Function at 0x140003cd0
Capabilities:
Attach user process memory
Complete processing asynchronous io request
Find process by pid
Inject apc
Map section object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x140010030]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xc0], rsp
mov rdi, rdx
mov qword [rsp + 0x90], rdx
mov esi, 0xc0000001
mov dword [rsp + 0x50], esi
xor r14d, r14d
mov qword [rsp + 0xa0], r14
cmp dword [0x14001a01c], r14d
jne 0x140003d42
mov rax, qword [rdx + 0xb8]
mov qword [rsp + 0xa0], rax
mov ecx, dword [rax + 0x18]
jmp 0x140003d45
mov ecx, dword [rdx + 0x10]
cmp ecx, 0x22e100
ja 0x140004a3f
je 0x140004a15
add ecx, 0xffdd2000
cmp ecx, 0xfc
ja case.0x140004a6a.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x55bc]
mov ecx, dword [rdx + rax*4 + 0x54f4]
add rcx, rdx
jmp rcx
mov rax, qword [rdi + 0x18]
movzx r9d, word [rax + 0x10]
mov qword [rsp + 0x20], rax
mov r8, qword [rax + 8]
xor edx, edx
mov ecx, dword [rax]
call fcn.1400066e0
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 0x12]
movzx r9d, word [rcx + 0x10]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 8]
xor edx, edx
mov ecx, dword [rcx]
call fcn.1400068b0
test al, al
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140004a6a.2285861
mov qword [rsp + 0x70], r14
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov esi, ecx
call fcn.140007790
mov qword [rsp + 0x78], rax
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], r14d
test rax, rax
jne 0x140003e83
mov byte [rbx + 8], r14b
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x70]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003e72
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1fffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x50], eax
jmp 0x140003e87
mov byte [rbx + 8], 1
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140003e97
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x78]
mov qword [rbx], rax
jmp case.0x140004a6a.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x58], r14
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x78], r14
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xd0]
mov edx, 0x1fffff
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwOpenThread]
mov dword [rsp + 0x50], eax
jmp 0x140003f0c
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
jmp case.0x140004a6a.2285861
mov rbx, qword [rdi + 0x18]
lea r9, [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r8, qword [rbx + 8]
xor edx, edx
mov ecx, dword [rbx]
call fcn.1400062b0
movzx eax, al
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
jmp case.0x140004a6a.2285861
cli
sti
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140006b90
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
test ecx, ecx
je 0x140003fc7
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rdi + 0x18]
test eax, eax
jne 0x140003fc4
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov qword [rcx], r14
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
mov r8, rcx
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.140006410
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
movups xmm0, xmmword [0x14000d5c0]
movups xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [0x14000d5d0]
movups xmmword [rsp + 0x120], xmm1
movsd xmm0, qword [0x14000d5e0]
movsd qword [rsp + 0x130], xmm0
mov eax, dword [0x14000d5e8]
mov dword [rsp + 0x138], eax
movzx eax, word [0x14000d5ec]
mov word [rsp + 0x13c], ax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xd0], 0x30
mov qword [rsp + 0xd8], r14
mov dword [rsp + 0xe8], 0x40
lea rax, [rsp + 0x140]
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xd0]
mov edx, 0xf001f
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x140004a6a.2285861
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x58], 0x2000
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x2000
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [r9 - 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140004146
mov rcx, qword [rbx]
sub rcx, qword [rsp + 0x70]
lea rdx, [rbx + 0x10]
add rcx, qword [rsp + 0x78]
mov r8, rdi
call fcn.14000d200
mov rdx, qword [rsp + 0x78]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp case.0x140004a6a.2285861
mov qword [rsp + 0x98], r14
mov ebx, r14d
mov dword [rsp + 0x50], ebx
mov rsi, qword [rdi + 0x18]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400041d8
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov r14, rax
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400041f3
test ebx, ebx
jne case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140004a6a.2285861
call fcn.1400021f0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
call fcn.140002220
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400022b0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov dword [rsp + 0x50], r14d
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400041fb
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
call fcn.140002210
mov r14, rax
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140004a6a.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.140001de0
xor ecx, ecx
mov rax, qword [rdi + 0x18]
mov qword [rax], rcx
mov word [rax + 8], cx
mov rcx, qword [rdi + 0x18]
movsd xmm0, qword [rsp + 0x58]
movsd qword [rcx], xmm0
movzx eax, word [rsp + 0x60]
mov word [rcx + 8], ax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
xor eax, eax
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], ax
lea rcx, [rsp + 0x58]
call fcn.140001022
jmp 0x1400042ea
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call fcn.14000b0f0
mov ecx, dword [rbx + 8]
lea rax, [0x14000be00]
xor r9d, r9d
xor r8d, r8d
cmp ecx, 0xffffffff
jne 0x14000436e
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x14000bda0]
call fcn.140001e50
call fcn.14000afc0
jmp case.0x140004a6a.2285861
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rdx, [0x14000bda0]
call fcn.140002140
jmp case.0x140004a6a.2285861
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400026c0]
call fcn.140001e50
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov edx, dword [rax + 8]
movzx ecx, byte [rax]
call fcn.1400039d0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov ebx, r14d
mov esi, pe_nt_image_headers64
movzx ecx, bl
call fcn.140003b70
inc ebx
cmp ebx, esi
jl 0x1400043d5
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002ab0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002c20
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
call fcn.140002c60
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
cmp byte [rax], r14b
setne byte [section..data]
cmp byte [0x140019b08], r14b
je 0x14000444f
cmp qword [0x140010120], r14
je 0x14000444f
mov dword [rsp + 0x50], esi
jmp case.0x140004a6a.2285861
mov dl, 1
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov byte [0x140019b18], r14b
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call fcn.140007290
cmp byte [0x140019b08], r14b
jne 0x1400044b9
xor edx, edx
lea rcx, [0x1400076e0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
test eax, eax
sete byte [0x140019b08]
test eax, eax
jne 0x1400044b2
lea rcx, [0x1400076f0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
test eax, eax
sete byte [0x14001a885]
cmp byte [0x140019b08], r14b
cmovne esi, r14d
mov dword [rsp + 0x50], esi
jmp case.0x140004a6a.2285861
mov dl, 1
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x140019b18]
mov byte [rcx], al
movzx eax, byte [0x140019b18]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x140019b20]
call fcn.14000d200
mov byte [0x140019b18], r14b
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov dl, 1
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [rdi + 0x18]
movzx eax, byte [0x14001a890]
mov byte [rcx], al
movzx eax, byte [0x14001a890]
lea r8, [rax + rax*2]
shl r8, 3
mov rcx, qword [rdi + 0x18]
inc rcx
lea rdx, [0x14001a8a0]
call fcn.14000d200
mov byte [0x14001a890], r14b
lea rcx, [0x140019aa0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 8]
mov ebx, dword [rax]
mov edx, 0x58
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
mov ecx, ebx
call fcn.140006b90
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], r14b
lea rcx, [fcn.140002b80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
lea r9, [0x140005a20]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInitializeApc]
xor r9d, r9d
mov r8, rsi
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400078e0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140007840
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x1400114a8], r14
je 0x140004667
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x14000465a
mov rax, qword [0x1400114a8]
mov rcx, qword [rsp + 0x68]
call qword [0x14000e3a8]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140004a6a.2285861
mov dword [rsp + 0x50], 0xc0000225
jmp case.0x140004a6a.2285861
mov dword [rsp + 0x50], 0xc0000002
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
cmp qword [0x1400114a0], r14
je 0x140004667
mov ecx, dword [rax]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x14000465a
mov rax, qword [0x1400114a0]
jmp 0x14000463b
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x78], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004a6a.2285861
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [r8 - 1]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x14000472b
cmp byte [0x14001a884], al
je 0x14000472b
mov r8, qword [rsp + 0x78]
mov ecx, r14d
mov edx, r14d
mov dword [rsp + 0x70], ecx
cmp edx, dword [rsp + 0x68]
jge 0x14000472b
movsxd rax, edx
mov byte [rax + r8], cl
lea ecx, [rdx + 1]
mov edx, ecx
jmp 0x140004713
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x78]
mov qword [rcx], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x140004fe0
mov rax, qword [rdi + 0x18]
movsxd rcx, dword [rax]
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], r14
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
test rax, rax
jne 0x140004787
mov dword [rsp + 0x50], esi
jmp case.0x140004a6a.2285861
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14000d100
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rdx, qword [rdi + 0x18]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rbx, qword [rdi + 0x18]
lea rdx, [0x14000d5f0]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x140014168], rax
test rax, rax
je case.0x140003d82.2285616
mov rcx, qword [rbx]
call qword [0x14000e3a8]
mov qword [rbx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.1400023c0
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002d00
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
call fcn.1400023f0
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140002800
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
mov dword [0x140019fe0], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax + 4]
cmp dword [rax], r14d
je 0x1400048c1
mov r9d, dword [rax + 0x14]
mov r8d, dword [rax + 0x10]
mov rdx, qword [rax + 8]
call fcn.140002a80
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
call fcn.140002ce0
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
xor ecx, ecx
call fcn.140002cd0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
call qword [0x14000e3a8]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov dword [rax], 0x1e849b
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov r8, qword [rdi + 0x18]
mov ecx, dword [r8]
rdmsr
shl rdx, 0x20
or rax, rdx
mov qword [r8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rbx, qword [rdi + 0x18]
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x28], r14
lea rax, [0x140019b10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov qword [rsp + 0x28], r14
lea rax, [0x14001a888]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f0003
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rax, qword [rdi + 0x18]
mov qword [rax], r14
jmp case.0x140004a6a.2285861
mov dword [rsp + 0x50], r14d
mov rcx, qword [rdi + 0x18]
cmp dword [rcx], r14d
je 0x140004a09
mov rax, qword [rcx + 4]
mov qword [0x14001a878], rax
mov eax, dword [rcx + 0xc]
mov dword [0x14001a870], eax
mov rax, qword [rcx + 0x10]
mov qword [0x14001a868], rax
call fcn.14000ac70
mov dword [0x14001a860], eax
mov dword [0x14001a880], 1
jmp case.0x140004a6a.2285861
mov dword [0x14001a880], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rcx + 8]
mov rax, rdx
shr rdx, 0x20
mov ecx, dword [rcx]
wrmsr
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
add ecx, 0xffdd1efc
cmp ecx, 0x84
ja case.0x140004a6a.2285861
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0x5744]
mov ecx, dword [rdx + rax*4 + 0x56bc]
add rcx, rdx
jmp rcx
mov rbx, qword [rdi + 0x18]
mov qword [rsp + 0x58], rbx
cmp qword [0x1400100d0], r14
jne 0x140004ac7
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
test rax, rax
je 0x140004abd
mov qword [0x1400100d0], rax
mov ecx, r14d
mov dword [rsp + 0x88], ecx
movsxd rdx, ecx
shl rdx, 4
cmp qword [rdx + rax + 8], 0
jne 0x140004ab9
cmp qword [rdx + rax], 0
jne 0x140004ab9
mov qword [0x1400100d8], rdx
jmp 0x140004abd
inc ecx
jmp 0x140004a93
jmp 0x140004ac7
mov rax, qword [0x1400100d0]
mov qword [rbx], rax
mov rax, qword [0x1400100d8]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rbx, r14
mov qword [rsp + 0x80], rbx
mov rdi, qword [rdi + 0x18]
mov qword [rsp + 0x58], rdi
mov r15, rdi
mov dword [rsp + 0x50], esi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140004bc8
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140004c2b
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140004b9f
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140004c2b
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140004bfe
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x140004c2b
test rbx, rbx
je case.0x140004a6a.2285861
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140004cda
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004a6a.2285861
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 2]
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [r15 + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140004a6a.2285861
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 2]
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [r15 + 8], rax
mov qword [r15], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rcx]
mov rdx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rdi, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004a6a.2285861
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x140004dd0
xor r8d, r8d
mov dl, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
jmp 0x140004dd0
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov qword [rdi], rbx
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
movzx ecx, byte [rax]
mov dword [0x140019fdc], ecx
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.140002b80
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x18]
lea r8, [rcx + 0xd8]
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 8]
mov edx, dword [rcx + 4]
mov ecx, dword [rcx]
call fcn.140008c10
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
mov qword [rdx], r14
call fcn.14000a820
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.14000a040
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.14000a0c0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
call fcn.140009ff0
mov rcx, qword [rdi + 0x18]
mov qword [rcx], rax
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
call fcn.14000a100
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov ecx, dword [rax]
call fcn.14000a150
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
call fcn.14000a230
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
call fcn.14000a420
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
call fcn.14000a5a0
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
call fcn.140008710
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + 0x20]
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, dword [rcx + 0x18]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
call fcn.140007cd0
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
call fcn.140008040
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rdx, qword [rdi + 0x18]
mov ecx, dword [rdx]
call fcn.140008480
