Function at 0x1c03f
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [eax + 0xc]
push edi
call sub.ntoskrnl.exe_PsGetProcessExitTime
test byte [esi + 0xe], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
jne 0x1c5d2
lea edi, [esi + 0x1c]
push ebx
lea edx, [ebp - 0x1c]
mov ecx, edi
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
push 0
push 0x20
push esi
call fcn.000103d2
mov ax, word [esi]
mov ecx, 0x1000
or dword [esi + 0xc], ecx
cmp ax, 0xafd1
je 0x1c55d
cmp ax, 0x1afd
je 0x21012
cmp ax, 0xafd
je 0x2109e
and ax, 0xafd2
cmp ax, 0xafd2
je 0x1c856
xor edi, edi
test edi, edi
jne 0x1c6f7
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
mov ax, word [esi]
and ax, 0xafd4
cmp ax, 0xafd4
je 0x211f4
test byte [esi + 0xe], 0x10
jne 0x21290
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea edi, [esi + 0x98]
cmp dword [edi], edi
jne 0x1ec36
xor edi, edi
cmp dword [esi + 0xb8], edi
lea ecx, [ebp - 0x1c]
jne 0x2134d
call ebx
cmp dword [esi + 0x88], edi
pop ebx
je 0x1c12f
test byte [esi + 0xc], 1
jne 0x213b9
cmp word [esi], 0xafd1
je 0x1c5a9
xor ecx, ecx
mov eax, 0x1254c
inc ecx
lock xadd dword [eax], ecx
pop edi
xor eax, eax
pop esi
leave
ret
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
mov al, byte [esi + 2]
cmp al, 2
je 0x1c577
cmp al, 3
jne 0x1c0da
and dword [esi + 0x44], 0
and dword [esi + 0x40], 0
push fcn.00029344
mov edi, 0xc0000120
push edi
push esi
lea eax, [esi + 0x28]
push eax
call fcn.0001c1aa
push fcn.00029344
push edi
push esi
lea eax, [esi + 0x30]
push eax
call fcn.0001c1aa
jmp 0x1c0da
push edi
push edi
push 4
push dword [esi + 0x10]
call fcn.00012e2b
push edi
push edi
push 0xa
push dword [esi + 0x10]
call fcn.00012e2b
push edi
push edi
push 2
push dword [esi + 0x10]
call fcn.00012e2b
jmp 0x1c12f
push 0
push 0x20
push esi
call fcn.00010545
jmp 0x1c064
xor edx, edx
lea eax, [edi + 0x20]
inc edx
lock xadd dword [eax], edx
mov al, byte [esi + 2]
cmp al, 3
jne 0x210e7
mov edx, dword [edi + 4]
test ecx, edx
je 0x1e80e
test byte [esi + 0xa], 1
jne 0x1e80e
mov eax, dword [esi + 0x80]
test al, 4
mov dword [ebp - 0x10], eax
jne 0x1e80e
test al, 1
jne 0x210f4
mov edx, dword [edi + 4]
test dl, 0x10
jne 0x1e80e
and edx, 1
jne 0x2119a
xor eax, eax
cmp word [edi + 0x40], ax
setne al
test eax, eax
jne 0x1e54c
xor ebx, ebx
cmp edx, ebx
jne 0x211c7
xor eax, eax
cmp word [edi + 0x42], bx
setne al
cmp eax, ebx
jne 0x1e54c
mov eax, dword [esi + 4]
shr eax, 9
and al, 1
jne 0x1c78e
cmp dword [edi + 0x44], ebx
ja 0x1e54c
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 8]
jne 0x1e54c
cmp dword [esi + 0x84], ebx
jne 0x1e54c
cmp dword [esi + 0xbc], ebx
jne 0x1e54c
test al, al
jne 0x1c7cc
lea eax, [edi + 0x28]
cmp dword [eax], eax
jne 0x1e54c
lea eax, [edi + 0x48]
cmp dword [eax], eax
jne 0x1e54c
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
or eax, 2
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x80], eax
call ebx
push 0
push 0
push esi
call fcn.0001db91
test eax, eax
jl 0x1e557
mov eax, dword [esi + 4]
shr eax, 9
test al, 1
jne 0x1c824
push 0
push 0xc0000120
push esi
lea eax, [edi + 0x28]
push eax
call fcn.0001c1aa
push 0x110bb
push 0xc0000120
push esi
lea eax, [edi + 0x48]
push eax
call fcn.0001c1aa
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
or byte [edi + 6], 0x10
push 1
push edi
call fcn.0001c64e
lea ecx, [ebp - 0x1c]
call ebx
or ecx, 0xffffffff
lea eax, [edi + 0x20]
lock xadd dword [eax], ecx
je 0x211e9
jmp 0x1c0c9
mov edi, dword [esi + 0x60]
jmp 0x1c0b6
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
push edi
call fcn.0001e328
jmp 0x1c7f5
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
jmp 0x1c7f5
cmp al, 6
jne 0x1e80e
jmp 0x1c70c
cmp byte [edi + 0x59], 0
je 0x1c760
jmp 0x1e54c
mov eax, dword [edi + 0x40]
cmp eax, ecx
ja 0x1e54c
jmp 0x1c77b
mov ecx, dword [edi]
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [eax + 4], edi
and dword [ecx], 0
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x1c]
call ebx
mov eax, dword [ebp - 0x10]
push eax
push esi
call dword [eax + 8]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
jmp 0x1c0f6
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea eax, [esi + 0x38]
cmp dword [eax], eax
lea ecx, [ebp - 0x1c]
je 0x21097
call ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov ecx, edi
jmp 0x21070
mov edi, dword [esi + 0x38]
sub edi, 0x58
xor eax, eax
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
test eax, eax
mov dword [ebp - 0x10], eax
je 0x21079
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
mov al, byte [ebp - 4]
push edi
mov byte [edi + 0x25], al
mov byte [edi + 0x24], 1
push dword [0x127f8]
call dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea ecx, [esi + 0x1c]
lea edx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
lea eax, [esi + 0x38]
cmp dword [eax], eax
jne 0x21032
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
jmp 0x1c0da
call ebx
jmp 0x1c0da
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
cmp esi, dword [0x1258c]
jne 0x1c0da
call dword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
push 1
push dword [0x127fc]
call dword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov ecx, dword [0x127fc]
and dword [0x1258c], 0
call dword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call dword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x1c0da
cmp al, 2
je 0x1c70c
jmp 0x1e81e
and edx, 1
je 0x21128
mov ecx, dword [edi + 0x38]
add ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x3c]
adc eax, dword [edi + 0x34]
mov ebx, dword [edi + 0x2c]
cmp ebx, eax
jg 0x1c73a
jl 0x2111d
mov eax, dword [edi + 0x28]
cmp eax, ecx
ja 0x1c73a
cmp byte [edi + 0x59], 0
je 0x21139
jmp 0x1c73a
xor eax, eax
cmp word [edi + 0x40], ax
setne al
test eax, eax
jne 0x1c73a
xor ebx, ebx
cmp edx, ebx
je 0x21165
mov ecx, dword [edi + 0x50]
add ecx, dword [edi + 0x48]
mov eax, dword [edi + 0x54]
adc eax, dword [edi + 0x4c]
mov edx, dword [edi + 0x44]
cmp edx, eax
jg 0x1c73a
jl 0x21176
mov eax, dword [edi + 0x40]
cmp eax, ecx
ja 0x1c73a
jmp 0x21176
xor eax, eax
cmp word [edi + 0x42], bx
setne al
cmp eax, ebx
jne 0x1c73a
mov eax, dword [esi + 4]
shr eax, 9
test al, 1
jne 0x21189
cmp dword [edi + 0x44], ebx
ja 0x1c73a
cmp dword [esi + 0xbc], ebx
je 0x1e80e
jmp 0x1c73a
mov ecx, dword [edi + 0x38]
add ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x3c]
adc eax, dword [edi + 0x34]
mov ebx, dword [edi + 0x2c]
cmp ebx, eax
jg 0x1e54c
jl 0x1e827
mov eax, dword [edi + 0x28]
cmp eax, ecx
ja 0x1e54c
jmp 0x1e827
mov ecx, dword [edi + 0x50]
add ecx, dword [edi + 0x48]
mov eax, dword [edi + 0x54]
adc eax, dword [edi + 0x4c]
mov edx, dword [edi + 0x44]
cmp edx, eax
jg 0x1e54c
jl 0x1c77b
jmp 0x1e836
push edi
call fcn.0001c24b
jmp 0x1c0c9
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea edi, [esi + 0x38]
jmp 0x21278
mov eax, dword [edi]
mov ecx, dword [eax]
mov dword [edi], ecx
mov dword [ecx + 4], edi
and dword [eax], 0
lea ecx, [eax - 0x58]
mov eax, dword [ecx + 0x60]
cmp byte [eax], 0xf
mov dword [ebp - 4], ecx
jne 0x2122c
push 0xc0000120
push ecx
call fcn.00024dbf
jmp 0x21237
and dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0xc0000120
lea ecx, [ebp - 0x1c]
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
add ecx, 0x38
xchg dword [ecx], eax
test eax, eax
jne 0x2125d
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dl, byte [0x12011]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
cmp dword [edi], edi
jne 0x21205
lea ecx, [ebp - 0x1c]
call ebx
push esi
call fcn.00025bbc
and dword [esi + 0x50], 0
jmp 0x1c0da
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
and byte [esi + 0xe], 0xef
mov eax, dword [esi + 0xc]
test eax, 0x200000
je 0x212c5
and eax, 0xffdfffff
mov dword [ebp - 0x10], 0x17
mov dword [esi + 0xc], eax
jmp 0x212cc
mov dword [ebp - 0x10], 2
lea eax, [esi + 0x90]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [ebp - 4], ecx
je 0x2132e
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
xor edi, edi
lea eax, [ecx + 8]
xchg dword [eax], edi
test edi, edi
je 0x21323
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
mov al, byte [ebp - 8]
push edi
mov byte [edi + 0x25], al
call fcn.000276ec
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
lea eax, [esi + 0x90]
cmp dword [ebp - 4], eax
jne 0x212db
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
push dword [ebp - 0x10]
call fcn.000180e1
jmp 0x1c0e4
call ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
mov ebx, dword [esi + 0xb8]
cmp ebx, edi
je 0x213a2
mov byte [ebx + 0x24], 1
lea eax, [ebx + 0x38]
xchg dword [eax], edi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
test edi, edi
je 0x21392
mov al, byte [ebp - 8]
push ebx
push 0
mov byte [ebx + 0x25], al
call edi
jmp 0x2139b
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
xor edi, edi
jmp 0x1c111
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
jmp 0x1c111
push edi
push edi
push edi
push dword [esi + 0x10]
call fcn.00012e2b
jmp 0x1c124