Function at 0x140003650
Capabilities:
Attach user process memory
Complete processing asynchronous io request
Find process by pid
Inject apc
Map section object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x14000f050]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xc0], rsp
mov rdi, rdx
mov qword [rsp + 0x90], rdx
mov esi, 0xc0000001
mov dword [rsp + 0x50], esi
xor r14d, r14d
mov qword [rsp + 0xa0], r14
cmp dword [0x140018f9c], r14d
jne 0x1400036c2
mov rax, qword [rdx + 0xb8]
mov qword [rsp + 0xa0], rax
mov ecx, dword [rax + 0x18]
jmp 0x1400036c5
mov ecx, dword [rdx + 0x10]
cmp ecx, 0x22e100
ja 0x1400043c6
je 0x14000439c
add ecx, 0xffdd2000
cmp ecx, 0xfc
ja case.0x1400043f1.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x4f40]
mov ecx, dword [rdx + rax*4 + 0x4e78]
add rcx, rdx
jmp rcx
mov rax, qword [rdi + 0x18]
movzx r9d, word [rax + 0x10]
mov qword [rsp + 0x20], rax
mov r8, qword [rax + 8]
xor edx, edx
mov ecx, dword [rax]
call fcn.140006060
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 0x12]
movzx r9d, word [rcx + 0x10]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 8]
xor edx, edx
mov ecx, dword [rcx]
call fcn.140006230
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x1400043f1.2285861
mov qword [rsp + 0x70], r14
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov esi, ecx
call fcn.1400070e0
mov qword [rsp + 0x78], rax
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], r14d
test rax, rax
jne 0x140003803
mov byte [rbx + 8], r14b
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x70]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400037f2
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1fffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x50], eax
jmp 0x140003807
mov byte [rbx + 8], 1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140003817
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x78]
mov qword [rbx], rax
jmp case.0x1400043f1.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x58], r14
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x78], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xd0]
mov edx, 0x1fffff
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwOpenThread]
mov dword [rsp + 0x50], eax
jmp 0x14000388c
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
jmp case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
lea r9, [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r8, qword [rbx + 8]
xor edx, edx
mov ecx, dword [rbx]
call fcn.140005c30
movzx eax, al
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
jmp case.0x1400043f1.2285861
cli
sti
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140006500
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
test ecx, ecx
je 0x140003947
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rdi + 0x18]
test eax, eax
jne 0x140003944
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov qword [rcx], r14
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
mov r8, rcx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.140005d90
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
movups xmm0, xmmword [str.devicephysicalmemory]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [0x14000d490]
movups xmmword [rsp + 0x120], xmm1
movsd xmm0, qword [0x14000d4a0]
movsd qword [rsp + 0x130], xmm0
mov eax, dword [0x14000d4a8]
mov dword [rsp + 0x138], eax
movzx eax, word [0x14000d4ac]
mov word [rsp + 0x13c], ax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xd0], 0x30
mov qword [rsp + 0xd8], r14
mov dword [rsp + 0xe8], 0x40
lea rax, [rsp + 0x140]
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xd0]
mov edx, 0xf001f
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], 0x2000
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2000
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [r9 - 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140003ac6
mov rcx, qword [rbx]
sub rcx, qword [rsp + 0x70]
lea rdx, [rbx + 0x10]
add rcx, qword [rsp + 0x78]
mov r8, rdi
call fcn.14000c580
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp case.0x1400043f1.2285861
mov qword [rsp + 0x98], r14
mov ebx, r14d
mov dword [rsp + 0x50], ebx
mov rsi, qword [rdi + 0x18]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003b58
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r14, rax
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140003b73
test ebx, ebx
jne case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x1400043f1.2285861
call fcn.140001b70
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
call fcn.140001ba0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140001c30
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov dword [rsp + 0x50], r14d
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003b7b
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
call fcn.140001b90
mov r14, rax
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x1400043f1.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.140001780
xor ecx, ecx
mov rax, qword [rdi + 0x18]
mov qword [rax], rcx
mov word [rax + 8], cx
mov rcx, qword [rdi + 0x18]
movsd xmm0, qword [rsp + 0x58]