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
call fcn.140007fd0
mov dword [rsp + 0x50], eax
jmp case.0x140004a6a.2285861
call fcn.1400081b0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
call fcn.1400081f0
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
call fcn.140008230
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne case.0x140004a6a.2285861
mov rcx, qword [rsp + 0x58]
call fcn.140006cc0
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003fc7
mov rcx, qword [rsp + 0x58]
call fcn.140006a70
mov rcx, qword [rdi + 0x18]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rcx, qword [rdi + 0x18]
mov edx, dword [rcx]
call fcn.140006b00
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [0x1400100e0]
test rcx, rcx
je 0x140005083
mov qword [rsp + 0x58], 0xfffffffffff85ee0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
lea edx, [r9 + 6]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov dword [rsp + 0x50], eax
test eax, eax
jne case.0x140004a6a.2285861
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x1400100e0], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400050a5
cmp rax, rcx
je 0x1400050a5
mov qword [0x1400100e8], rcx
cmp qword [0x1400100f0], r14
jne 0x140003f80
mov ebx, dword [rbx]
test ebx, ebx
jne 0x1400050ee
movabs rbx, 0xfffff78000000320
mov rbx, qword [rbx]
movabs rax, 0x29f16b11c6d1e109
imul rbx
sar rdx, 0xd
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0xc350
sub ebx, eax
add ebx, 0x3e8
mov r9d, ebx
lea r8, [0x14000d630]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.1400058e0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x110], 0x20100
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], r14
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 3
lea rax, [0x140005890]
mov qword [rsp + 0xe0], rax
lea rax, [fcn.140002b80]
mov qword [rsp + 0xe8], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], 3
lea rax, [0x140005970]
mov qword [rsp + 0x100], rax
lea rax, [fcn.140002b80]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x130], rax
lea rdx, [0x1400100f0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
jne case.0x140004a6a.2285861
cmp r14d, 0xa
jge case.0x140004a6a.2285861
inc ebx
mov r9d, ebx
lea r8, [0x14000d630]
mov edx, 0x12
lea rcx, [rsp + 0x140]
call fcn.1400058e0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x118], xmm0
inc r14d
lea rdx, [0x1400100f0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov dword [rsp + 0x50], eax
cmp eax, 0xc01c0011
je 0x1400051e1
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
lea rdx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x110]
xor edx, edx
lea rcx, [rdx - 1]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x1400052a2
mov rcx, qword [rdi + 0x18]
mov rax, qword [rsp + 0x118]
mov qword [rcx], rax
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp case.0x140004a6a.2285861
mov rbx, qword [rdi + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000430e
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140005344
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov r9d, dword [rbx + 0x18]
lea rcx, [rsp + 0x70]
mov edx, dword [rbx + 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffffffffffff
cmp qword [rbx + 8], 0
jne 0x14000530c
xor r8d, r8d
jmp 0x140005310
lea r8, [rbx + 0x10]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
movsxd rcx, eax
mov qword [rbx], rcx
mov eax, dword [rsp + 0x70]
mov qword [rbx + 8], rax
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000534c
mov dword [rsp + 0x50], 0xc0190060
jmp case.0x140004a6a.2285861
mov rax, qword [rdi + 0x18]
mov r9, qword [rax]
cmp dword [0x14001a880], r14d
jne 0x14000537b
mov dword [rsp + 0x50], 0xc0000184
jmp case.0x140004a6a.2285861
shl r9, 0xc
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], 1
mov r8, r14
mov rdx, 0xffffffffffffffff
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmAllocatePagesForMdlEx]
mov r13, rax
test rax, rax
je 0x140005487
mov r15d, dword [rax + 0x28]
shr r15, 0xc
lea rdi, [rax + 0x30]
test rdi, rdi
je 0x140005475
mov edx, 0x10
lea ecx, [rdx - 0xf]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x140005475
mov edx, pe_nt_image_headers64
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx], rax
test rax, rax
je 0x14000546a
mov dword [rbx + 8], r14d
mov esi, r14d
mov ecx, r14d
test r15, r15
je 0x14000544e
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi]
shl rdx, 0xc
movsxd rcx, ecx
mov rax, qword [rbx]
mov qword [rax + rcx*8], rdx
inc dword [rbx + 8]
mov ecx, dword [rbx + 8]
cmp ecx, 0x20
jne 0x14000543d
mov edx, ecx
mov rcx, qword [rbx]
call fcn.14000aa30
mov dword [rbx + 8], r14d
mov ecx, r14d
inc esi
add rdi, 8
movsxd rax, esi
cmp rax, r15
jb 0x140005410
mov rax, qword [rbx]
test ecx, ecx
je 0x14000545f
mov edx, ecx
mov rcx, rax
call fcn.14000aa30
mov rax, qword [rbx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x50], r14d
jmp case.0x140004a6a.2285861
mov dword [rsp + 0x50], 0xc00000a0
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0x30], ebx
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x1400054c4
test ebx, ebx
jne 0x1400054b5
mov r14d, dword [rax + 8]
jmp 0x1400054b8
xor r14d, r14d
mov qword [rcx + 0x38], r14
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, ebx
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.14000cd00
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret