Function at 0x1400068a0
Capabilities:
Execute anti-debugging instructions
Execute command
Link many functions at runtime
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r8
lea rsi, [0x140016160]
mov r15, rdx
mov rbp, rcx
mov r8, rsi
lea rdx, [section..data]
lea rcx, str.___.LDATA:__16llx_____16llx__n
call fcn.14000c800
lea rdi, [0x1400013ac]
mov r8, rdi
lea rdx, section..text
lea rcx, str.___.LTEXT:__16llx_____16llx__n
call fcn.14000c800
lea rbx, [section..data]
and rsi, 0xfffffffffffff000
and rbx, 0xfffffffffffff000
cmp rbx, rsi
ja 0x14000697b
nop dword [rax]
mov ecx, 0x1000
call fcn.140008310
test eax, eax
je 0x140006a51
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
jne 0x14000695c
mov ecx, 0x2000
call fcn.140008310
test eax, eax
je 0x140006a51
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x140006a51
lea rdx, [section..data]
lea rcx, str.___Locked__16llx_successfully__n
call fcn.14000c800
add rbx, 0x1000
cmp rbx, rsi
jbe 0x140006910
lea rbx, section..text
and rdi, 0xfffffffffffff000
and rbx, 0xfffffffffffff000
cmp rbx, rdi
ja 0x1400069fc
mov ecx, 0x1000
call fcn.140008310
test eax, eax
je 0x140006a51
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
jne 0x1400069dd
mov ecx, 0x2000
call fcn.140008310
test eax, eax
je 0x140006a51
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x140006a51
lea rdx, section..text
lea rcx, str.___Locked__16llx_successfully__n
call fcn.14000c800
add rbx, 0x1000
cmp rbx, rdi
jbe 0x140006995
call fcn.1400066c0
mov rdi, rax
call fcn.1400044d0
mov rsi, rax
test rax, rax
jne 0x140006a9e
mov ecx, 0xfffffff5
lea ebx, [rax + 0xc]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n______________Assert_Failed:_CpCtx_______________n_n
call fcn.14000c800
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Failed_locking__16llx__n
mov rdx, rbx
call fcn.14000c800
mov ecx, 0xfffffff5
mov ebx, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n______________Assert_Failed:_Np_LockSections_________________n_n
call fcn.14000c800
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test rdi, rdi
jne 0x140006adf
mov ecx, 0xfffffff5
lea ebx, [rdi + 0xc]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str._n______________Assert_Failed:_KrCtx_______________n_n
call fcn.14000c800
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x88], r12
xor r12d, r12d
cmp qword [0x140016050], r12
jne 0x140006bd3
xor ecx, ecx
mov eax, 7
cpuid
test bl, bl
js 0x140006b2e
lea rcx, str.___No_SMEP_support__n
call fcn.14000c800
movabs rax, 0x9090909090909090
mov qword [0x140016010], rax
mov word [0x140016018], ax
mov byte [0x14001601a], al
mov rcx, qword [rdi]
lea rdx, str.ExAllocatePool
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140006b4b
mov rax, r12
jmp 0x140006b55
sub rcx, qword [rdi]
mov rax, qword [rdi + 8]
add rax, rcx
mov qword [0x140016058], rax
lea rax, [fcn.140001370]
mov qword [rsi + 0x17], rax
rdtsc
shl rdx, 0x20
or rax, rdx
jne 0x140006b79
xor ecx, ecx
call fcn.140001370
mov rcx, qword [rsi + 0x21]
lea rax, [rsi + 8]
mov qword [rsi], rax
mov r9d, 8
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov r8, rsi
lea rax, [rsp + 0x98]
mov dword [rsp + 0x28], 4
mov edx, 0xaa013044
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], r12d
mov dword [rsp + 0x80], r12d
mov qword [rsi + 0xa], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, str.___Mapping_physical_memory_to_user_mode__n
call fcn.14000c800
mov rax, qword gs:[0x58]
mov ecx, dword [0x140019450]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x1400193f8], eax
jg 0x140006e84
mov eax, dword [rbx]
cmp dword [0x1400193fc], eax
jg 0x140006edc
mov eax, dword [rbx]
cmp dword [0x140019400], eax
jg 0x140006f34
mov eax, dword [rbx]
cmp dword [0x140019404], eax
jg 0x140006f8c
mov eax, dword [rbx]
cmp dword [0x140019408], eax
jg 0x140006fe4
mov eax, dword [rbx]
cmp dword [0x14001940c], eax
jg 0x14000703c
mov eax, dword [rbx]
cmp dword [0x140019410], eax
jg 0x140007094
lea rax, str.DevicePhysicalMemory
mov dword [0x140016140], 0x2e002c
mov qword [0x140016148], rax
xorps xmm0, xmm0
lea rax, [0x140016140]
mov dword [0x140016110], 0x30
mov qword [0x140016120], rax
lea rax, [fcn.140001020]
mov dword [0x140016128], 0x240
mov qword [0x140016118], r12
movdqu xmmword [0x140016130], xmm0
mov qword [rsi + 0x17], rax
rdtsc
shl rdx, 0x20
or rax, rdx
jne 0x140006cc5
xor ecx, ecx
call fcn.140001020
mov rcx, qword [rsi + 0x21]
lea rax, [rsi + 8]
mov qword [rsi], rax
mov r9d, 8
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov r8, rsi
lea rax, [rsp + 0x98]
mov dword [rsp + 0x28], 4
mov edx, 0xaa013044
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], r12d
mov dword [rsp + 0x80], r12d
mov qword [rsi + 0xa], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp qword [0x140016088], 0
mov r12, qword [rsp + 0x88]
jne 0x140006d3b
mov dword [0x1400160a0], 1
cmp qword [0x140016090], 0
jne 0x140006d4f
mov dword [0x1400160a0], 2
mov rdx, qword [0x140016060]
lea rcx, str.___PhysicalMemoryBegin:__16llx_n
call fcn.14000c800
mov rdx, qword [0x140016068]
lea rcx, str.___PhysicalMemorySize:___16llx_n
call fcn.14000c800
mov rdx, qword [0x140016078]
lea rcx, str.___CurrentProcessCr3:____16llx_n
call fcn.14000c800
mov rdx, qword [0x140016080]
lea rcx, str.___CurrentEProcess:______16llx_n
call fcn.14000c800
mov rdx, qword [0x140016090]
lea rcx, str.___DirectoryTableBase____16llx_n
call fcn.14000c800
mov rdx, qword [0x140016088]
lea rcx, str.___UniqueProcessId_______16llx_n
call fcn.14000c800
mov rdx, qword [0x140016098]
lea rcx, str.___ActiveProcessLinks____16llx_n
call fcn.14000c800
mov edx, dword [0x1400160a0]
lea rcx, str.___Status:_______________16lx_n
call fcn.14000c800
mov rax, qword [0x140016078]
mov qword [0x140016070], rax
test r15, r15
jne 0x140006e03
mov rcx, rsi
call fcn.1400042c0
jmp 0x140006e06
mov qword [r15], rsi
test r14, r14
jne 0x140006e19
lea edx, [r14 + 0x10]
mov rcx, rdi
call fcn.14000cb60
jmp 0x140006e1c
mov qword [r14], rdi
movaps xmm0, xmmword [0x140016060]
mov rax, rbp
movaps xmm1, xmmword [0x140016070]
mov rbx, qword [rsp + 0x90]
movups xmmword [rbp], xmm0
movaps xmm0, xmmword [0x140016080]
movups xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [0x140016090]
movups xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [0x1400160a0]
movups xmmword [rbp + 0x30], xmm1
movsd qword [rbp + 0x40], xmm0
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140019410]
mov qword [0x1400160d8], rax
call fcn.14000cb68
jmp 0x140006c5c
lea rcx, [0x1400193f8]
call fcn.14000cbd4
cmp dword [0x1400193f8], 0xffffffff
jne 0x140006c08
mov rcx, qword [rdi]
lea rdx, str.ZwOpenSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140006eba
mov rax, r12
jmp 0x140006ec4
sub rcx, qword [rdi]
mov rax, qword [rdi + 8]
add rax, rcx
lea rcx, [0x1400193f8]
mov qword [0x1400160a8], rax
call fcn.14000cb68
jmp 0x140006c08
lea rcx, [0x1400193fc]
call fcn.14000cbd4
cmp dword [0x1400193fc], 0xffffffff
jne 0x140006c16
mov rcx, qword [rdi]
lea rdx, str.ZwMapViewOfSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140006f12
mov rax, r12
jmp 0x140006f1c
sub rcx, qword [rdi]
mov rax, qword [rdi + 8]
add rax, rcx
lea rcx, [0x1400193fc]
mov qword [0x1400160b0], rax
call fcn.14000cb68
jmp 0x140006c16
lea rcx, [0x140019400]
call fcn.14000cbd4
cmp dword [0x140019400], 0xffffffff
jne 0x140006c24
mov rcx, qword [rdi]
lea rdx, str.ZwClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140006f6a
mov rax, r12
jmp 0x140006f74
sub rcx, qword [rdi]
mov rax, qword [rdi + 8]
add rax, rcx
lea rcx, [0x140019400]
mov qword [0x1400160b8], rax
call fcn.14000cb68
jmp 0x140006c24
lea rcx, [0x140019404]
call fcn.14000cbd4
cmp dword [0x140019404], 0xffffffff
jne 0x140006c32
mov rcx, qword [rdi]
lea rdx, str.PsGetCurrentProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140006fc2
mov rax, r12
jmp 0x140006fcc
sub rcx, qword [rdi]
mov rax, qword [rdi + 8]
add rax, rcx
lea rcx, [0x140019404]
mov qword [0x1400160c0], rax
call fcn.14000cb68
jmp 0x140006c32
lea rcx, [0x140019408]
call fcn.14000cbd4
cmp dword [0x140019408], 0xffffffff
jne 0x140006c40
mov rcx, qword [rdi]
lea rdx, str.PsGetCurrentProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14000701a
mov rax, r12
jmp 0x140007024
sub rcx, qword [rdi]
mov rax, qword [rdi + 8]
add rax, rcx
lea rcx, [0x140019408]
mov qword [0x1400160c8], rax
call fcn.14000cb68
jmp 0x140006c40
lea rcx, [0x14001940c]
call fcn.14000cbd4
cmp dword [0x14001940c], 0xffffffff
jne 0x140006c4e
mov rcx, qword [rdi]
lea rdx, str.PsGetProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x140007072
mov rax, r12
jmp 0x14000707c
sub rcx, qword [rdi]
mov rax, qword [rdi + 8]
add rax, rcx
lea rcx, [0x14001940c]
mov qword [0x1400160d0], rax
call fcn.14000cb68
jmp 0x140006c4e
lea rcx, [0x140019410]
call fcn.14000cbd4
cmp dword [0x140019410], 0xffffffff
jne 0x140006c5c
mov rcx, qword [rdi]
lea rdx, str.MmGetPhysicalMemoryRanges
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x1400070cd
mov rax, r12
jmp 0x140006e6c
mov rax, qword [rdi + 8]
sub rax, qword [rdi]
add rax, rcx
jmp 0x140006e6c