Function at 0x40aaa0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x638
mov rax, qword [0x00415400]
mov qword [rsp + 0x628], rax
mov qword [rsp + 0x5b0], 0
mov word [rsp + 0x5a0], 0
lea rax, [rsp + 0x5a2]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x598], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0xc8]
mov rdi, rax
xor eax, eax
mov ecx, 0x4c8
rep stosb byte [rdi], al
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x590], 0
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x5c0]
lea rcx, [0x0040fe20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x5a
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x68]
lea rcx, [0x0040fdf0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x50]
lea rcx, [0x0040fdd0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x650]
mov byte [rax + 0x81], 0x33
mov rax, qword [rsp + 0x650]
mov byte [rax + 0x82], 0xc0
mov rax, qword [rsp + 0x650]
mov byte [rax + 0x83], 0xc3
mov rax, qword [rsp + 0x650]
add rax, 0x84
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call sub.ntoskrnl.exe_PsGetVersion
mov rax, qword [rsp + 0x650]
mov edx, dword [rax + 0x84]
lea rcx, [0x0040fdb0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fd80]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x650]
add rax, 8
mov r8d, 8
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call fcn.0040ceb0
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 8]
lea rcx, [0x0040fd50]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fd20]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x650]
add rax, 0x80
mov r8d, 1
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call fcn.0040ceb0
mov rax, qword [rsp + 0x650]
movsx eax, byte [rax + 0x80]
mov edx, eax
lea rcx, [0x0040fcf0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fcc0]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x138], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x138]
lea rcx, [0x0040fc90]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fc60]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x140], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x140]
lea rcx, [0x0040fc30]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fc00]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x170], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x170]
lea rcx, [0x0040fbd0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fba0]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x178], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x178]
lea rcx, [0x0040fb70]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fb50]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x180], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x180]
lea rcx, [0x0040fb30]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fb00]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x188], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x188]
lea rcx, [0x0040fad0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040faa0]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x190], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x190]
lea rcx, [0x0040fa70]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040e750]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x198], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x198]
lea rcx, [0x0040e730]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040fa40]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x1a0], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x1a0]
lea rcx, [0x0040fa10]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040f9f0]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x1b0], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x1b0]
lea rcx, [0x0040f9d0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040f990]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x1b8], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x1b8]
lea rcx, [0x0040f960]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040f920]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x158], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x158]
lea rcx, [0x0040f8f0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040f8b0]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x160], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x160]
lea rcx, [0x0040f880]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0040f830]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x168], rax
mov rax, qword [rsp + 0x650]
mov rdx, qword [rax + 0x168]
lea rcx, [0x0040f7f0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0xf0], 0x10000b
lea rcx, [rsp + 0xc0]
call sub.ntoskrnl.exe_RtlCaptureContext
mov edx, 0x40000
xor ecx, ecx
call sub.ntoskrnl.exe_ExAllocatePool
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x40b233
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc0]
call sub.ntoskrnl.exe_KeCapturePersistentThreadState
mov rax, qword [rsp + 0xb0]
add rax, 0x2080
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x650]
add rax, 0x1c8
mov r8d, 0x318
mov rdx, qword [rsp + 0xa8]
mov rcx, rax
call fcn.0040ceb0
mov rax, qword [rsp + 0xa8]
add rax, 0x318
mov qword [rsp + 0x590], rax
mov rax, qword [rsp + 0x650]
add rax, 0x4e0
mov r8d, 0x68
mov rdx, qword [rsp + 0x590]
mov rcx, rax
call fcn.0040ceb0
mov rax, qword [rsp + 0x650]
mov rcx, qword [rsp + 0x650]
mov rcx, qword [rcx + 0x210]
mov qword [rax], rcx
mov rax, qword [rsp + 0x650]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x650]
mov rax, qword [rax]
mov qword [rcx + 0x30], rax
mov rax, qword [rsp + 0x650]
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call sub.ntoskrnl.exe_ExFreePoolWithTag
mov rax, qword [rsp + 0x650]
mov word [rax + 0x548], 0x30
mov rax, qword [rsp + 0x650]
mov word [rax + 0x54a], 0x2f8
lea rdx, [0x0040f7b0]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
add rax, 0x1000
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.0040c680
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x40b2d9
mov rax, qword [rsp + 0x98]
movsxd rax, dword [rax + 3]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + rax + 7]
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x10], rax
lea rdx, [0x0040e980]
mov rax, qword [rsp + 0x650]
mov rcx, qword [rax + 0x1e0]
call fcn.0040b8d0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x40b49d
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x650]
add rax, qword [rcx + 0x1e0]
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0x10], ecx
jbe 0x40b347
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x620], eax
jmp 0x40b356
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov dword [rsp + 0x620], eax
mov eax, dword [rsp + 0x620]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x598]
add rcx, rax
mov rax, rcx
lea r8, [rsp + 0x5c0]
mov rdx, rax
mov rcx, qword [rsp + 0x598]
call fcn.0040c680
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x40b49d
mov rax, qword [rsp + 0x98]
movsxd rax, dword [rax + 0x17]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + rax + 0x1b]
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x98]
movsxd rax, dword [rax + 0x1e]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + rax + 0x22]
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x28], rax
mov eax, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x598]
add rcx, rax
mov rax, rcx
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.0040c680
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x40b49d
mov rax, qword [rsp + 0x98]
add rax, 0xa
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0xa0], rax
mov rax, qword [rsp + 0x650]
add rax, 0x98
mov r8d, 6
mov rcx, qword [rsp + 0x650]
mov rdx, qword [rcx + 0xa0]
mov rcx, rax
call fcn.0040ceb0
mov rax, qword [rsp + 0x98]
movsxd rax, dword [rax + 2]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + rax + 2]
mov rcx, qword [rsp + 0x650]
mov qword [rcx + 0x90], rax
lea rdx, [0x0040f780]
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x5a0]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x40b4ea
mov rax, qword [rsp + 0x650]
mov rcx, qword [rsp + 0x98]
mov ecx, dword [rcx + 3]
mov dword [rax + 0x550], ecx
mov rax, qword [rsp + 0x650]
add rax, 0x58
mov rcx, rax
call fcn.00404300
mov rcx, qword [rsp + 0x628]
call fcn.0040d430
add rsp, 0x638
pop rdi
pop rsi
ret