Function at 0x140002f10
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
xorps xmm0, xmm0
lea rdx, [rbp - 0x19]
movups xmmword [rbp + 0x17], xmm0
mov rbx, rcx
movabs rax, 0xfffff78000000014
xor edi, edi
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x19], rdi
mov rax, qword [rax]
mov qword [rbp - 0x11], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov eax, 0x7e7
cmp word [rbp + 0x17], ax
jg 0x140003176
cmp word [rbp + 0x19], 0xa
jne 0x140003176
lea rax, [0x140002ee0]
mov qword [rsp + 0xc0], rsi
mov qword [rbx + 0x68], rax
mov qword [rsp + 0xc8], r14
call fcn.140001810
lea rax, [0x1400040a0]
mov dword [rbp - 9], 0x220020
mov qword [rbp - 1], rax
lea edx, [rdi + 0x40]
lea rax, [rbp + 0x77]
mov qword [rbp + 0x77], rdi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x28], dil
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
lea r14, [0x140007350]
test eax, eax
js 0x140003055
mov eax, dword [0x140009330]
lea rcx, [0x140002070]
movaps xmm0, xmmword [rbp - 9]
mov edx, eax
shl rdx, 5
inc eax
mov dword [0x140009330], eax
mov rax, qword [rbp + 0x77]
add rax, 0xe0
movdqa xmmword [rbp + 0x27], xmm0
mov qword [rdx + r14 + 0x10], rax
xchg qword [rax], rcx
movaps xmm0, xmmword [rbp + 0x27]
mov qword [rdx + r14 + 0x18], rcx
movups xmmword [rdx + r14], xmm0
mov qword [0x140006330], rcx
lea rdx, [rbp + 0x27]
lea rcx, [0x140003f90]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000306c
lfence
mov r8d, eax
lea rdx, [rbp - 9]
lea rcx, [0x140003f40]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
call fcn.140002490
call fcn.140002b40
lea rax, [0x140004440]
mov dword [rbp + 7], 0x220020
mov qword [rbp + 0xf], rax
xor r9d, r9d
lea rax, [rbp + 0x7f]
mov qword [rbp + 0x7f], rdi
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov qword [rsp + 0x30], rdi
lea edx, [r9 + 0x40]
mov byte [rsp + 0x28], dil
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
mov rsi, qword [rsp + 0xc0]
test eax, eax
js 0x14000314a
mov eax, dword [0x140009330]
lea rdx, [0x140002e40]
movaps xmm0, xmmword [rbp + 7]
lea rcx, [0x140003f90]
mov r8d, eax
movdqa xmmword [rbp + 0x37], xmm0
inc eax
shl r8, 5
mov dword [0x140009330], eax
mov rax, qword [rbp + 0x7f]
add rax, 0xe0
mov qword [r8 + r14 + 0x10], rax
xchg qword [rax], rdx
movaps xmm0, xmmword [rbp + 0x37]
mov qword [r8 + r14 + 0x18], rdx
mov qword [0x140006328], rdx
lea rdx, [rbp + 0x37]
movups xmmword [r8 + r14], xmm0
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r14, qword [rsp + 0xc8]
xor eax, eax
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
lfence
mov r8d, eax
lea rdx, [rbp + 7]
lea rcx, [0x140003f40]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov r14, qword [rsp + 0xc8]
xor eax, eax
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
mov eax, 0xc0000001
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret