Function at 0x14a58
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x928
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x918], rax
mov r8d, 0x100
mov edx, 0xff
lea rcx, [rsp + 0x7d0]
call fcn.0001b210
mov r11d, 4
mov word [rsp + 0x50], r11w
mov eax, 8
mov word [rsp + 0x40], ax
mov r8d, 0x28
mov edx, 0xff
lea rcx, [rsp + 0x4b0]
call fcn.0001b210
mov r8d, 0x28
mov edx, 0xff
lea rcx, [rsp + 0x488]
call fcn.0001b210
mov r11d, 4
mov word [rsp + 0x650], r11w
mov eax, 8
mov word [rsp + 0x7b8], ax
xor edx, edx
lea rcx, [rsp + 0x7d0]
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
mov dword [rsp + 0x648], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x648]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x4d8], eax
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
call fcn.00012144
mov rax, qword [0x00023598]
add rax, 0x4521
mov qword [rsp + 0x8e0], rax
xor eax, eax
mov word [rsp + 0x8f8], ax
jmp 0x14b6e
movzx eax, word [rsp + 0x8f8]
add eax, 4
mov word [rsp + 0x8f8], ax
movzx eax, word [rsp + 0x8f8]
cmp eax, 0x238
jge 0x14bd3
mov rax, qword [0x000232b0]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x4d8]
xor eax, 0xc0000042
add ecx, eax
mov rax, qword [rsp + 0x8e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x8e0]
add rax, 1
mov qword [rsp + 0x8e0], rax
mov rax, qword [0x000232b0]
add rax, 1
mov qword [0x000232b0], rax
jmp 0x14b5b
xor r8d, r8d
mov edx, 4
mov ecx, 0xff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuerySetVolumeInformation]
mov rax, qword [0x00023598]
add rax, 0x4750
mov qword [rsp + 0x8d8], rax
xor r8d, r8d
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.ntoskrnl.exe_RtlSetGroupSecurityDescriptor]
xor eax, eax
mov word [rsp + 0x8f8], ax
jmp 0x14c33
movzx eax, word [rsp + 0x8f8]
add eax, 4
mov word [rsp + 0x8f8], ax
movzx eax, word [rsp + 0x8f8]
cmp eax, 0x27c
jge 0x14cd4
mov edx, 0x8bc8
lea rcx, [rsp + 0x660]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
mov r11, qword [rsp + 0x930]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0x4d8], 0xc0000022
jne 0x14c84
mov dword [rsp + 0x8fc], 0x4c
jmp 0x14c8f
mov dword [rsp + 0x8fc], 0xbcf0
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x8fc]
mov rax, qword [rsp + 0x8d8]
mov byte [rax], cl
mov rax, qword [rsp + 0x8d8]
add rax, 1
mov qword [rsp + 0x8d8], rax
mov rax, qword [rsp + 0x930]
add rax, 1
mov qword [rsp + 0x930], rax
jmp 0x14c20
lea rcx, [0x0001e8a0]
call fcn.000144e0
mov rax, qword [0x00023598]
add rax, 0x440a
mov qword [rsp + 0x7b0], rax
xor eax, eax
mov word [rsp + 0x8f8], ax
jmp 0x14d14
movzx eax, word [rsp + 0x8f8]
add eax, 4
mov word [rsp + 0x8f8], ax
movzx eax, word [rsp + 0x8f8]
cmp eax, 0x29c
jge 0x14d9a
mov rax, qword [0x000232b8]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x4d8], 0xc0000022
jne 0x14d4c
mov dword [rsp + 0x900], 0x84
jmp 0x14d57
mov dword [rsp + 0x900], 0x6fa2
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x900]
mov rax, qword [rsp + 0x7b0]
mov byte [rax], cl
mov rax, qword [rsp + 0x7b0]
add rax, 1
mov qword [rsp + 0x7b0], rax
mov rax, qword [0x000232b8]
add rax, 1
mov qword [0x000232b8], rax
jmp 0x14d01
mov rax, qword [0x00023598]
add rax, 0x44b1
mov qword [rsp + 0x640], rax
xor eax, eax
mov word [rsp + 0x8f8], ax
jmp 0x14dce
movzx eax, word [rsp + 0x8f8]
add eax, 4
mov word [rsp + 0x8f8], ax
movzx eax, word [rsp + 0x8f8]
cmp eax, 0x1c0
jge 0x14e8d
mov edx, 0xdbc8
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
mov r11, qword [0x000232c0]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0x4d8], 0xc0000022
jne 0x14e1e
mov dword [rsp + 0x904], 0x34
jmp 0x14e29
mov dword [rsp + 0x904], 0x3fab
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x904]
mov rax, qword [rsp + 0x640]
mov byte [rax], cl
mov rax, qword [sym.imp.ntoskrnl.exe_IoRemoveShareAccess]
mov qword [0x00023570], rax
mov rax, qword [rsp + 0x640]
add rax, 1
mov qword [rsp + 0x640], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov rax, qword [0x000232c0]
add rax, 1
mov qword [0x000232c0], rax
jmp 0x14dbb
mov rax, qword [0x00023598]
add rax, 0x45af
mov qword [rsp + 0x4e0], rax
xor r8d, r8d
lea rdx, [rsp + 0x8e8]
lea rcx, [rsp + 0x488]
call qword [sym.imp.ntoskrnl.exe_RtlSetGroupSecurityDescriptor]
xor eax, eax
mov word [rsp + 0x8f8], ax
jmp 0x14eda
movzx eax, word [rsp + 0x8f8]
add eax, 4
mov word [rsp + 0x8f8], ax
movzx eax, word [rsp + 0x8f8]
cmp eax, 0x24c
jge 0x14f4d
mov rax, qword [0x000232c8]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x4d8]
xor eax, 0xc0000073
add ecx, eax
mov rax, qword [rsp + 0x4e0]
mov byte [rax], cl
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_InitializeSListHead]
mov rax, qword [rsp + 0x4e0]
add rax, 1
mov qword [rsp + 0x4e0], rax
mov rax, qword [0x000232c8]
add rax, 1
mov qword [0x000232c8], rax
jmp 0x14ec7
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x908], eax
cmp dword [rsp + 0x908], 1
je 0x14f9d
cmp dword [rsp + 0x908], 2
je 0x14fab
cmp dword [rsp + 0x908], 0x1000
je 0x14fbe
cmp dword [rsp + 0x908], 0x2000
je 0x14fcb
cmp dword [rsp + 0x908], 0x4004
je 0x14fd9
jmp 0x14ff5
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x14ff5
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x14ff5
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x14ff5
lea rcx, [0x00021150]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14ff5
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023598]
add rax, 0x4642
mov qword [rsp + 0x8d0], rax
xor eax, eax
mov word [rsp + 0x8f8], ax
jmp 0x15029
movzx eax, word [rsp + 0x8f8]
add eax, 4
mov word [rsp + 0x8f8], ax
movzx eax, word [rsp + 0x8f8]
cmp eax, 0x1e4
jge 0x150af
mov rax, qword [0x000232d0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x4d8], 0xc0000022
jne 0x15061
mov dword [rsp + 0x90c], 0x6d
jmp 0x1506c
mov dword [rsp + 0x90c], 0x6e98
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x90c]
mov rax, qword [rsp + 0x8d0]
mov byte [rax], cl
mov rax, qword [rsp + 0x8d0]
add rax, 1
mov qword [rsp + 0x8d0], rax
mov rax, qword [0x000232d0]
add rax, 1
mov qword [0x000232d0], rax
jmp 0x15016
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023598]
add rax, 0x46bb
mov qword [rsp + 0x60], rax
xor eax, eax
mov word [rsp + 0x8f8], ax
jmp 0x150eb
movzx eax, word [rsp + 0x8f8]
add eax, 4
mov word [rsp + 0x8f8], ax
movzx eax, word [rsp + 0x8f8]
cmp eax, 0x254
jge IoAcquireRemoveLockEx
mov r8b, 1
lea rdx, [rsp + 0x7b8]
lea rcx, [rsp + 0x650]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov r11, qword [0x000232d8]
mov al, byte [r11]
mov byte [0x000235a4], al
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x910], eax
cmp dword [rsp + 0x910], 1
je 0x15177
cmp dword [rsp + 0x910], 2
je 0x15185
cmp dword [rsp + 0x910], 0x1000
je 0x15198
cmp dword [rsp + 0x910], 0x2000
je 0x151a5
cmp dword [rsp + 0x910], 0x4004
je 0x151b3
jmp 0x151cf
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x151cf
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x151cf
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x151cf
lea rcx, [0x00021160]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x151cf
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
cmp dword [rsp + 0x4d8], 0xc0000022
jne 0x151e9
mov dword [rsp + 0x914], 0xff
jmp 0x151f4
mov dword [rsp + 0x914], 0x9e44
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x914]
mov rax, qword [rsp + 0x60]
mov byte [rax], cl
mov rax, qword [rsp + 0x60]
add rax, 1
mov qword [rsp + 0x60], rax
mov rax, qword [0x000232d8]
add rax, 1
mov qword [0x000232d8], rax
jmp 0x150d8
mov rcx, qword [rsp + 0x918]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x928
ret