movsd qword [rcx], xmm0
movzx eax, word [rsp + 0x60]
mov word [rcx + 8], ax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.14000b7b2
jmp 0x140003c6a
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call fcn.14000a910
mov ecx, dword [rbx + 8]
lea rax, [0x14000b620]
xor r9d, r9d
xor r8d, r8d
cmp ecx, 0xffffffff
jne 0x140003cee
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x14000b5c0]
call fcn.1400017f0
call fcn.14000a7e0
jmp case.0x1400043f1.2285861
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rdx, [0x14000b5c0]
call fcn.140001ac0
jmp case.0x1400043f1.2285861
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140002040]
call fcn.1400017f0
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov edx, dword [rax + 8]
movzx ecx, byte [rax]
call fcn.140003350
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov ebx, r14d
mov esi, 0x100
movzx ecx, bl
call fcn.1400034f0
inc ebx
cmp ebx, esi
jl 0x140003d55
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002430
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400025a0
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
call fcn.1400025e0
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
cmp byte [rax], r14b
setne byte [section..data]
cmp byte [0x140018a88], r14b
je 0x140003dcf
cmp qword [0x14000f0f8], r14
je 0x140003dcf
mov dword [rsp + 0x50], esi
jmp case.0x1400043f1.2285861
mov dl, 1
lea rcx, [0x140018a20]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov byte [0x140018a98], r14b
lea rcx, [0x140018a20]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call fcn.140006be0
cmp byte [0x140018a88], r14b
jne 0x140003e39
xor edx, edx
lea rcx, [0x140007030]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
test eax, eax
sete byte [0x140018a88]
test eax, eax
jne 0x140003e32
lea rcx, [0x140007040]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
test eax, eax
sete byte [0x140018545]
cmp byte [0x140018a88], r14b
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x1400043f1.2285861
mov dl, 1
lea rcx, [0x140018a20]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x140018a98]
mov byte [rcx], al
movzx eax, byte [0x140018a98]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x140018aa0]
call fcn.14000c580
mov byte [0x140018a98], r14b
lea rcx, [0x140018a20]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov dl, 1
lea rcx, [0x140018a20]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x140018550]
mov byte [rcx], al
movzx eax, byte [0x140018550]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x140018560]
call fcn.14000c580
mov byte [0x140018550], r14b
lea rcx, [0x140018a20]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 8]
mov ebx, dword [rax]
mov edx, 0x58
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov ecx, ebx
call fcn.140006500
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], r14b
lea rcx, [fcn.140002500]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
lea r9, [0x1400053a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInitializeApc]
xor r9d, r9d
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140007230
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140007190
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x14000f6e8], r14
je 0x140003fe0
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003fd3
mov rcx, qword [rsp + 0x68]
call qword [0x14000f6e8]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x1400043f1.2285861
mov dword [rsp + 0x50], 0xc0000225
jmp case.0x1400043f1.2285861
mov dword [rsp + 0x50], 0xc0000002
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x14000f6e0], r14
je 0x140003fe0
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003fd3
mov rcx, qword [rsp + 0x68]
call qword [0x14000f6e0]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x78], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x1400043f1.2285861
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [r8 - 1]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400040ba
cmp byte [0x140018544], al
je 0x1400040ba
mov r8, qword [rsp + 0x78]
mov ecx, r14d
mov edx, r14d
mov dword [rsp + 0x70], ecx
cmp edx, dword [rsp + 0x68]
jge 0x1400040ba
movsxd rax, edx
mov byte [rax + r8], cl
lea ecx, [rdx + 1]
mov edx, ecx
jmp 0x1400040a2
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x140004967
mov rax, qword [rdi + 0x18]
movsxd rcx, dword [rax]
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], r14
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
test rax, rax
jne 0x140004116
mov dword [rsp + 0x50], esi
jmp case.0x1400043f1.2285861
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14000c480
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rdx, qword [rdi + 0x18]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
lea rdx, str.PsGetProcessImageFileName
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x1400123a8], rax
test rax, rax
je case.0x140003702.2285616
mov rcx, qword [rbx]
call rax
mov qword [rbx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140001d40
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002680
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140001d70
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140002180
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov dword [0x140018f60], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax + 4]
cmp dword [rax], r14d
je 0x14000424c
mov r9d, dword [rax + 0x14]
mov r8d, dword [rax + 0x10]
mov rdx, qword [rax + 8]
call fcn.140002400
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
call fcn.140002660
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
xor ecx, ecx
call fcn.140002650
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
call rax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov dword [rax], 0x1e849b
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov r8, qword [rdi + 0x18]
mov ecx, dword [r8]
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [r8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x28], r14
lea rax, [0x140018a90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov qword [rsp + 0x28], r14
lea rax, [0x140018548]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x1400043f1.2285861
mov dword [rsp + 0x50], r14d
mov rcx, qword [rdi + 0x18]
cmp dword [rcx], r14d
je 0x140004390
mov rax, qword [rcx + 4]
mov qword [0x140018538], rax
mov eax, dword [rcx + 0xc]
mov dword [0x140018530], eax
mov rax, qword [rcx + 0x10]
mov qword [0x140018528], rax
call fcn.14000a500
mov dword [0x140018520], eax
mov dword [0x140018540], 1
jmp case.0x1400043f1.2285861
mov dword [0x140018540], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rcx + 8]
mov rax, rdx
shr rdx, 0x20
mov ecx, dword [rcx]
wrmsr
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
add ecx, 0xffdd1efc
cmp ecx, 0x84
ja case.0x1400043f1.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x50c8]
mov ecx, dword [rdx + rax*4 + 0x5040]
add rcx, rdx
jmp rcx
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
cmp qword [0x14000f0b8], r14
jne 0x14000444e
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
test rax, rax
je 0x140004444
mov qword [0x14000f0b8], rax
mov ecx, r14d
mov dword [rsp + 0x88], ecx
movsxd rdx, ecx
shl rdx, 4
cmp qword [rdx + rax + 8], 0
jne 0x140004440
cmp qword [rdx + rax], 0
jne 0x140004440
mov qword [0x14000f0c0], rdx
jmp 0x140004444
inc ecx
jmp 0x14000441a
jmp 0x14000444e
mov rax, qword [0x14000f0b8]
mov qword [rbx], rax
mov rax, qword [0x14000f0c0]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rbx, r14
mov qword [rsp + 0x80], rbx
mov rdi, qword [rdi + 0x18]
mov qword [rsp + 0x58], rdi
mov r15, rdi
mov dword [rsp + 0x50], esi
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000454f
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400045b2
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140004526
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400045b2
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140004585
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x1400045b2
test rbx, rbx
je case.0x1400043f1.2285861
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140004661
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x1400043f1.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 2]
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [r15 + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x1400043f1.2285861
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 2]
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [r15 + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rcx]
mov rdx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rdi, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x1400043f1.2285861
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x140004757
xor r8d, r8d
mov dl, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x140004757
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov qword [rdi], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
movzx ecx, byte [rax]
mov dword [0x140018f5c], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002500
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x18]
lea r8, [rcx + 0xd8]
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 8]
mov edx, dword [rcx + 4]
mov ecx, dword [rcx]
call fcn.140008550
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
mov qword [rdx], r14
call fcn.14000a110
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140009940
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400099c0
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
call fcn.1400098f0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
call fcn.140009a00
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140009a50
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
call fcn.140009b20
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
call fcn.140009d10
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
call fcn.140009e90
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
call fcn.140008050
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x20]
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 0x18]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.140007620
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
call fcn.140007990
