Function at 0x1bac0
Capabilities:
Get file attributes
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x248
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x78], 0xffffffffff000000
mov qword [rsp + 0x68], 0x800000
lea rcx, [0x00025600]
call sub.ntoskrnl.exe_DbgPrint
mov edx, dword [0x0002d47c]
lea rcx, [0x00025610]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [0x0002d47c], 0
jne 0x1cb76
lea rcx, [0x00025630]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x400000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [0x00030470], rax
cmp qword [0x00030470], 0
je 0x1cb6a
mov rcx, qword [0x00030470]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [0x00030480], rax
mov rcx, qword [0x00030470]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r8, rax
mov rdx, qword [0x00030470]
lea rcx, [0x00025660]
call sub.ntoskrnl.exe_DbgPrint
mov rdi, qword [0x00030470]
xor eax, eax
mov ecx, 0x400000
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x260]
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xd8], 0
lea rax, [rsp + 0xf8]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xa0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0xc0]
mov edx, 0x120000
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0xf0], eax
cmp dword [rsp + 0xf0], 0
jne 0x1bc7b
lea rcx, [rsp + 0xf8]
call fcn.00022290
mov dword [rsp + 0xf0], eax
cmp dword [rsp + 0xf0], 0
jne 0x1cb4d
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp qword [rsp + 0x110], 0x400000
jle 0x1bcd4
lea rcx, [0x000256b0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1d42f
mov qword [rsp + 0x128], 8
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x128]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
lea rax, [rsp + 0x120]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0x130], eax
cmp dword [rsp + 0x130], 0x103
jne 0x1bd6a
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
test eax, eax
je 0x1bd6a
lea rcx, [0x000256e0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1d42f
cmp dword [rsp + 0xb0], 0
jne 0x1cb3d
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x134], eax
movzx r8d, word [rsp + 0x120]
imul r8d, r8d, 0x200
movzx edx, word [rsp + 0x120]
lea rcx, [0x000256f0]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, word [rsp + 0x120]
imul eax, eax, 0x200
cdqe
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x128]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x134]
mov dword [rsp + 0x30], eax
mov rax, qword [0x00030470]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0x130], eax
cmp dword [rsp + 0x130], 0x103
jne 0x1be39
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov eax, dword [rsp + 0x134]
add eax, 0x1000
mov eax, eax
and rax, 0xfffffffffffff000
mov dword [rsp + 0x134], eax
mov edx, dword [rsp + 0x134]
lea rcx, [0x00025720]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0xb0], 0
jne 0x1cb3d
mov ecx, dword [rsp + 0x134]
mov rax, qword [0x00030470]
lea rax, [rax + rcx + 0x1000]
mov qword [rsp + 0x158], rax
mov ecx, dword [rsp + 0x134]
mov rax, qword [0x00030470]
lea rax, [rax + rcx + 0x2000]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x138]
add rax, 0x1000
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x138]
add rax, 0x2000
mov qword [rsp + 0x140], rax
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r8, rax
mov rdx, qword [rsp + 0x138]
lea rcx, [0x00025730]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [0x00030498], rax
lea rcx, [0x00025760]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1c0], rax
mov rcx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x1c0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x148]
movzx ecx, byte [rax]
or cl, 1
mov rax, qword [rsp + 0x148]
mov byte [rax], cl
mov rax, qword [rsp + 0x148]
movzx ecx, byte [rax]
or cl, 2
mov rax, qword [rsp + 0x148]
mov byte [rax], cl
mov rdx, qword [rsp + 0x148]
mov rdx, qword [rdx]
lea rcx, reloc.ntoskrnl.exe_KeInsertQueueApc
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1c8], rax
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x1c8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x150]
movzx ecx, byte [rax]
or cl, 1
mov rax, qword [rsp + 0x150]
mov byte [rax], cl
mov rax, qword [rsp + 0x150]
movzx ecx, byte [rax]
or cl, 2
mov rax, qword [rsp + 0x150]
mov byte [rax], cl
mov rdx, qword [rsp + 0x150]
mov rdx, qword [rdx]
lea rcx, [0x000257b0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rsp + 0x140]
mov qword [rdx], 0
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
or ecx, 1
mov rax, qword [rsp + 0x140]
mov dword [rax], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
or ecx, 4
mov rax, qword [rsp + 0x140]
mov dword [rax], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
and ecx, 0xfffffffd
mov rax, qword [rsp + 0x140]
mov dword [rax], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax]
or ecx, 0x80
mov rax, qword [rsp + 0x140]
mov dword [rax], ecx
mov rdx, qword [rsp + 0x140]
mov rdx, qword [rdx]
lea rcx, [0x000257d0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rsp + 0x140]
mov qword [rdx + 8], 0x200000
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 8]
or ecx, 1
mov rax, qword [rsp + 0x140]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 8]
or ecx, 4
mov rax, qword [rsp + 0x140]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 8]
and ecx, 0xfffffffd
mov rax, qword [rsp + 0x140]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 8]
or ecx, 0x80
mov rax, qword [rsp + 0x140]
mov dword [rax + 8], ecx
mov rdx, qword [rsp + 0x140]
mov rdx, qword [rdx + 8]
lea rcx, [0x000257f0]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1d0], rax
mov rcx, qword [rsp + 0x140]
mov rax, qword [rsp + 0x1d0]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 0x10]
or ecx, 1
mov rax, qword [rsp + 0x140]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 0x10]
or ecx, 2
mov rax, qword [rsp + 0x140]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 0x10]
and ecx, 0xffffff7f
mov rax, qword [rsp + 0x140]
mov dword [rax + 0x10], ecx
mov rdx, qword [rsp + 0x140]
mov rdx, qword [rdx + 0x10]
lea rcx, [0x00025810]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x160], 0
jmp 0x1c1fa
mov eax, dword [rsp + 0x160]
add eax, 1
mov dword [rsp + 0x160], eax
cmp dword [rsp + 0x160], 0x200
jge 0x1c2a5
mov eax, dword [rsp + 0x160]
imul eax, eax, 0x1000
cdqe
mov rcx, qword [0x00030470]
add rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1d8], rax
movsxd rdx, dword [rsp + 0x160]
mov rcx, qword [rsp + 0x168]
mov rax, qword [rsp + 0x1d8]
mov qword [rcx + rdx*8], rax
movsxd rcx, dword [rsp + 0x160]
mov rax, qword [rsp + 0x168]
mov edx, dword [rax + rcx*8]
or edx, 1
movsxd rcx, dword [rsp + 0x160]
mov rax, qword [rsp + 0x168]
mov dword [rax + rcx*8], edx
movsxd rcx, dword [rsp + 0x160]
mov rax, qword [rsp + 0x168]
mov edx, dword [rax + rcx*8]
or edx, 2
movsxd rcx, dword [rsp + 0x160]
mov rax, qword [rsp + 0x168]
mov dword [rax + rcx*8], edx
jmp 0x1c1e9
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x178], rax
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1e0], rax
mov rcx, qword [rsp + 0x140]
mov rax, qword [rsp + 0x1e0]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 0x18]
or ecx, 1
mov rax, qword [rsp + 0x140]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 0x18]
or ecx, 2
mov rax, qword [rsp + 0x140]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x140]
mov ecx, dword [rax + 0x18]
and ecx, 0xffffff7f
mov rax, qword [rsp + 0x140]
mov dword [rax + 0x18], ecx
mov rdx, qword [rsp + 0x140]
mov rdx, qword [rdx + 0x18]
lea rcx, [0x00025830]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x170], 0
jmp 0x1c368
mov eax, dword [rsp + 0x170]
add eax, 1
mov dword [rsp + 0x170], eax
cmp dword [rsp + 0x170], 0x200
jge 0x1c419
mov eax, dword [rsp + 0x170]
imul eax, eax, 0x1000
movsxd rcx, eax
mov rax, qword [0x00030470]
lea rcx, [rax + rcx + 0x200000]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1e8], rax
movsxd rdx, dword [rsp + 0x170]
mov rcx, qword [rsp + 0x178]
mov rax, qword [rsp + 0x1e8]
mov qword [rcx + rdx*8], rax
movsxd rcx, dword [rsp + 0x170]
mov rax, qword [rsp + 0x178]
mov edx, dword [rax + rcx*8]
or edx, 1
movsxd rcx, dword [rsp + 0x170]
mov rax, qword [rsp + 0x178]
mov dword [rax + rcx*8], edx
movsxd rcx, dword [rsp + 0x170]
mov rax, qword [rsp + 0x178]
mov edx, dword [rax + rcx*8]
or edx, 2
movsxd rcx, dword [rsp + 0x170]
mov rax, qword [rsp + 0x178]
mov dword [rax + rcx*8], edx
jmp 0x1c357
mov rax, qword [rsp + 0x158]
mov qword [rax], 0
mov rcx, qword [rsp + 0x158]
movabs rax, 0xcf92000000ffff
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x158]
movabs rax, 0xcf96000000ffff
mov qword [rcx + 0x10], rax
mov rcx, qword [rsp + 0x158]
movabs rax, 0xcf9b000000ffff
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x158]
movabs rax, 0x9a000000ffff
mov qword [rcx + 0x20], rax
mov rcx, qword [rsp + 0x158]
movabs rax, 0x92000000ffff
mov qword [rcx + 0x28], rax
mov rcx, qword [rsp + 0x158]
movabs rax, 0x9a030000ffff
mov qword [rcx + 0x30], rax
mov rax, qword [rsp + 0x158]
mov qword [rax + 0x38], 0
mov rax, qword [rsp + 0x158]
mov qword [rax + 0x40], 0
mov rax, qword [rsp + 0x158]
mov qword [rax + 0x48], 0
mov rcx, qword [rsp + 0x158]
movabs rax, 0xa09e0000000000
mov qword [rcx + 0x50], rax
mov rax, qword [rsp + 0x158]
mov qword [rax + 0x58], 0
mov rax, qword [rsp + 0x158]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x158]
mov qword [rax + 0x68], 0
mov eax, 0x6f
mov word [0x000304a0], ax
mov eax, dword [rsp + 0x134]
add eax, 0x401000
mov eax, eax
mov qword [0x000304a2], rax
lea r9, [0x000304a2]
lea r8, [0x000304a0]
lea rdx, [0x000304a0]
lea rcx, [0x00025850]
call sub.ntoskrnl.exe_DbgPrint
movzx edx, word [0x000304a0]
lea rcx, [0x000258a0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [0x000304a2]
lea rcx, [0x000258c0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x000304a0]
mov qword [0x00030490], rdx
mov qword [rsp + 0x78], 0x3fffff
mov rdx, qword [rsp + 0x78]
lea rcx, [0x000258e0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rsp + 0x78]
mov ecx, 0x1000
call qword [sym.imp.ntoskrnl.exe_MmAllocateContiguousMemory]
mov qword [0x00030450], rax
cmp qword [0x00030450], 0
je 0x1c748
lea rax, [0x00022bb0]
mov qword [rsp + 0x180], rax
mov rdi, qword [0x00030450]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rcx, [0x00022bb0]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1f0], rax
mov r8, qword [rsp + 0x1f0]
lea rdx, [0x00022bb0]
lea rcx, [0x00025910]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x00030450]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x1f8], rax
mov r8, qword [rsp + 0x1f8]
mov rdx, qword [0x00030450]
lea rcx, [0x00025940]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x00025970]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x70], 0
cmp dword [rsp + 0x70], 0x1000
jge 0x1c714
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x180]
movzx eax, byte [rax + rcx]
cmp eax, 0xce
jne 0x1c704
mov eax, dword [rsp + 0x70]
add eax, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x180]
movzx eax, byte [rax + rcx]
cmp eax, 0xce
jne 0x1c704
mov eax, dword [rsp + 0x70]
add eax, 2
movsxd rcx, eax
mov rax, qword [rsp + 0x180]
movzx eax, byte [rax + rcx]
cmp eax, 0xce
jne 0x1c704
mov eax, dword [rsp + 0x70]
add eax, 3
movsxd rcx, eax
mov rax, qword [rsp + 0x180]
movzx eax, byte [rax + rcx]
cmp eax, 0xce
jne 0x1c704
mov eax, dword [rsp + 0x70]
add eax, 4
movsxd rcx, eax
mov rax, qword [rsp + 0x180]
movzx eax, byte [rax + rcx]
cmp eax, 0xce
je 0x1c714
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
jmp 0x1c66a
mov edx, dword [rsp + 0x70]
lea rcx, [0x00025990]
call sub.ntoskrnl.exe_DbgPrint
movsxd rcx, dword [rsp + 0x70]
mov rdi, qword [0x00030450]
mov rsi, qword [rsp + 0x180]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x000259a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1c759
lea rcx, [0x000259b0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1d42f
lea rcx, [0x000259d0]
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x78], 0xffffffffffff0000
mov edx, 0x4000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [0x00030460], rax
cmp qword [0x00030460], 0
jne 0x1c7a6
lea rcx, [0x00025a00]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1d42f
mov rdi, qword [0x00030460]
xor eax, eax
mov ecx, 0x4000
rep stosb byte [rdi], al
mov rcx, qword [0x00030460]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x200], rax
mov r8, qword [rsp + 0x200]
mov rdx, qword [0x00030460]
lea rcx, [0x00025a20]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x00030460]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [0x00030488], rax
lea rcx, [0x00025a50]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [0x00030460]
mov qword [rsp + 0x1a0], rax
mov rax, qword [0x00030460]
add rax, 0x1000
mov qword [rsp + 0x198], rax
mov rax, qword [0x00030460]
add rax, 0x2000
mov qword [rsp + 0x188], rax
mov rax, qword [0x00030460]
add rax, 0x3000
mov qword [rsp + 0x190], rax
lea rcx, [0x00025a80]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x70], 0
jmp 0x1c885
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x200
jge 0x1ca07
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x210], rax
movsxd rdx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x1a0]
mov rax, qword [rsp + 0x210]
mov qword [rcx + rdx*8], rax
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x1a0]
movzx edx, byte [rax + rcx*8]
or dl, 1
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x1a0]
mov byte [rax + rcx*8], dl
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x218], rax
movsxd rdx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x198]
mov rax, qword [rsp + 0x218]
mov qword [rcx + rdx*8], rax
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x198]
movzx edx, byte [rax + rcx*8]
or dl, 1
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x198]
mov byte [rax + rcx*8], dl
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x220], rax
movsxd rdx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x188]
mov rax, qword [rsp + 0x220]
mov qword [rcx + rdx*8], rax
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x188]
mov edx, dword [rax + rcx*8]
or edx, 1
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x188]
mov dword [rax + rcx*8], edx
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x188]
mov edx, dword [rax + rcx*8]
and edx, 0xffffff7f
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x188]
mov dword [rax + rcx*8], edx
mov rcx, qword [0x00030450]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x228], rax
movsxd rdx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x228]
mov qword [rcx + rdx*8], rax
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x190]
mov edx, dword [rax + rcx*8]
or edx, 1
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x190]
mov dword [rax + rcx*8], edx
jmp 0x1c87a
lea rcx, [0x00025a90]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x00030450]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x230]
mov qword [0x00030458], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x78], 0xfffffffffffff000
mov qword [rsp + 0x68], 0
xor eax, eax
cmp eax, 1
je 0x1ca72
mov rdx, qword [rsp + 0x78]
mov ecx, 0x1000
call qword [sym.imp.ntoskrnl.exe_MmAllocateContiguousMemory]
mov qword [0x00030478], rax
jmp 0x1ca89
mov rdx, qword [rsp + 0x78]
mov ecx, 0x140
call qword [sym.imp.ntoskrnl.exe_MmAllocateContiguousMemory]
mov qword [0x00030478], rax
mov rdi, qword [0x00030478]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
mov rcx, qword [0x00030478]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
mov qword [0x00030468], rax
mov rdx, qword [0x00030458]
lea rcx, [0x00025ab0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [0x00030468]
lea rcx, [0x00025ad0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [0x00030468]
lea rcx, [0x00025ad0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [0x00030470]
mov rax, qword [0x00030468]
mov qword [rdx + 0x10], rax
mov rcx, qword [0x00030470]
mov rax, qword [0x00030480]
mov qword [rcx + 0x18], rax
mov eax, dword [rsp + 0x134]
add eax, 0x402000
mov ecx, eax
mov rax, qword [0x00030470]
mov qword [rax + 0x20], rcx
mov dword [0x0002d47c], 1
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1cb68
mov r8, qword [rsp + 0x100]
mov edx, dword [rsp + 0xf0]
lea rcx, [0x00025af0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1cb76
lea rcx, [0x00025b30]
call sub.ntoskrnl.exe_DbgPrint
mov edx, dword [0x0002d47c]
lea rcx, [0x00025610]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [0x0002d47c], 0
je 0x1d42f
call fcn.00012440
mov edx, eax
lea rcx, [0x00025b60]
call sub.ntoskrnl.exe_DbgPrint
mov cl, 0xf
call fcn.0001ba50
mov byte [rsp + 0x1a8], al
lea rcx, [0x00025b70]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000123c0
movsxd rcx, eax
mov rax, qword [0x00030478]
mov qword [rax], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx]
lea rcx, [0x00025b90]
call sub.ntoskrnl.exe_DbgPrint
mov ecx, 0xc0000080
call fcn.000124b0
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 8], rdx
mov ecx, 0xc0000080
call fcn.000124b0
shr eax, 8
and eax, 1
movsxd rcx, eax
mov rax, qword [0x00030478]
mov qword [rax + 0x10], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x10]
lea rcx, [0x00025bb0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000124f0
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x38], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x38]
lea rcx, [0x00025bd0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00012500
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x40], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x40]
lea rcx, [0x00025bf0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00012510
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x48], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x48]
lea rcx, [0x00025c10]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00012540
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x50], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x50]
lea rcx, [0x00025c30]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00022994
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0xf8], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xf8]
lea rcx, [0x00025c50]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00022990
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0xf0], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xf0]
lea rcx, [0x00025c70]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00022998
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0x100], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x100]
lea rcx, [0x00025c90]
call sub.ntoskrnl.exe_DbgPrint
call fcn.0002299c
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0x108], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x108]
lea rcx, [0x00025cb0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229a0
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0x110], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x110]
lea rcx, [0x00025cd0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229a4
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0x118], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x118]
lea rcx, [0x00025cf0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229ad
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0x128], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x128]
lea rcx, [0x00025d10]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229a8
movzx ecx, ax
mov rax, qword [0x00030478]
mov qword [rax + 0x120], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x120]
lea rcx, [0x00025d30]
call sub.ntoskrnl.exe_DbgPrint
mov ecx, 0xc0000100
call fcn.000124b0
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x130], rdx
mov ecx, 0xc0000101
call fcn.000124b0
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x138], rdx
mov r8, qword [0x00030478]
mov r8, qword [r8 + 0x138]
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x130]
lea rcx, reloc.ntoskrnl.exe_KeQueryMaximumProcessorCount
call sub.ntoskrnl.exe_DbgPrint
call fcn.00012430
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x58], rdx
mov qword [rsp + 0x92], 0
xor eax, eax
mov word [rsp + 0x90], ax
lea rcx, [rsp + 0x90]
call fcn.000229b2
mov rdx, qword [0x00030478]
mov rax, qword [rsp + 0x92]
mov qword [rdx + 0x28], rax
movzx ecx, word [rsp + 0x90]
mov rax, qword [0x00030478]
mov qword [rax + 0x30], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x28]
lea rcx, [0x00025d90]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x30]
lea rcx, [0x00025db0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [rsp + 0x80]
call fcn.00012550
mov rdx, qword [0x00030478]
mov rax, qword [rsp + 0x82]
mov qword [rdx + 0x18], rax
movzx ecx, word [rsp + 0x80]
mov rax, qword [0x00030478]
mov qword [rax + 0x20], rcx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x18]
lea rcx, [0x00025dd0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x20]
lea rcx, [0x00025df0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00012480
mov qword [rsp + 0xa0], rax
mov rcx, qword [0x00030478]
mov rax, qword [rsp + 0xa0]
mov qword [rcx + 0xe8], rax
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xe8]
lea rcx, [0x00025e10]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0xa0]
and eax, 0xfffffdff
mov dword [rsp + 0xa0], eax
mov rcx, qword [0x00030478]
mov rax, qword [rsp + 0xa0]
mov qword [rcx + 0xe8], rax
