Function at 0x1a864
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor r14d, r14d
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
cmp rdx, r14
je 0x1b033
cmp edi, r14d
jle 0x1b033
cmp byte [0x00025742], r14b
je 0x1a8b7
lea rcx, [0x00021340]
mov r8d, edi
call sub.ntoskrnl.exe_DbgPrint
cmp edi, r14d
jbe 0x1a91b
cmp byte [0x00025742], r14b
je 0x1a91b
lea eax, [rdi + 1]
xor ecx, ecx
mov edx, eax
mov r12d, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
cmp rax, r14
je 0x1a91b
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.0001ce80
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.0001cf80
cmp byte [0x00025742], r14b
je 0x1a910
lea rcx, [0x00021370]
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add dword [rbx + 0x2c], edi
mov r12d, 4
cmp dword [rbx + 0x28], r12d
jae 0x1ac8e
cmp edi, r12d
jl 0x1a975
lea rdx, [0x00021390]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1a975
cmp byte [0x00025742], r14b
je 0x1a960
lea rcx, [0x000213a0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rbx
call fcn.00018fd0
mov ebp, 1
mov dword [rbx + 0x28], ebp
jmp 0x1b048
mov eax, dword [rbx + 0x28]
cmp eax, r14d
jne 0x1a9d1
cmp edi, r12d
jl 0x1ac6d
lea rdx, [0x000213c0]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
je 0x1a9ba
lea rdx, [0x000213d0]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1ac6d
cmp byte [0x00025742], r14b
je 0x1a968
lea rcx, [0x000213e0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1a968
mov ebp, 1
cmp eax, ebp
jne 0x1aa6a
lea r8d, [rbp + 9]
cmp edi, r8d
jle 0x1ac6d
lea rdx, [0x00021400]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1ac6d
cmp byte [0x00025742], r14b
je 0x1aa19
lea rcx, [0x00021410]
call sub.ntoskrnl.exe_DbgPrint
lea edx, [rdi - 0xa]
lea rcx, [rsi + 0xa]
call fcn.00019088
mov rdi, rax
cmp rax, r14
je 0x1aa5e
cmp byte [0x00025742], r14b
je 0x1aa45
lea rcx, [0x00021430]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x1aa5a
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 8], r14
mov qword [rbx + 8], rdi
mov dword [rbx + 0x28], 2
jmp 0x1ac6d
cmp eax, 2
jne 0x1aaff
cmp edi, 8
jle 0x1ac6d
lea r8d, [rax + 6]
lea rdx, [0x00021450]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1ac6d
cmp byte [0x00025742], r14b
je 0x1aaae
lea rcx, [0x00021460]
call sub.ntoskrnl.exe_DbgPrint
lea edx, [rdi - 8]
lea rcx, [rsi + 8]
call fcn.00019088
mov rdi, rax
cmp rax, r14
je 0x1aaf3
cmp byte [0x00025742], r14b
je 0x1aada
lea rcx, [0x00021480]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
je 0x1aaef
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x28], 3
jmp 0x1ac6d
cmp eax, 3
jne 0x1ac6d
cmp edi, r12d
jl 0x1ab43
lea rdx, [0x000214a0]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1ab43
cmp byte [0x00025742], r14b
je 0x1ab3a
lea rcx, [0x000214b0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rbx + 0x28], r12d
jmp 0x1ac6d
cmp edi, 8
jle 0x1ac6d
lea rdx, [0x00021450]
mov r8d, 8
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1ac6d
cmp byte [0x00025742], r14b
je 0x1ab80
lea rcx, [0x00021460]
call sub.ntoskrnl.exe_DbgPrint
lea edx, [rdi - 8]
lea rcx, [rsi + 8]
call fcn.00019088
mov rsi, rax
cmp rax, r14
je 0x1ac6d
cmp byte [0x00025742], r14b
je 0x1abb0
lea rcx, [0x00021480]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rdi, qword [rbx + 0x10]
cmp rdi, r14
jne 0x1abc2
mov qword [rbx + 0x10], rsi
jmp 0x1ac6d
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
repne scasb al, byte [rdi]
mov rdi, rsi
not rcx
sub rcx, rbp
mov rdx, rcx
mov rcx, r13
repne scasb al, byte [rdi]
not rcx
sub rcx, rbp
lea eax, [rdx + rcx + 2]
xor ecx, ecx
mov edx, eax
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r12, rax
cmp rax, r14
je 0x1ac62
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0001ce80
mov rax, qword [rbx + 0x10]
mov rcx, r12
mov dl, byte [rax]
add rax, rbp
mov byte [rcx], dl
add rcx, rbp
cmp dl, r14b
jne 0x1ac10
xor eax, eax
mov rdi, r12
mov rcx, r13
repne scasb al, byte [rdi]
movzx eax, word [0x0001fc00]
mov rcx, r13
sub rdi, rbp
mov word [rdi], ax
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
sub rdi, rbp
xor ecx, ecx
mov al, byte [rsi + rcx]
mov byte [rdi + rcx], al
add rcx, rbp
test al, al
jne 0x1ac45
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x10], r12
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x00025742], r14b
je 0x1b048
mov edx, dword [rbx + 0x28]
lea rcx, [0x000214d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1b048
jne 0x1adee
mov dword [rbx + 0x28], 6
cmp byte [0x00025742], r14b
je 0x1acc7
lea rcx, [0x00021500]
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x00025742], r14b
je 0x1acc7
lea rcx, [0x00021530]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
mov edx, edi
mov rcx, rsi
call fcn.0001965c
mov rbp, rax
cmp rax, r14
je 0x1ad25
cmp byte [0x00025742], r14b
je 0x1acf1
lea rcx, [0x00021550]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x10]
mov rdx, rbp
call fcn.00019440
xor edx, edx
mov rcx, rbp
mov qword [rbx + 0x10], rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x00025742], r14b
je 0x1ad25
mov rdx, qword [rbx + 0x10]
lea rcx, [0x00021570]
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 9
jle 0x1adee
lea r8, [0x00020000]
mov r9d, 9
mov edx, edi
mov rcx, rsi
call fcn.000189d4
or r13, 0xffffffffffffffff
cmp eax, r13d
je 0x1adee
sub edi, eax
add eax, 9
xor r8d, r8d
movsxd rcx, eax
sub edi, 9
add rcx, rsi
mov edx, edi
mov rsi, rcx
call fcn.00019150
mov rbp, rax
cmp rax, r14
je 0x1adee
sub ebp, esi
cmp qword [rbx + 0x18], r14
jne 0x1adee
lea ecx, [rbp + 1]
mov r12d, ecx
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx + 0x18], rax
cmp rax, r14
je 0x1adee
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.0001ce80
mov rcx, qword [rbx + 0x18]
mov r8d, ebp
mov rdx, rsi
call fcn.0001cf80
mov rcx, qword [rbx + 0x18]
mov edx, ebp
call fcn.0001919c
mov rbp, rax
cmp rax, r14
je 0x1add5
mov rcx, qword [rbx + 0x18]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x18], rbp
cmp byte [0x00025742], r14b
je 0x1adee
mov rdx, qword [rbx + 0x18]
lea rcx, [0x000215a0]
call sub.ntoskrnl.exe_DbgPrint
mov edx, dword [rbx + 0x28]
cmp edx, 8
jne 0x1ae0f
cmp byte [0x00025742], r14b
je 0x1b048
lea rcx, [0x000215c0]
jmp 0x1b043
cmp edx, 6
je 0x1ae1d
cmp edx, 7
jne 0x1b007
mov r12, rsi
mov r13d, edi
mov bpl, r14b
cmp byte [0x00025742], r14b
je 0x1ae3b
lea rcx, [0x000215e0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rbx + 0x58]
cmp eax, r14d
jbe 0x1aee7
lea r13d, [rax + rdi]
xor ecx, ecx
mov ebp, 1
mov edx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r12, rax
cmp rax, r14
jne 0x1ae97
mov rcx, qword [rbx + 0x60]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x60], r14
mov dword [rbx + 0x58], r14d
mov dword [rbx + 0x28], 8
cmp byte [0x00025742], r14b
je 0x1b048
lea rcx, [0x00021610]
jmp 0x1b043
mov r8d, dword [rbx + 0x58]
mov rdx, qword [rbx + 0x60]
mov rcx, rax
call fcn.0001cf80
cmp byte [0x00025742], r14b
je 0x1aec2
mov edx, dword [rbx + 0x58]
lea rcx, [0x00021630]
mov r8, r12
call sub.ntoskrnl.exe_DbgPrint
mov ecx, dword [rbx + 0x58]
mov r8d, edi
mov rdx, rsi
add rcx, r12
call fcn.0001cf80
mov rcx, qword [rbx + 0x60]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x60], r14
mov dword [rbx + 0x58], r14d
cmp r13d, r14d
mov rdi, r12
mov eax, r13d
jle 0x1af3c
mov esi, dword [rbx + 0x28]
cmp esi, 6
jne 0x1af0a
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.000198d0
jmp 0x1af1d
cmp esi, 7
jne 0x1af22
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.0001a360
mov rdi, rax
jmp 0x1af25
mov rdi, r14
cmp rdi, r14
je 0x1af41
cmp esi, dword [rbx + 0x28]
je 0x1af3c
mov eax, r12d
sub eax, edi
add eax, r13d
cmp eax, r14d
jg 0x1aef2
cmp rdi, r14
jne 0x1af5e
mov dword [rbx + 0x28], 8
cmp byte [0x00025742], r14b
je 0x1afdb
lea rcx, [0x00021680]
jmp 0x1afd6
sub edi, r12d
cmp r13d, edi
jle 0x1afdb
sub r13d, edi
xor ecx, ecx
mov edx, r13d
mov esi, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx + 0x60], rax
cmp rax, r14
je 0x1afbf
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.0001ce80
mov rcx, qword [rbx + 0x60]
movsxd rdx, edi
add rdx, r12
mov r8, rsi
call fcn.0001cf80
mov dword [rbx + 0x58], esi
cmp byte [0x00025742], r14b
je 0x1afdb
mov r8, qword [rbx + 0x60]
lea rcx, [0x000216b0]
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1afdb
mov dword [rbx + 0x28], 8
cmp byte [0x00025742], r14b
je 0x1afdb
lea rcx, [0x00021700]
call sub.ntoskrnl.exe_DbgPrint
cmp bpl, r14b
je 0x1afeb
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x00025742], r14b
je 0x1b023
mov r8d, dword [rbx + 0x58]
mov edx, dword [rbx + 0x28]
lea rcx, [0x00021730]
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x00025742], r14b
je 0x1b023
mov r8, qword [rbx + 0x50]
mov edx, dword [rbx + 0x2c]
lea rcx, [0x00021770]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [rbx + 0x50], r14
jne 0x1b048
mov rcx, rbx
call fcn.00017904
jmp 0x1b04a
cmp byte [0x00025742], r14b
je 0x1b048
lea rcx, [0x00021320]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret