Function at 0x1ba6c
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x248b0], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0x60]
mov dword [ebp - 4], eax
je 0x1baa7
inc byte [edi + 0x23]
add esi, 0x24
mov dword [edi + 0x60], esi
mov ecx, dword [eax + 4]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1bc5d
cmp byte [esi], 0xe
push ebx
jne 0x1bae3
cmp dword [esi + 0xc], 0x82200
jne 0x1bae3
mov eax, dword [edi + 0xc]
lea ebx, [edi + 0x18]
push ebx
push dword [esi + 4]
push eax
push dword [esi + 8]
push eax
call fcn.0001a75c
cmp dword [ebx], 0
jne 0x1bae0
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebx]
jmp 0x1bc5c
and dword [ebx], 0
cmp byte [esi], 0
jne 0x1bc47
push dword [esi + 0x18]
call fcn.0001adf0
test al, al
jne 0x1bc47
and dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x18]
call fcn.0001aea0
test eax, eax
jne 0x1bc47
push 1
push 0x27098
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
mov ebx, 0x400
test eax, eax
jne 0x1bb92
push 0x48524452
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp + 8], eax
test eax, eax
je 0x1bb92
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1bb5f
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x18]
mov ecx, ebx
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x18]
push ebx
push 0
push dword [eax + 0x34]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x26e50
jmp 0x1bc10
cmp byte [0x24db4], 0
je 0x1bc3f
push 1
push 0x270a0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x1bc3f
push 0x48524452
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp + 8], eax
test eax, eax
je 0x1bc3f
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1bbdf
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x18]
mov ecx, ebx
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x18]
push ebx
push 0
push dword [eax + 0x34]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x270a8
mov eax, dword [esi + 0x18]
add eax, 0x30
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push dword [ebp - 8]
call fcn.00015c6a
and dword [edi + 0x1c], 0
mov esi, 0x104
xor dl, dl
mov ecx, edi
mov dword [edi + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x1bc5c
push dword [ebp - 8]
call fcn.00015c6a
mov eax, dword [ebp - 4]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov ecx, dword [eax + 4]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop ebx
pop edi
pop esi
leave
ret 8