Function at 0x140058edc
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r15, r8
mov r14d, edx
mov r13, rcx
mov ebx, 0xc000009a
mov dword [rsp + 0x30], ebx
mov edx, 0x58
xor ecx, ecx
call fcn.140077530
mov rsi, rax
mov qword [rsp + 0x50], rax
xor edi, edi
test rax, rax
je 0x1400591ea
lea edx, [rdi + 0x12]
xor ecx, ecx
call fcn.140077530
mov r12, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400591e2
xor edx, edx
lea r8d, [rdi + 0x58]
mov rcx, rsi
call fcn.1400013f0
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov word [r12 + 0x10], ax
lea eax, [rdi + 0x58]
mov word [rsi], ax
mov byte [rsi + 2], dil
mov qword [rsi + 0x18], r15
mov ecx, dword [rsp + 0xe0]
mov edx, ecx
imul edx, dword [rsp + 0xe8]
mov dword [rsp + 0x40], edx
mov dword [rsi + 0x10], edx
mov word [rsi + 9], 0xa00
mov qword [rsi + 0x20], r12
mov byte [rsi + 0xb], 0x12
mov dword [rsi + 0xc], pe_nt_image_headers64
mov eax, 0x80
lea r8d, [rdi + 0x40]
cmp r14d, 3
cmove eax, r8d
mov dword [rsi + 0xc], eax
mov eax, edx
shr eax, 0xa
inc eax
mov dword [rsi + 0x14], eax
mov edx, dword [rsp + 0xd8]
mov dword [rsi + 0x40], edx
lea eax, [r14 + 0x11]
add al, al
mov byte [rsi + 0x48], al
mov al, byte [rsi + 0x49]
and al, 0x1f
or al, 0x80
mov byte [rsi + 0x49], al
mov eax, edx
shr eax, 0x18
mov byte [rsi + 0x4a], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x4b], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x4c], al
mov byte [rsi + 0x4d], dl
mov eax, ecx
shr eax, 8
mov byte [rsi + 0x4f], al
mov byte [rsi + 0x50], cl
mov rax, qword [r13]
xor edx, edx
mov cl, byte [rax + 0x4c]
call qword [sym.imp.ntoskrnl.exe_IoAllocateIrp]
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400591da
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov r15, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400591d1
xor edx, edx
mov rcx, rax
cmp dword [rsp + 0xc8], 3
jne 0x140059060
xor r8d, r8d
jmp 0x140059066
mov r8d, 1
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
mov al, 1
jmp 0x140059094
cmp al, 1
jne 0x1400591c8
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rax, qword [r14 + 0xb8]
lea rcx, [0x1400797ec]
mov qword [rax - 0x10], rcx
mov qword [rax - 8], rsi
mov byte [rax - 0x45], 0xe0
mov qword [rsi + 0x30], r14
mov qword [r14 + 8], r15
mov dword [r14 + 0x10], 1
mov byte [r14 + 0x40], dil
lea rax, [rsp + 0x58]
mov qword [r14 + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [r14 + 0x50], rax
mov byte [r14 + 0x44], dil
mov qword [r14 + 0x68], rdi
mov rax, qword gs:[0x188]
mov qword [r14 + 0x98], rax
mov dword [r14 + 0x30], edi
mov qword [r14 + 0x38], rdi
mov qword [r14 + 0x18], rdi
mov rcx, qword [r14 + 0xb8]
sub rcx, 0x48
mov byte [rcx], 0xf
mov rax, qword [r13]
mov qword [rcx + 0x28], rax
mov qword [rcx + 8], rsi
dec byte [r14 + 0x43]
mov qword [r14 + 0xb8], rcx
mov rcx, qword [r13 + 0x10]
call fcn.140077ff8
mov rbx, rax
mov rcx, qword [r13 + 0x18]
call fcn.140077ff8
mov r8, rax
mov rax, qword [r13 + 8]
mov r15, qword [rax + 0x60]
mov rax, cr8
mov qword [rsp + 0x38], rax
mov cr8, rdi
mov rax, qword [r13 + 8]
mov qword [rax + 0x60], rbx
mov rdx, r14
mov rcx, qword [r13]
call r8
mov ebx, eax
cmp eax, 0x103
jne 0x140059199
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ebx, dword [rsp + 0x58]
movzx eax, byte [rsp + 0x38]
mov cr8, rax
mov rax, qword [r13 + 8]
mov qword [rax + 0x60], r15
mov rcx, qword [rsi + 0x20]
cmp rcx, r12
je 0x1400591c0
test rcx, rcx
je 0x1400591c0
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test ebx, ebx
js 0x1400591da
mov ebx, edi
jmp 0x1400591da
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoFreeIrp]
mov rcx, r12
call fcn.140077564
mov rcx, rsi
call fcn.140077564
mov eax, ebx
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret