Function at 0x1ec50
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x00024b60]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1eca8
xor eax, eax
jmp 0x1f3ac
mov eax, dword [0x0002aebc]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x3d
je 0x1ecdf
cmp dword [rsp + 0x50], 0x3e
je 0x1f2fd
cmp dword [rsp + 0x50], 0x3f
je 0x1ed8e
cmp dword [rsp + 0x50], 0x64
je 0x1ee3d
jmp 0x1f3a5
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1ecf9
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1ed89
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0x45
jne 0x1ed84
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0x33
jne 0x1ed84
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xc0
jne 0x1ed84
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 3]
cmp eax, 0xe9
jne 0x1ed84
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 8
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1ed82
xor eax, eax
jmp 0x1f3ac
jmp 0x1ed89
jmp 0x1eceb
jmp 0x1f3a5
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1eda8
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1ee38
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0x45
jne 0x1ee33
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0x33
jne 0x1ee33
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xc0
jne 0x1ee33
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 3]
cmp eax, 0xe9
jne 0x1ee33
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 8
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1ee31
xor eax, eax
jmp 0x1f3ac
jmp 0x1ee38
jmp 0x1ed9a
jmp 0x1f3a5
cmp dword [0x0002aeb8], 0x42ee
je 0x1ee65
cmp dword [0x0002aeb8], 0x4563
je 0x1ee65
cmp dword [0x0002aeb8], 0x47ba
jne 0x1ef36
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1ee7f
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1ef31
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0xe8
jne 0x1ef2c
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0xe
jne 0x1ef2c
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 5]
cmp eax, 0x48
jne 0x1ef2c
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 6]
cmp eax, 0x83
jne 0x1ef2c
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 7]
cmp eax, 0xc4
jne 0x1ef2c
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 8]
cmp eax, 0x28
jne 0x1ef2c
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 1]
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1ef2a
xor eax, eax
jmp 0x1f3ac
jmp 0x1ef31
jmp 0x1ee71
jmp 0x1f2f8
cmp dword [0x0002aeb8], 0x3ad7
jne 0x1effb
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1ef60
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1eff6
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0xf
jne 0x1eff1
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0x95
jne 0x1eff1
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xc2
jne 0x1eff1
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 3]
cmp eax, 0xe9
jne 0x1eff1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 4
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1efef
xor eax, eax
jmp 0x1f3ac
jmp 0x1eff6
jmp 0x1ef52
jmp 0x1f2f8
cmp dword [0x0002aeb8], 0x3fab
jne 0x1f0c0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1f025
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1f0bb
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0xf
jne 0x1f0b6
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0x95
jne 0x1f0b6
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xc2
jne 0x1f0b6
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 3]
cmp eax, 0xe8
jne 0x1f0b6
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 4
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1f0b4
xor eax, eax
jmp 0x1f3ac
jmp 0x1f0bb
jmp 0x1f017
jmp 0x1f2f8
cmp dword [0x0002aeb8], 0x3839
jne 0x1f187
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1f0ea
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1f182
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0x8b
jne 0x1f17d
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0xd0
jne 0x1f17d
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xe9
jne 0x1f17d
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 7]
cmp eax, 0xcc
jne 0x1f17d
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 3]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 3
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1f17b
xor eax, eax
jmp 0x1f3ac
jmp 0x1f182
jmp 0x1f0dc
jmp 0x1f2f8
cmp dword [0x0002aeb8], 0x295a
jne 0x1f24e
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1f1b1
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1f249
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0x8b
jne 0x1f244
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0xd0
jne 0x1f244
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xe9
jne 0x1f244
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 7]
cmp eax, 0xcc
jne 0x1f244
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 3]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 3
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1f242
xor eax, eax
jmp 0x1f3ac
jmp 0x1f249
jmp 0x1f1a3
jmp 0x1f2f8
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1f268
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1f2f8
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0x45
jne 0x1f2f3
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0x33
jne 0x1f2f3
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xc0
jne 0x1f2f3
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 3]
cmp eax, 0xe9
jne 0x1f2f3
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 8
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1f2f1
xor eax, eax
jmp 0x1f3ac
jmp 0x1f2f8
jmp 0x1f25a
jmp 0x1f3a5
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1f317
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 0xff
cmp qword [rsp + 0x38], rax
jae 0x1f3a5
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 0x45
jne 0x1f3a0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 1]
cmp eax, 0x33
jne 0x1f3a0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 2]
cmp eax, 0xc0
jne 0x1f3a0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 3]
cmp eax, 0xeb
jne 0x1f3a0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 4]
mov byte [rsp + 0x30], al
mov eax, dword [rsp + 0x30]
add eax, 5
cdqe
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0002af58], rax
cmp qword [0x0002af58], 0
jne 0x1f39e
xor eax, eax
jmp 0x1f3ac
jmp 0x1f3a5
jmp 0x1f309
mov rax, qword [0x0002af58]
add rsp, 0x68
ret