Function at 0x6076f
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x80
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
cmp qword [0x00045e88], rbp
lea r12d, [rbp + 1]
jne 0x600f0
lea rdx, str.CallbackAcpiSimulator
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [0x00045e88]
mov r9b, r12b
xor r8d, r8d
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x68], 0x10
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
call qword [sym.imp.ntoskrnl.exe_ExCreateCallback]
cmp eax, ebp
jl 0x600e9
mov rcx, qword [0x00045e88]
cmp rcx, rbp
je 0x600e9
lea rdx, [0x0002c0d8]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ExRegisterCallback]
cmp rax, rbp
mov qword [0x00045e90], rax
jne 0x600f0
mov rcx, qword [0x00045e88]
cmp rcx, rbp
je 0x600f0
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [0x00045e90]
mov qword [0x00045e88], rbp
cmp rcx, rbp
je 0x600f0
call qword [sym.imp.ntoskrnl.exe_ExUnregisterCallback]
mov qword [0x00045e90], rbp
jmp 0x600f0
mov qword [0x00045e88], rbp
mov word [0x00047180], bp
movzx eax, word [rdi]
mov r8d, 0x4d706341
add ax, 2
mov ecx, r12d
mov qword [0x00047050], rbx
mov word [0x00047182], ax
movzx edx, word [rdi]
add rdx, 2
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp rax, rbp
mov qword [0x00047188], rax
je 0x60140
lea rcx, [0x00047180]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
jmp 0x60147
mov word [0x00047182], bp
call fcn.00020410
lea rdx, [0x00019264]
lea rcx, [0x00047060]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
lea rdx, [0x000115b8]
lea rcx, [0x00047320]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
lea rdx, [0x00021288]
lea rcx, [0x00046fa0]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
lea rcx, [0x00046fe0]
call qword [sym.imp.ntoskrnl.exe_KeInitializeTimer]
lea rax, [0x00047140]
mov qword [0x00047198], rbp
mov qword [0x00047148], rax
mov qword [0x00047140], rax
lea rax, [0x00047130]
mov qword [0x00047138], rax
mov qword [0x00047130], rax
lea rax, [0x00047120]
mov qword [0x00047128], rax
mov qword [0x00047120], rax
lea rax, [0x00047110]
mov qword [0x00047118], rax
mov qword [0x00047110], rax
lea rax, [0x00047100]
mov qword [0x00047108], rax
mov qword [0x00047100], rax
lea rax, [0x000470f0]
mov qword [0x000470f8], rax
mov qword [0x000470f0], rax
lea rax, [0x000470e0]
mov qword [0x000470e8], rax
mov qword [0x000470e0], rax
lea rax, [0x000470d0]
mov qword [0x000470d8], rax
mov qword [0x000470d0], rax
lea rax, [0x000470c0]
mov qword [0x000470c8], rax
mov qword [0x000470c0], rax
lea rax, [0x000470b0]
mov qword [0x000470b8], rax
mov qword [0x000470b0], rax
lea rax, [0x000470a0]
mov qword [0x000470a8], rax
mov qword [0x000470a0], rax
lea rax, [0x000473d0]
mov qword [0x000473d8], rax
mov qword [0x000473d0], rax
lea rax, [0x000473c0]
mov qword [0x000473c8], rax
mov qword [0x000473c0], rax
lea rax, [0x000473b0]
mov qword [0x000473b8], rax
mov qword [0x000473b0], rax
lea rax, [0x000473a0]
mov qword [0x000473a8], rax
mov qword [0x000473a0], rax
lea rax, [0x00047390]
mov qword [0x00047398], rax
mov qword [0x00047390], rax
lea rax, [0x00047380]
mov qword [0x00047388], rax
mov qword [0x00047380], rax
lea rax, [0x00047370]
mov qword [0x00047378], rax
mov qword [0x00047370], rax
lea rax, [0x00047360]
mov qword [0x00047158], rbp
mov qword [0x00047150], rbp
mov qword [0x000473e0], rbp
mov qword [0x00047368], rax
mov qword [0x00046bc0], rbp
mov qword [0x000472f0], rbp
mov qword [0x00046f48], rbp
mov qword [0x00047028], rbp
mov qword [0x00047508], rbp
mov qword [0x00047510], rbp
mov qword [0x00047360], rax
lea rax, [0x00047300]
mov word [rsp + 0x30], 0x20
mov qword [0x00047308], rax
mov qword [0x00047300], rax
lea rax, [0x00046bb0]
mov qword [0x00046bb8], rax
