Function at 0x1400028f4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
xor ebx, ebx
cmp qword [0x1400067b0], rbx
jne 0x140002937
lea rdx, str.ZwQueryInformationProcess
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400067b0], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067b8], rbx
jne 0x14000296b
lea rdx, str.ZwQueryInformationThread
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400067b8], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067c8], rbx
jne 0x14000299f
lea rdx, str.ZwQuerySystemInformation
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400067c8], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067d0], rbx
jne 0x1400029d3
lea rdx, str.NtQuerySystemInformation
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400067d0], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067d8], rbx
jne 0x140002a07
lea rdx, str.NtClose
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400067d8], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067f0], rbx
jne 0x140002a3b
lea rdx, str.NtDuplicateObject
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400067f0], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067f8], rbx
jne 0x140002a6f
lea rdx, str.KeRaiseUserException
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400067f8], rax
test rax, rax
je 0x140002b8f
cmp qword [0x140006800], rbx
jne 0x140002aa3
lea rdx, str.NtSetInformationThread
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140006800], rax
test rax, rax
je 0x140002b8f
cmp qword [0x140006808], rbx
jne 0x140002ad7
lea rdx, str.NtSetInformationProcess
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140006808], rax
test rax, rax
je 0x140002b8f
cmp qword [0x140006810], rbx
jne 0x140002b0b
lea rdx, str.NtQueryInformationProcess
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140006810], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067c0], rbx
jne 0x140002b2c
lea rcx, str.NtQueryObject
call fcn.1400013f0
mov qword [0x1400067c0], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067e0], rbx
jne 0x140002b4d
lea rcx, str.NtSetContextThread
call fcn.1400013f0
mov qword [0x1400067e0], rax
test rax, rax
je 0x140002b8f
cmp qword [0x1400067e8], rbx
jne 0x140002b6e
lea rcx, str.NtContinue
call fcn.1400013f0
mov qword [0x1400067e8], rax
test rax, rax
je 0x140002b8f
cmp qword [0x140006818], rbx
jne 0x140002b93
lea rcx, str.NtSystemDebugControl
call fcn.1400013f0
mov qword [0x140006818], rax
test rax, rax
jne 0x140002b93
xor al, al
jmp 0x140002b95
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret