x8899e800
jb 0x14728
cmp ecx, 0x8899e834
ja 0x14728
or byte [ebx + 3], 0x20
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x1c]
call fcn.000195d3
call fcn.0001962b
ret 0x1c