mov qword [0x00046bb0], rax
lea rax, [0x000472e0]
mov qword [0x000472e8], rax
mov qword [0x000472e0], rax
lea rax, [0x00047520]
mov edi, 0x44706341
lea rcx, [0x00045640]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [0x00047528], rax
mov qword [0x00047520], rax
mov dword [0x00047160], ebp
mov dword [0x000473ec], ebp
mov byte [0x000473e8], bpl
mov byte [0x00046f44], bpl
mov byte [0x00047022], bpl
mov byte [0x00047021], bpl
mov byte [0x00047020], bpl
mov qword [rsp + 0x20], 0x80
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], 0x78
mov esi, 0x50706341
lea rcx, [0x000457c0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], 0x88
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], 0x40
lea rcx, [0x000456c0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], 0x2a8
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], 0x66
lea rcx, [0x00045740]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x4f706341
mov qword [rsp + 0x20], 0x28
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], 0x10
lea rcx, [0x00045840]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], 0x30
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
lea rcx, [0x00046d00]
xor edx, edx
mov r8d, 0x240
mov qword [0x00046ce8], rbp
call fcn.0003cb30
lea rax, [0x0002b1f0]
lea rcx, [0x00046b00]
mov qword [0x00046b50], rax
lea rax, [0x00046b20]
xor r8d, r8d
xor edx, edx
mov qword [0x00046b60], rbp
mov qword [0x00046b58], rbp
mov qword [0x00046b28], rax
mov qword [0x00046b20], rax
mov qword [0x00046b40], rbp
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r8d, r8d
xor edx, edx
lea rcx, [0x00046ae0]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rdx, [0x00046ac0]
lea rax, [0x0002b2a8]
mov qword [0x00046ac8], rdx
mov qword [0x00046ac0], rdx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov edi, 0x1fffff
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
xor r9d, r9d
mov edx, edi
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x68], ebp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, ebp
je 0x605d1
xor r9d, r9d
mov r8d, 0xe0067
mov rdx, r12
mov ecx, 0xa3
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
int3
mov rcx, qword [rsp + 0xa0]
lea rax, [rsp + 0xa8]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, ebp
je 0x6061a
xor r9d, r9d
mov r8d, 0xe0073
mov rdx, r12
mov ecx, 0xa3
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
int3
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rdx, qword [rbx + 0x30]
lea rax, [0x0001aca0]
mov qword [rdx + 8], rax
lea rax, [0x0001b154]
lea rdi, [rbx + 0x70]
mov ecx, 0x1c
lea rsi, [0x00047420]
xor edx, edx
rep stosq qword [rdi], rax
lea rax, [0x0001b564]
mov edi, 0xe0
mov r8, rdi
mov rcx, rsi
mov qword [rbx + 0x68], rax
call fcn.0003cb30
lea rax, [0x0001d060]
mov dword [0x00047420], edi
mov qword [0x00047488], rax
mov qword [rbx + 0x50], rsi
lea rax, [0x0001fb14]
mov qword [0x00047408], rax
lea rax, [fcn.000259ec]
lea rdx, [0x00047500]
mov qword [0x00047410], rax
lea rax, [0x0002a62c]
lea rcx, [0x00047400]
mov qword [0x00047418], rax
mov rax, qword [sym.imp.ntoskrnl.exe_HalDispatchTable]
mov dword [0x00047400], 0x41435049
mov dword [0x00047404], r12d
call qword [rax + 0x70]
lea r9, [0x00046ab0]
lea rcx, [0x0003ede8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_EtwRegister]
lea r11, [rsp + 0x80]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov rax, qword [0x00042100]
movabs r9, 0x2b992ddfa232
test rax, rax
je 0x6076f
cmp rax, r9
jne 0x6079e
lea r8, [0x00042100]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
xor rax, r8
movabs r8, 0xffffffffffff
and rax, r8
cmove rax, r9
mov qword [0x00042100], rax
not rax
mov qword [0x00042108], rax
jmp 0x60008