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
call fcn.140007dc0
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140007920
mov dword [rsp + 0x50], eax
jmp case.0x1400043f1.2285861
call fcn.140007af0
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
call fcn.140007b30
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
call fcn.140007b70
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x1400043f1.2285861
mov rcx, qword [rsp + 0x58]
call fcn.140006630
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003947
mov rcx, qword [rsp + 0x58]
call fcn.1400063e0
mov rcx, qword [rdi + 0x18]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rcx, qword [rdi + 0x18]
mov edx, dword [rcx]
call fcn.140006470
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [0x14000f0c8]
test rcx, rcx
je 0x140004a0a
mov qword [rsp + 0x58], 0xfffffffffff85ee0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
lea edx, [r9 + 6]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x1400043f1.2285861
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x14000f0c8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004a2c
cmp rax, rcx
je 0x140004a2c
mov qword [0x14000f0d0], rcx
cmp qword [0x14000f0b0], r14
jne 0x140003900
mov ebx, dword [rbx]
test ebx, ebx
jne 0x140004a75
movabs rbx, 0xfffff78000000320
mov rbx, qword [rbx]
movabs rax, 0x29f16b11c6d1e109
imul rbx
sar rdx, 0xd
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0xc350
sub ebx, eax
add ebx, 0x3e8
mov r9d, ebx
lea r8, [0x14000d4e4]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.140005260
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x110], 0x20100
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], r14
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 3
lea rax, [0x140005210]
mov qword [rsp + 0xe0], rax
lea rax, [fcn.140002500]
mov qword [rsp + 0xe8], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], 3
lea rax, [0x1400052f0]
mov qword [rsp + 0x100], rax
lea rax, [fcn.140002500]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x130], rax
lea rdx, [0x14000f0b0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
jne case.0x1400043f1.2285861
nop dword [rax + rax]
cmp r14d, 0xa
jge case.0x1400043f1.2285861
inc ebx
mov r9d, ebx
lea r8, [0x14000d4e4]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.140005260
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
inc r14d
lea rdx, [0x14000f0b0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
je 0x140004b70
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x110]
xor edx, edx
lea rcx, [rdx - 1]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140004c31
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x118]
mov qword [rcx], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp case.0x1400043f1.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140003c8e
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004cd3
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov r9d, dword [rbx + 0x18]
lea rcx, [rsp + 0x70]
mov edx, dword [rbx + 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffffffffffff
cmp qword [rbx + 8], 0
jne 0x140004c9b
xor r8d, r8d
jmp 0x140004c9f
lea r8, [rbx + 0x10]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
movsxd rcx, eax
mov qword [rbx], rcx
mov eax, dword [rsp + 0x70]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140004cdb
mov dword [rsp + 0x50], 0xc0190060
jmp case.0x1400043f1.2285861
mov rax, qword [rdi + 0x18]
mov r9, qword [rax]
cmp dword [0x140018540], r14d
jne 0x140004d0a
mov dword [rsp + 0x50], 0xc0000184
jmp case.0x1400043f1.2285861
shl r9, 0xc
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], 1
mov r8, r14
mov rdx, 0xffffffffffffffff
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmAllocatePagesForMdlEx]
mov r13, rax
test rax, rax
je 0x140004e0a
mov r15d, dword [rax + 0x28]
shr r15, 0xc
lea rdi, [rax + 0x30]
test rdi, rdi
je 0x140004df8
mov edx, 0x10
lea ecx, [rdx - 0xf]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140004df8
mov edx, 0x100
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx], rax
test rax, rax
je 0x140004ded
mov dword [rbx + 8], r14d
mov esi, r14d
mov ecx, r14d
test r15, r15
je 0x140004dd1
mov rdx, qword [rdi]
shl rdx, 0xc
movsxd rcx, ecx
mov rax, qword [rbx]
mov qword [rax + rcx*8], rdx
inc dword [rbx + 8]
mov ecx, dword [rbx + 8]
cmp ecx, 0x20
jne 0x140004dc0
mov edx, ecx
mov rcx, qword [rbx]
call fcn.14000a310
mov dword [rbx + 8], r14d
mov ecx, r14d
inc esi
add rdi, 8
movsxd rax, esi
cmp rax, r15
jb 0x140004d93
mov rax, qword [rbx]
test ecx, ecx
je 0x140004de2
mov edx, ecx
mov rcx, rax
call fcn.14000a310
mov rax, qword [rbx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x1400043f1.2285861
mov dword [rsp + 0x50], 0xc00000a0
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0x30], ebx
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x140004e47
test ebx, ebx
jne 0x140004e38
mov r14d, dword [rax + 8]
jmp 0x140004e3b
xor r14d, r14d
mov qword [rcx + 0x38], r14
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14000c410
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret