Function at 0x160a0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov eax, r8d
mov r13, rdx
mov edi, 1
lock xadd dword [0x0001b1e0], edi
mov ebp, dword [rsp + 0x120]
mov r10, qword [rsp + 0x110]
add edi, 1
test ebp, ebp
jne 0x160ef
mov ebp, dword [r10 + 0x1c]
mov r15d, dword [rsp + 0x118]
test r15d, r15d
jne 0x16100
mov r15d, dword [r10 + 0x10]
and dword [rsp + 0x110], 0
mov ecx, dword [r10]
cmp eax, 1
mov al, byte [r10 + 0x18]
sete byte [rsp + 0x118]
lea r12, [0x00010000]
and eax, 3
test cl, cl
jns 0x16132
mov r12, qword [r12 + rax*8 + 0xb160]
jmp 0x1613a
mov r12, qword [r12 + rax*8 + 0xb180]
cmp r9d, 0xa
mov rax, qword [r10 + 8]
mov esi, dword [rsp + 0x140]
mov qword [rsp + 0x88], rax
jne 0x161af
mov ebx, r15d
imul ebx, ebx, 0xff
cmp esi, ebx
jg 0x16168
cmp esi, ebp
jg 0x16168
mov ebx, esi
jmp 0x1616d
cmp ebx, ebp
cmovg ebx, ebp
xor edx, edx
mov dword [rsp + 0x40], r15d
lea eax, [rbx + rsi - 1]
div ebx
lea r14, [0x00019750]
lea rdx, [0x00019700]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ecx
mov r9d, edi
mov r8, r12
mov rcx, r14
mov dword [rsp + 0x140], eax
call fcn.0001717c
jmp 0x161f1
cmp esi, ebp
mov ebx, esi
lea r14, [0x00019750]
cmovg ebx, ebp
xor edx, edx
mov r9d, edi
lea eax, [rbx + rsi - 1]
mov r8, r12
div ebx
lea rdx, [0x00019760]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ecx
mov rcx, r14
mov dword [rsp + 0x140], eax
call fcn.0001717c
lea rax, [r13 + 0x78]
mov qword [rax + 0x18], r12
mov dword [rax + 0x10], edi
mov qword [rax + 8], rax
mov qword [rax], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x18]
mov al, byte [rax + 0x4c]
mov byte [rsp + 0x120], al
mov rax, qword [rsp + 0x138]
mov ecx, dword [rax + 0x2c]
add rcx, qword [rax + 0x20]
mov qword [rsp + 0x70], rcx
jne 0x1624e
lea rdx, [0x000197a0]
mov r9d, edi
mov r8, r12
mov rcx, r14
call fcn.000170fc
mov ebx, 0xc000009a
jmp 0x166ed
mov eax, dword [rsp + 0x140]
mov r8d, 0x30425355
xor ecx, ecx
mov qword [rsp + 0x60], rax
shl rax, 3
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [rsp + 0x68], rax
jne 0x16298
lea rdx, [0x000197d0]
mov r8, r12
mov r9d, edi
mov rcx, r14
call fcn.000170fc
mov ebx, 0xc000009a
jmp 0x1666d
mov r8d, dword [rsp + 0x140]
xor edx, edx
mov rcx, rax
shl r8, 3
call fcn.000177a0
mov ecx, dword [rsp + 0x140]
and dword [rsp + 0x50], 0
test ecx, ecx
je 0x165a0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov edx, 0x50
xor ecx, ecx
mov r8d, 0x30425355
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [rsp + 0x58], rax
je 0x1665c
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x50]
call fcn.000177a0
mov rdx, qword [rsp + 0x58]
lea rax, [r13 + 0x78]
mov rcx, qword [rax + 8]
lea r11, [rdx + 8]
mov qword [r11], rax
mov qword [r11 + 8], rcx
mov qword [rcx], r11
mov cl, byte [rsp + 0x120]
mov qword [rax + 8], r11
mov rax, qword [rsp + 0x78]
mov qword [rax], rdx
mov eax, dword [rsp + 0x110]
mov qword [rdx], r13
mov dword [rdx + 0x48], eax
mov dword [rdx + 0x28], 1
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IoAllocateIrp]
test rax, rax
mov rcx, rax
mov qword [rsp + 0x98], rax
je 0x16650
cmp word [rsp + 0x108], 0xa
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x30], rcx
jne 0x16389
lea eax, [rbx + r15 - 1]
cdq
idiv r15d
mov dword [rsp + 0xf8], eax
lea ecx, [rax + rax*2]
lea eax, [rcx*4 + 0x98]
jmp 0x16397
xor eax, eax
mov dword [rsp + 0xf8], eax
mov eax, 0x80
mov dword [rsp + 0x138], eax
cdqe
mov r8d, 0x30425355
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [rsp + 0x80], rax
je 0x16634
mov r8, qword [rsp + 0x90]
xor edx, edx
mov rcx, rax
call fcn.000177a0
mov r11, qword [rsp + 0x80]
mov r10d, dword [rsp + 0x138]
mov eax, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x70]
and qword [rsp + 0x20], 0
mov word [r11], r10w
mov word [r11 + 2], ax
mov rax, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov qword [rax + 0x38], r11
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
test rax, rax
mov qword [rsp + 0x138], rax
je 0x16628
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x70]
mov r9d, ebx
mov qword [rcx + 0x40], rax
mov rcx, qword [r13 + 8]
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_IoBuildPartialMdl]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov r10d, dword [rsp + 0x108]
mov qword [rcx + 0x18], rax
mov eax, dword [rsp + 0x100]
mov dword [rcx + 0x20], eax
mov rax, qword [rsp + 0x138]
mov r11d, ebx
add qword [rsp + 0x70], r11
sub esi, ebx
cmp r10d, 0xa
mov qword [rcx + 0x30], rax
mov dword [rcx + 0x24], ebx
jne 0x16516
mov eax, dword [rsp + 0xf8]
xor r8d, r8d
cmp byte [rsp + 0x118], r8b
mov dword [rcx + 0x84], eax
je 0x164e3
test eax, eax
je 0x16516
lea rdx, [rcx + 0x90]
mov r9, rax
and dword [rdx], 0
cmp ebx, r15d
mov dword [rdx - 4], r8d
jbe 0x164d2
add r8d, r15d
sub ebx, r15d
jmp 0x164d7
add r8d, ebx
xor ebx, ebx
add rdx, 0xc
sub r9, 1
jne 0x164be
jmp 0x16516
test eax, eax
je 0x16516
lea rdx, [rcx + 0x90]
mov r9, rax
cmp ebx, r15d
mov dword [rdx - 4], r8d
jbe 0x16505
add r8d, r15d
mov dword [rdx], r15d
sub ebx, r15d
jmp 0x1650c
mov dword [rdx], ebx
add r8d, ebx
xor ebx, ebx
add rdx, 0xc
sub r9, 1
jne 0x164f1
cmp r10d, 0xa
mov rdx, qword [rsp + 0x98]
mov rax, qword [rdx + 0xb8]
mov qword [rax - 0x40], rcx
mov byte [rax - 0x48], 0xf
mov dword [rax - 0x30], 0x220003
mov rax, qword [rdx + 0xb8]
lea rcx, [0x00016754]
mov qword [rax - 0x10], rcx
mov rcx, qword [rsp + 0x58]
mov byte [rax - 0x45], 0xe0
mov qword [rax - 8], rcx
jne 0x16572
mov ebx, r15d
imul ebx, ebx, 0xff
cmp esi, ebx
jg 0x1656e
cmp esi, ebp
jg 0x1656e
mov ebx, esi
jmp 0x16579
cmp ebx, ebp
jmp 0x16576
mov ebx, esi
cmp esi, ebp
cmovg ebx, ebp
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x140]
add dword [rsp + 0x110], ebx
add qword [rsp + 0x78], 8
add eax, 1
cmp eax, ecx
mov dword [rsp + 0x50], eax
jb 0x162cc
cmp byte [r13 + 0x44], 0
jne 0x16668
mov rax, qword [r13 + 0xb8]
or byte [rax + 3], 1
test ecx, ecx
lea rax, [0x000169e0]
xchg qword [r13 + 0x68], rax
je 0x16611
mov rdi, qword [rsp + 0x68]
mov esi, dword [rsp + 0x130]
mov rbp, qword [rsp + 0xf0]
mov rbx, qword [rdi]
mov r9d, dword [rsp + 0x128]
mov rdx, r13
mov r8, qword [rbx + 0x38]
mov rcx, rbp
mov dword [rsp + 0x20], esi
call fcn.00016acc
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
add rdi, 8
sub qword [rsp + 0x60], 1
jne 0x165d9
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0x103
jmp 0x1673a
lea rdx, [0x000198a0]
jmp 0x16280
lea rdx, [0x00019870]
mov r9d, edi
mov r8, r12
mov rcx, r14
mov ebx, 0xc000009a
call fcn.000170fc
jmp 0x1666d
lea rdx, [0x00019840]
jmp 0x16280
lea rdx, [0x00019810]
jmp 0x16280
mov ebx, 0xc0000120
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x166ed
cmp dword [rsp + 0x140], 0
jbe 0x166e2
mov eax, dword [rsp + 0x140]
mov rbp, r15
mov rsi, qword [rbp]
test rsi, rsi
je 0x166d3
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x166a3
call qword [sym.imp.ntoskrnl.exe_IoFreeIrp]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x166b4
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x166c3
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x60]
add rbp, 8
sub rax, 1
mov qword [rsp + 0x60], rax
jne 0x1668b
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [r13 + 0x38], 0
xor edx, edx
mov rcx, r13
mov dword [r13 + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea rdx, [0x000198d0]
mov r9d, edi
mov r8, r12
mov rcx, r14
mov dword [rsp + 0x20], ebx
call fcn.000170fc
mov rax, qword [rsp + 0xf0]
lock add dword [rax + 0x20], 0xffffffff
jne 0x16738
lea rcx, [rax + 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov eax, ebx
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret