Function at 0x19dc8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x718
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x708], rax
mov r8d, 0xd0
xor edx, edx
lea rcx, [rsp + 0x5d0]
call fcn.0001b210
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x6b8]
call fcn.0001b210
mov qword [rsp + 0x48], 0x160
mov qword [rsp + 0x5c0], 0x174
mov r8d, 0x100
mov edx, 0xff
lea rcx, [rsp + 0x70]
call fcn.0001b210
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x598]
call fcn.0001b210
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_InitializeSListHead]
mov dword [rsp + 0x6a0], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x6a0]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x6b0], eax
mov rax, qword [0x00023598]
add rax, 0x1d92
mov qword [rsp + 0x6d8], rax
xor eax, eax
mov word [rsp + 0x6e0], ax
jmp 0x19eb0
movzx eax, word [rsp + 0x6e0]
add eax, 4
mov word [rsp + 0x6e0], ax
movzx eax, word [rsp + 0x6e0]
cmp eax, 0x224
jge 0x19fe2
mov rax, qword [0x00023508]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x6b0], 0xc0000022
jne 0x19eec
mov dword [rsp + 0x6e4], 0x92
jmp 0x19ef7
mov dword [rsp + 0x6e4], 0xc9c9
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x6e4]
mov rax, qword [rsp + 0x6d8]
mov byte [rax], cl
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x6e8], eax
cmp dword [rsp + 0x6e8], 1
je 0x19f5f
cmp dword [rsp + 0x6e8], 2
je 0x19f6d
cmp dword [rsp + 0x6e8], 0x1000
je 0x19f80
cmp dword [rsp + 0x6e8], 0x2000
je 0x19f8d
cmp dword [rsp + 0x6e8], 0x4004
je 0x19f9b
jmp 0x19fb7
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x19fb7
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x19fb7
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x19fb7
lea rcx, [0x00021230]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x19fb7
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [rsp + 0x6d8]
add rax, 1
mov qword [rsp + 0x6d8], rax
mov rax, qword [0x00023508]
add rax, 1
mov qword [0x00023508], rax
jmp 0x19e9d
mov edx, 0xc000005b
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.ntoskrnl.exe_IoReuseIrp]
lea rcx, [0x0001f3e0]
call fcn.000197b0
mov rax, qword [0x00023598]
add rax, 0x1bd2
mov qword [rsp + 0x188], rax
xor eax, eax
mov word [rsp + 0x6e0], ax
jmp 0x1a035
movzx eax, word [rsp + 0x6e0]
add eax, 4
mov word [rsp + 0x6e0], ax
movzx eax, word [rsp + 0x6e0]
cmp eax, 0x268
jge 0x1a0e3
mov rax, qword [0x00023510]
mov al, byte [rax]
mov byte [0x000235a4], al
lea rdx, [rsp + 0x5b8]
lea rcx, [rsp + 0x170]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
cmp dword [rsp + 0x6b0], 0xc0000022
jne 0x1a087
mov dword [rsp + 0x6ec], 0xef
jmp 0x1a092
mov dword [rsp + 0x6ec], 0xca6e
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x6ec]
mov rax, qword [rsp + 0x188]
mov byte [rax], cl
mov rax, qword [rsp + 0x188]
add rax, 1
mov qword [rsp + 0x188], rax
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023510]
add rax, 1
mov qword [0x00023510], rax
jmp 0x1a022
mov rax, qword [0x00023598]
add rax, 0x1c6c
mov qword [rsp + 0x6a8], rax
xor eax, eax
mov word [rsp + 0x6e0], ax
jmp 0x1a117
movzx eax, word [rsp + 0x6e0]
add eax, 4
mov word [rsp + 0x6e0], ax
movzx eax, word [rsp + 0x6e0]
cmp eax, 0x214
jge 0x1a23e
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x6f0], eax
cmp dword [rsp + 0x6f0], 1
je 0x1a17a
cmp dword [rsp + 0x6f0], 2
je 0x1a188
cmp dword [rsp + 0x6f0], 0x1000
je 0x1a19b
cmp dword [rsp + 0x6f0], 0x2000
je 0x1a1a8
cmp dword [rsp + 0x6f0], 0x4004
je 0x1a1b6
jmp 0x1a1d2
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x1a1d2
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x1a1d2
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x1a1d2
lea rcx, [0x00021240]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1a1d2
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023518]
mov al, byte [rax]
mov byte [0x000235a4], al
xor r8d, r8d
mov edx, 4
mov ecx, 0xff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuerySetVolumeInformation]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x6b0]
xor eax, 0xc00000d3
add ecx, eax
mov rax, qword [rsp + 0x6a8]
mov byte [rax], cl
mov rax, qword [rsp + 0x6a8]
add rax, 1
mov qword [rsp + 0x6a8], rax
mov rax, qword [0x00023518]
add rax, 1
mov qword [0x00023518], rax
jmp 0x1a104
mov rax, qword [0x00023598]
add rax, 0x1cf1
mov qword [rsp + 0x58], rax
xor eax, eax
mov word [rsp + 0x6e0], ax
jmp 0x1a26f
movzx eax, word [rsp + 0x6e0]
add eax, 4
mov word [rsp + 0x6e0], ax
movzx eax, word [rsp + 0x6e0]
cmp eax, 0x284
jge 0x1a2e1
mov rax, qword [0x00023520]
mov al, byte [rax]
mov byte [0x000235a4], al
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x6b8]
call qword [sym.imp.ntoskrnl.exe_IoReleaseRemoveLockEx]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x6b0]
xor eax, 0xc00000e7
add ecx, eax
mov rax, qword [rsp + 0x58]
mov byte [rax], cl
mov rax, qword [rsp + 0x58]
add rax, 1
mov qword [rsp + 0x58], rax
mov rax, qword [0x00023520]
add rax, 1
mov qword [0x00023520], rax
jmp 0x1a25c
mov rdx, qword [rsp + 0x48]
lea rcx, [0x000235b0]
mov rax, qword [rsp + 0x5c0]
lock cmpxchg qword [rcx], rdx
mov rax, qword [0x00023598]
add rax, 0x1e1b
mov qword [rsp + 0x590], rax
xor eax, eax
mov word [rsp + 0x6e0], ax
jmp 0x1a32e
movzx eax, word [rsp + 0x6e0]
add eax, 4
mov word [rsp + 0x6e0], ax
movzx ecx, word [rsp + 0x6e0]
mov eax, dword [0x00023530]
shl eax, 2
cmp ecx, eax
jae 0x1a3ba
mov rax, qword [0x00023528]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x6b0], 0xc0000022
jne 0x1a36c
mov dword [rsp + 0x6f4], 0x5e
jmp 0x1a377
mov dword [rsp + 0x6f4], 0x60a0
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x6f4]
mov rax, qword [rsp + 0x590]
mov byte [rax], cl
mov rax, qword [rsp + 0x590]
add rax, 1
mov qword [rsp + 0x590], rax
mov rax, qword [0x00023528]
add rax, 1
mov qword [0x00023528], rax
jmp 0x1a31b
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x6f8], eax
cmp dword [rsp + 0x6f8], 1
je 0x1a40a
cmp dword [rsp + 0x6f8], 2
je 0x1a418
cmp dword [rsp + 0x6f8], 0x1000
je 0x1a42b
cmp dword [rsp + 0x6f8], 0x2000
je 0x1a438
cmp dword [rsp + 0x6f8], 0x4004
je 0x1a446
jmp 0x1a462
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x1a462
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x1a462
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x1a462
lea rcx, [0x00021250]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1a462
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023598]
add rax, 0x1e91
mov qword [rsp + 0x180], rax
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
xor eax, eax
mov word [rsp + 0x6e0], ax
jmp 0x1a4a3
movzx eax, word [rsp + 0x6e0]
add eax, 4
mov word [rsp + 0x6e0], ax
movzx eax, word [rsp + 0x6e0]
cmp eax, 0x1d8
jge 0x1a508
mov rax, qword [0x00023538]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x6b0]
xor eax, 0xc00000c6
add ecx, eax
mov rax, qword [rsp + 0x180]
mov byte [rax], cl
mov rax, qword [rsp + 0x180]
add rax, 1
mov qword [rsp + 0x180], rax
mov rax, qword [0x00023538]
add rax, 1
mov qword [0x00023538], rax
jmp 0x1a490
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x6fc], eax
cmp dword [rsp + 0x6fc], 1
je 0x1a558
cmp dword [rsp + 0x6fc], 2
je 0x1a566
cmp dword [rsp + 0x6fc], 0x1000
je 0x1a579
cmp dword [rsp + 0x6fc], 0x2000
je 0x1a586
cmp dword [rsp + 0x6fc], 0x4004
je 0x1a594
jmp 0x1a5b0
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x1a5b0
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x1a5b0
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x1a5b0
lea rcx, [0x00021260]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1a5b0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023598]
add rax, 0x1f07
mov qword [rsp + 0x40], rax
xor eax, eax
mov word [rsp + 0x6e0], ax
jmp 0x1a5e1
movzx eax, word [rsp + 0x6e0]
add eax, 4
mov word [rsp + 0x6e0], ax
movzx eax, word [rsp + 0x6e0]
cmp eax, 0x22c
jge 0x1a686
mov rax, qword [rsp + 0x720]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x6b0], 0xc0000022
jne 0x1a61e
mov dword [rsp + 0x700], 0x12
jmp 0x1a629
mov dword [rsp + 0x700], 0x8f47
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x700]
mov rax, qword [rsp + 0x40]
mov byte [rax], cl
mov dword [rsp + 0x20], 0
mov r9d, 0x83
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x598]
call qword [sym.imp.ntoskrnl.exe_IoAcquireRemoveLockEx]
mov rax, qword [rsp + 0x40]
add rax, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x720]
add rax, 1
mov qword [rsp + 0x720], rax
jmp 0x1a5ce
mov rcx, qword [rsp + 0x708]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x718
ret