Function at 0x212c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
lea rcx, [0x000270b0]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [0x0002d4e8], 0
jne 0x212de
jmp 0x218e7
lea rcx, [0x000270f0]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x0001fc80]
call fcn.00012260
lea r8, [0x0002d4f0]
mov edx, 8
mov ecx, 1
mov rax, qword [sym.imp.ntoskrnl.exe_HalDispatchTable]
call qword [rax + 0x10]
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x24]
lea rcx, [0x00027130]
call sub.ntoskrnl.exe_DbgPrint
mov byte [0x0002d4dc], 0
cmp qword [0x0002d7b8], 0
je 0x21386
lea rcx, [0x00027160]
call sub.ntoskrnl.exe_DbgPrint
xor r8d, r8d
xor edx, edx
lea rcx, [0x0002d520]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x0002d7b8]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [0x0002d7b8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [0x0002d7b8], 0
cmp qword [0x0002d7a8], 0
je 0x213f4
mov dword [rsp + 0x20], 0
jmp 0x213a5
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x0002d798]
cmp dword [rsp + 0x20], eax
jge 0x213f4
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
add rcx, 0x88
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
movsxd r11, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + r11*8]
add rcx, 0x70
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
jmp 0x2139a
cmp qword [0x0002d508], 0
je 0x21446
lea rcx, [0x00027180]
call sub.ntoskrnl.exe_DbgPrint
xor r8d, r8d
xor edx, edx
lea rcx, [0x0002d780]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x0002d508]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [0x0002d508]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [0x0002d508], 0
cmp qword [0x0002d7a8], 0
je 0x218ad
lea rcx, [0x000271a0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x20], 0
jmp 0x21475
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x0002d798]
cmp dword [rsp + 0x20], eax
jge 0x21878
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x21873
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
add rcx, 0x40
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
movsxd r11, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + r11*8]
add rcx, 0x58
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov edx, dword [rsp + 0x20]
lea rcx, [0x000271d0]
call sub.ntoskrnl.exe_DbgPrint
movsxd r11, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + r11*8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
movsxd r11, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + r11*8]
mov rcx, qword [rcx + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + r11*8]
mov qword [rax + 0x108], 0
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
cmp qword [rax + 0x20], 0
je 0x2158f
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + r11*8]
mov qword [rax + 0x20], 0
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
cmp qword [rax + 0x10], 0
je 0x215ff
cmp dword [0x0002d4ec], 0
je 0x215cb
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x215e7
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
mov qword [rax + 0x10], 0
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
cmp qword [rax + 0x28], 0
je 0x21648
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + r11*8]
mov qword [rax + 0x20], 0
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
cmp qword [rax + 0x18], 0
je 0x216b8
cmp dword [0x0002d4ec], 0
je 0x21684
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x216a0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
mov qword [rax + 0x18], 0
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
cmp qword [rax], 0
je 0x21700
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + r11*8]
mov qword [rax], 0
movsxd rcx, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + rcx*8]
cmp qword [rax + 8], 0
je 0x2174b
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + r11*8]
mov qword [rax + 8], 0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetElementGenericTable]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x21795
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTable]
jmp 0x2174b
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + r11*8]
mov qword [rax + 0x30], 0
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlGetElementGenericTable]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x21813
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTable]
jmp 0x217c9
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov rax, qword [rax + r11*8]
mov qword [rax + 0x38], 0
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd r11, dword [rsp + 0x20]
mov rax, qword [0x0002d7a8]
mov qword [rax + r11*8], 0
jmp 0x2146a
xor edx, edx
mov rcx, qword [0x0002d7a8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [0x0002d5c0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x0002d7a8], 0
lea rcx, [0x00027200]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x0002d4e0], 0
je 0x218db
xor edx, edx
mov rcx, qword [0x0002d4e0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x0002d4e0], 0
mov dword [0x0002d5d8], 0
lea rcx, [0x00027220]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x38
ret