Function at 0x1400031fc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0x28]
add rcx, 0x48
call fcn.140002430
xor esi, esi
cmp qword [0x140012108], rsi
je 0x14000322f
cmp qword [0x140012100], rsi
jne 0x14000324b
lea rcx, [0x140012100]
call fcn.1400074b4
test eax, eax
jns 0x14000324b
lea rcx, [0x140009d10]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x140012118], rsi
je 0x14000325d
cmp qword [0x140012110], rsi
jne 0x140003279
lea rcx, [0x140012110]
call fcn.1400070e8
test eax, eax
jns 0x140003279
lea rcx, [0x140009d20]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x140012118], rsi
je 0x14000328b
cmp qword [0x140012110], rsi
jne 0x1400032a7
lea rcx, [0x140012110]
call fcn.140007298
test eax, eax
jns 0x1400032a7
lea rcx, [0x140009d40]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockAtDpcLevel]
mov qword [0x140012460], rax
mov rax, qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLockFromDpcLevel]
mov qword [0x140012458], rax
mov rax, qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov qword [0x140012450], rax
mov rax, qword [sym.imp.ntoskrnl.exe_IoReleaseRemoveLockEx]
mov qword [0x140012448], rax
call fcn.140004de0
lea rax, [0x140012420]
lea rcx, [0x140012340]
mov qword [0x140012428], rax
mov qword [0x140012420], rax
call qword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
mov word [rsp + 0x30], si
lea rcx, [0x140012140]
mov dword [rsp + 0x28], 0x6c6a6e69
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x20
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], si
lea rcx, [0x1400121c0]
mov dword [rsp + 0x28], 0x646a6e69
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x18
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
xor edx, edx
lea rcx, [0x1400123c0]
lea r8d, [rdx + 0x60]
call fcn.1400098c0
lea rcx, [0x140009d60]
call fcn.140008598
mov ecx, eax
call fcn.1400065bc
lea rcx, [0x140009d80]
mov qword [0x140012320], rax
call fcn.140008598
mov ecx, eax
call fcn.1400065bc
lea rcx, [0x140009da0]
mov qword [0x140012318], rax
call fcn.140008598
mov ecx, eax
call fcn.1400065bc
lea rcx, [0x140009dc0]
mov qword [0x140012310], rax
call fcn.140008598
mov ecx, eax
call fcn.1400065bc
lea rcx, [0x140009de0]
mov qword [0x140012308], rax
call fcn.140008598
mov ecx, eax
call fcn.1400065bc
cmp qword [0x140012320], rsi
mov qword [0x140012300], rax
je 0x1400034ae
cmp qword [0x140012318], rsi
je 0x1400034ae
cmp qword [0x140012310], rsi
je 0x1400034ae
cmp qword [0x140012308], rsi
je 0x1400034ae
lea rcx, [0x140004ac0]
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
xor edx, edx
mov ebx, eax
test eax, eax
jns 0x14000344d
mov rcx, qword [0x140012128]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x1400034ce
lea rcx, [0x140002400]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
mov ebx, eax
test eax, eax
jns 0x140003471
lea rcx, [0x140004ac0]
call qword [sym.imp.ntoskrnl.exe_PsRemoveLoadImageNotifyRoutine]
xor edx, edx
jmp 0x140003439
lea rcx, [0x140002630]
call fcn.140001c84
call fcn.1400047b4
lea rcx, [0x140012280]
call fcn.1400083f8
call fcn.140001c3c
lea rcx, [0x140009e10]
call sub.ntoskrnl.exe_DbgPrint
lea rax, [0x1400034e0]
mov qword [rdi + 0x68], rax
xor eax, eax
jmp 0x1400034ce
lea rcx, [0x140009e00]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x140012128]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret