Function at 0x1400097c0
Capabilities:
Link many functions at runtime
Load ntoskrnl
Resolve ntoskrnl gadgets

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140122218]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [0x1400f9758]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov rdi, rax
test rax, rax
jne 0x140009805
mov ebx, esi
jmp 0x140009833
lea rdx, str.PsGetProcessId
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000982a
mov rcx, qword [0x140231940]
sub rcx, rdi
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140231920]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea r8, [rbx + 3]
mov r9d, 4
mov qword [rsp + 0x20], 2
lea rdx, [rbp - 9]
mov dword [rbp - 9], esi
mov qword [rbp - 1], rsi
call fcn.140009210
cmp qword [rbp - 1], 4
jne 0x140009c1f
mov eax, dword [rbp - 9]
mov dword [0x14023191c], eax
test eax, eax
je 0x140009c25
lea rcx, [0x1400f9758]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x14000989c
mov rbx, rsi
jmp 0x1400098ca
lea rdx, str.PsGetProcessExitProcessCalled
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400098c1
mov rcx, qword [0x140231940]
sub rcx, rdi
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140231920]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea r8, [rbx + 2]
mov r9d, 4
mov qword [rsp + 0x20], 2
lea rdx, [rbp - 9]
mov dword [rbp - 9], esi
mov qword [rbp - 1], rsi
call fcn.140009210
cmp qword [rbp - 1], 4
jne 0x140009c17
mov eax, dword [rbp - 9]
mov dword [0x14023190c], eax
test eax, eax
je 0x140009c25
lea rcx, [0x1400f9758]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x140009933
mov rbx, rsi
jmp 0x140009961
lea rdx, str.PsGetProcessImageFileName
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140009958
mov rcx, qword [0x140231940]
sub rcx, rdi
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140231920]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea r8, [rbx + 3]
mov r9d, 4
mov qword [rsp + 0x20], 2
lea rdx, [rbp - 9]
mov dword [rbp - 9], esi
mov qword [rbp - 1], rsi
call fcn.140009210
cmp qword [rbp - 1], 4
jne 0x140009c0f
mov eax, dword [rbp - 9]
mov dword [0x140231918], eax
test eax, eax
je 0x140009c25
lea rcx, [0x1400f9758]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x1400099ca
mov rbx, rsi
jmp 0x1400099f8
lea rdx, str.PsGetProcessSectionBaseAddress
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400099ef
mov rcx, qword [0x140231940]
sub rcx, rdi
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140231920]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea r8, [rbx + 3]
mov r9d, 4
mov qword [rsp + 0x20], 2
lea rdx, [rbp - 9]
mov dword [rbp - 9], esi
mov qword [rbp - 1], rsi
call fcn.140009210
cmp qword [rbp - 1], 4
jne 0x140009c07
mov eax, dword [rbp - 9]
mov dword [0x140231908], eax
test eax, eax
je 0x140009c25
lea rcx, [0x1400f9758]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x140009a61
mov rbx, rsi
jmp 0x140009a8f
lea rdx, str.PsGetProcessPeb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140009a86
mov rcx, qword [0x140231940]
sub rcx, rdi
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140231920]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea r8, [rbx + 3]
mov r9d, 4
mov qword [rsp + 0x20], 2
lea rdx, [rbp - 9]
mov dword [rbp - 9], esi
mov qword [rbp - 1], rsi
call fcn.140009210
cmp qword [rbp - 1], 4
jne 0x140009bff
mov eax, dword [rbp - 9]
mov dword [0x140231950], eax
test eax, eax
je 0x140009c25
lea rcx, [0x1400f9758]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x140009af8
mov rbx, rsi
jmp 0x140009b26
lea rdx, str.PsGetProcessWow64Process
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140009b1d
mov rcx, qword [0x140231940]
sub rcx, rdi
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140231920]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea r8, [rbx + 3]
mov r9d, 4
mov qword [rsp + 0x20], 2
lea rdx, [rbp - 9]
mov dword [rbp - 9], esi
mov qword [rbp - 1], rsi
call fcn.140009210
cmp qword [rbp - 1], 4
jne 0x140009bf7
mov eax, dword [rbp - 9]
mov dword [0x140231954], eax
test eax, eax
je 0x140009c25
lea rcx, [0x1400f9758]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x140009b8f
mov rbx, rsi
jmp 0x140009bbd
lea rdx, str.PsReferencePrimaryToken
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140009bb4
mov rax, qword [0x140231940]
sub rax, rdi
add rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x140231920]
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 7]
mov r9d, 0x40
mov qword [rsp + 0x20], 2
mov r8, rbx
mov qword [rbp - 1], rsi
call fcn.140009210
cmp qword [rbp - 1], 0x40
jne 0x140009c25
mov al, 1
jmp 0x140009c27
mov dword [0x140231954], esi
jmp 0x140009c25
mov dword [0x140231950], esi
jmp 0x140009c25
mov dword [0x140231908], esi
jmp 0x140009c25
mov dword [0x140231918], esi
jmp 0x140009c25
mov dword [0x14023190c], esi
jmp 0x140009c25
mov dword [0x14023191c], esi
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c17f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret