Function at 0x429910
Capabilities:
Link many functions at runtime
Patch event tracing for windows function

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov word [rsp + 0x20], 0
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
cmp dword [0x004c5c84], 0
jbe 0x429959
mov eax, dword [0x004c5c90]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d30], rax
lea rdx, [0x00434fb0]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x42998d
mov eax, 0x80
jmp 0x429f2a
mov rax, qword [rsp + 0x30]
sub rax, 0x20
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [0x004c5cb0], rax
mov eax, dword [0x004c5ca0]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5cf8], rax
mov eax, dword [0x004c5c9c]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d00], rax
mov eax, dword [0x004c5c98]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d08], rax
mov eax, dword [0x004c5c94]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d10], rax
mov eax, dword [0x004c5c90]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d18], rax
mov eax, dword [0x004c5c38]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5dd8], rax
mov eax, dword [0x004c5c80]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d38], rax
mov eax, dword [0x004c5c88]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d28], rax
mov eax, dword [0x004c5c7c]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d40], rax
mov eax, dword [0x004c5c74]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d50], rax
mov eax, dword [0x004c5c70]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d58], rax
mov eax, dword [0x004c5c6c]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d60], rax
mov eax, dword [0x004c5c8c]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d20], rax
mov eax, dword [0x004c5c68]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d68], rax
mov eax, dword [0x004c5c5c]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5de0], rax
mov eax, dword [0x004c5c64]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5e10], rax
mov eax, dword [0x004c5c60]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5e08], rax
mov eax, dword [0x004c5c34]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5db8], rax
mov eax, dword [0x004c5c3c]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5dc8], rax
mov eax, dword [0x004c5c40]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5e00], rax
mov eax, dword [0x004c5c44]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5dc0], rax
mov eax, dword [0x004c5c48]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5df0], rax
mov eax, dword [0x004c5c48]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5df8], rax
mov eax, dword [0x004c5c4c]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5dd0], rax
mov eax, dword [0x004c5c50]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5e18], rax
mov eax, dword [0x004c5c54]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5db0], rax
mov eax, dword [0x004c5c58]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5da8], rax
lea rcx, [0x00434fa0]
call fcn.00424700
mov qword [0x004c5e80], rax
lea rcx, [0x00434f80]
call fcn.00424700
mov qword [0x004c5ca8], rax
lea rcx, [0x00434f70]
call fcn.00424700
mov qword [0x004c5ce0], rax
lea rcx, [0x00434f50]
call fcn.00424700
mov qword [0x004c5cc8], rax
lea rcx, [0x00434f30]
call fcn.00424700
mov qword [0x004c5cd0], rax
lea rcx, [0x00433fe0]
call fcn.00424700
mov qword [0x004c5e20], rax
lea rcx, [0x00434040]
call fcn.00424700
mov qword [0x004c5cf0], rax
lea rcx, [0x00434030]
call fcn.00424700
mov qword [0x004c5ce8], rax
lea rcx, [0x00434f10]
call fcn.00424700
mov qword [0x004c5cc0], rax
lea rcx, [0x00434010]
call fcn.00424700
mov qword [0x004c5de8], rax
lea rcx, [0x00434060]
call fcn.00424700
mov qword [0x004c5d98], rax
lea rcx, [0x00434f00]
call fcn.00424700
mov qword [0x004c5cd8], rax
lea rcx, [0x00434ee0]
call fcn.00424700
mov qword [0x004c5e78], rax
lea rcx, [0x00434ec0]
call fcn.00424700
mov qword [0x004c5cb8], rax
lea rdx, [0x00434e90]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e90], rax
lea rdx, [0x00434e60]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e88], rax
lea rdx, [0x00434e20]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e28], rax
lea rdx, [0x00434df0]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e30], rax
lea rdx, [0x00434de0]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e38], rax
lea rdx, [0x00434db0]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e40], rax
lea rdx, [0x00434d70]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e48], rax
lea rcx, [0x00434d60]
call fcn.00424700
mov qword [0x004c5e50], rax
lea rdx, [0x00434d20]
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_RtlInitUnicodeString
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_MmGetSystemRoutineAddress
mov qword [0x004c5e58], rax
lea rcx, [0x00434d00]
call fcn.00424700
mov qword [0x004c5e60], rax
lea rcx, [0x00434ce0]
call fcn.00424700
mov qword [0x004c5e68], rax
lea rcx, [0x00434cc0]
call fcn.00424700
mov qword [0x004c5e70], rax
lea rcx, [0x00434cb0]
call fcn.00424700
mov qword [0x004c5da0], rax
lea rcx, [0x00434ca0]
call fcn.00424700
mov qword [0x004c5d90], rax
lea rcx, [0x00433fd0]
call fcn.00424700
mov qword [0x004c5d88], rax
lea rcx, [0x00434050]
call fcn.00424700
mov qword [0x004c5d70], rax
lea rcx, [0x00434c80]
call fcn.00424700
mov qword [0x004c5d78], rax
mov eax, dword [0x004c5ca4]
and eax, 0xfff
mov ecx, eax
call fcn.00425280
mov qword [0x004c5d80], rax
xor eax, eax
add rsp, 0x40
pop rdi
ret