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xe8]
lea rcx, [0x00025e30]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [0x00030478]
mov rax, qword [rsp + 0xa0]
mov qword [rdx + 0xe8], rax
call fcn.000229ba
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xa0], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xa0]
lea rcx, [0x00025e50]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229c2
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x98], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x98]
lea rcx, [0x00025e70]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229c5
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x68], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x68]
lea rcx, [0x00025e90]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229c6
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x70], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x70]
lea rcx, [0x00025eb0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229ca
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x78], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x78]
lea rcx, reloc.ksecdd.sys_BCryptGetProperty
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229ce
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x80], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x80]
lea rcx, reloc.ntoskrnl.exe___C_specific_handler
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229d2
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x88], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x88]
lea rcx, [0x00025f10]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229d6
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0x90], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x90]
lea rcx, [0x00025f30]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229da
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xa8], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xa8]
lea rcx, [0x00025f50]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229de
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xb0], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xb0]
lea rcx, [0x00025f70]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229e2
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xb8], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xb8]
lea rcx, [0x00025f90]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229e6
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xc0], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xc0]
lea rcx, [0x00025fb0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229ea
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xc8], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xc8]
lea rcx, [0x00025fd0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229ee
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xd0], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xd0]
lea rcx, [0x00025ff0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229f2
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xd8], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xd8]
lea rcx, [0x00026010]
call sub.ntoskrnl.exe_DbgPrint
call fcn.000229f6
mov rdx, rax
mov rax, qword [0x00030478]
mov qword [rax + 0xe0], rdx
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0xe0]
lea rcx, [0x00026030]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x00030478]
mov rcx, qword [rcx + 0xa0]
sub rcx, 8
mov rax, qword [0x00030478]
mov qword [rax + 0xa0], rcx
mov rcx, qword [0x00030478]
lea rax, [0x00022cdd]
mov qword [rcx + 0x60], rax
mov rdx, qword [0x00030478]
mov rdx, qword [rdx + 0x60]
lea rcx, [0x00026050]
call sub.ntoskrnl.exe_DbgPrint
mov r8, qword [0x00030468]
mov rdx, qword [0x00030478]
lea rcx, [0x00026070]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00022c2f
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012580
call fcn.00012570
lea rcx, [0x000260a0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00012440
mov edx, eax
lea rcx, [0x00025b60]
call sub.ntoskrnl.exe_DbgPrint
movzx ecx, byte [rsp + 0x1a8]
call fcn.0001ba00
call fcn.00012440
mov edx, eax
lea rcx, [0x00025b60]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x000260c0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x248
pop rdi
pop rsi
ret