Function at 0x15e80
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0x190
push 0
push 0x1e920
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov dword [0x1e800], ecx
push 0x64
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [0x1ef10], eax
cmp dword [0x1ef10], 0
je 0x15ed3
push 0x64
push 0
mov edx, dword [0x1ef10]
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax + 8]
shl ecx, 2
push ecx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [0x1eef4], eax
cmp dword [0x1eef4], 0
je 0x15f32
mov dword [ebp - 4], 0
jmp 0x15f07
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x15f30
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [0x1eef4]
mov esi, dword [ebp - 4]
mov eax, dword [eax + esi*4]
mov dword [edx + ecx*4], eax
jmp 0x15efe
jmp 0x15f3c
mov eax, 0xc0000001
jmp 0x16270
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx]
mov eax, dword [0x1ef2c]
mov ecx, dword [edx + eax*4]
mov dword [0x1e6b0], ecx
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [0x1e784]
mov edx, dword [eax + ecx*4]
mov dword [0x1e744], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov edx, dword [0x1e708]
mov eax, dword [ecx + edx*4]
mov dword [0x1ef00], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx]
mov eax, dword [0x1e89c]
mov ecx, dword [edx + eax*4]
mov dword [0x1e73c], ecx
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [0x1e724]
mov edx, dword [eax + ecx*4]
mov dword [0x1e794], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov edx, dword [0x1eab0]
mov eax, dword [ecx + edx*4]
mov dword [0x1ef04], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx]
mov eax, dword [0x1def4]
mov ecx, dword [edx + eax*4]
mov dword [0x1e690], ecx
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [0x1eef0]
mov edx, dword [eax + ecx*4]
mov dword [0x1e88c], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov edx, dword [0x1df18]
mov eax, dword [ecx + edx*4]
mov dword [0x1e810], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx]
mov eax, dword [0x1df0c]
mov ecx, dword [edx + eax*4]
mov dword [0x1df14], ecx
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [0x1df10]
mov edx, dword [eax + ecx*4]
mov dword [0x1e804], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov edx, dword [0x1eab8]
mov eax, dword [ecx + edx*4]
mov dword [0x1e714], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx]
mov eax, dword [0x1e734]
mov ecx, dword [edx + eax*4]
mov dword [0x1e8a4], ecx
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [0x1df1c]
mov edx, dword [eax + ecx*4]
mov dword [0x1e780], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov edx, dword [0x1e8cc]
mov eax, dword [ecx + edx*4]
mov dword [0x1e8f8], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx]
mov eax, dword [0x1e878]
mov ecx, dword [edx + eax*4]
mov dword [0x1e720], ecx
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [0x1e7a4]
mov edx, dword [eax + ecx*4]
mov dword [0x1e774], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov edx, dword [0x1e8ec]
mov eax, dword [ecx + edx*4]
mov dword [0x1e718], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx]
mov eax, dword [0x1e70c]
mov ecx, dword [edx + eax*4]
mov dword [0x1ef28], ecx
mov edx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [edx]
mov ecx, dword [0x1e728]
mov edx, dword [eax + ecx*4]
mov dword [0x1e8c8], edx
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [eax]
mov edx, dword [0x1ef14]
mov eax, dword [ecx + edx*4]
mov dword [0x1e6f4], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edx, dword [ecx + 1]
push edx
push 0x1bd40
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, 0x10a30
mov ecx, dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edx, dword [ecx + 1]
mov ecx, dword [0x1eef4]
lea edx, [ecx + edx*4]
xchg dword [edx], eax
mov dword [0x1e818], eax
xor eax, eax
mov dword [0x1e7c0], eax
mov dword [0x1e7c4], eax
mov dword [0x1e7c8], eax
mov dword [0x1e7cc], eax
mov dword [0x1e7d0], eax
mov dword [0x1e7d4], eax
mov dword [0x1e7d8], eax
mov word [0x1e7dc], ax
push 0xa
push 0x1e
mov ecx, dword [0x1e818]
push ecx
push 0x1e7c0
call fcn.00019a40
mov edx, 0x108a0
mov eax, dword [0x1eef0]
mov ecx, dword [0x1eef4]
lea eax, [ecx + eax*4]
xchg dword [eax], edx
mov ecx, 0x109a0
mov edx, dword [0x1def4]
mov eax, dword [0x1eef4]
lea edx, [eax + edx*4]
xchg dword [edx], ecx
xor eax, eax
mov dword [0x1e7e0], eax
mov dword [0x1e7e4], eax
mov dword [0x1e7e8], eax
mov dword [0x1e7ec], eax
mov dword [0x1e7f0], eax
mov dword [0x1e7f4], eax
mov dword [0x1e7f8], eax
mov word [0x1e7fc], ax
push 7
push 0x1e
mov ecx, dword [0x1e690]
push ecx
push 0x1e7e0
call fcn.00019a40
mov edx, 0x12900
mov eax, dword [0x1e724]
mov ecx, dword [0x1eef4]
lea eax, [ecx + eax*4]
xchg dword [eax], edx
xor ecx, ecx
mov dword [0x1e820], ecx
mov dword [0x1e824], ecx
mov dword [0x1e828], ecx
mov dword [0x1e82c], ecx
mov dword [0x1e830], ecx
mov dword [0x1e834], ecx
mov dword [0x1e838], ecx
mov word [0x1e83c], cx
push 0xa
push 0x1e
mov edx, dword [0x1e794]
push edx
push 0x1e820
call fcn.00019a40
cmp dword [0x1e748], 5
jne 0x1626e
cmp dword [0x1eee8], 1
jne 0x1626e
mov eax, 0x159c0
mov ecx, dword [0x1df0c]
mov edx, dword [0x1eef4]
lea ecx, [edx + ecx*4]
xchg dword [ecx], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret