Function at 0x237a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
call fcn.00016210
movzx eax, al
cmp eax, 1
jle 0x237f1
call fcn.00016210
movzx eax, al
mov edx, eax
lea rcx, [0x00011090]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0xb81
lea rdx, [0x00011ef0]
lea rcx, [0x000110e4]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov r8d, 8
xor edx, edx
mov rcx, qword [rsp + 0x1f8]
call fcn.000139e0
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.000139e0
mov rax, qword [rsp + 0x1f0]
add rax, 0xc
mov qword [rsp + 0x38], rax
lea rax, str.RegistryMACHINESystemCurrentControlSetlvshao
mov qword [rsp + 0x30], rax
lea rax, [0x00011ee0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
lea rcx, [rsp + 0xe0]
call fcn.00016280
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0xb0], 0x40
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
lea r8, [rsp + 0x98]
mov edx, 0x20019
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jl 0x2414e
mov dword [rsp + 0x40], 0
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax + 8]
shr eax, 0x10
mov rcx, qword [rsp + 0x1f0]
mov ecx, dword [rcx + 8]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0x1f8]
mov dword [rcx + 0x43c], eax
mov rax, qword [rsp + 0x1f8]
mov r9d, 1
mov r8, rax
lea rdx, [0x00012fd8]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
movzx eax, byte [rax]
cmp eax, 1
jne 0x23ef4
mov rax, qword [rsp + 0x1f8]
add rax, 0x43a
mov r9d, 1
mov r8, rax
lea rdx, [0x000130e8]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0x43b
mov r9d, 1
mov r8, rax
lea rdx, [0x000130f8]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x1f8]
lea rax, [rcx + rax + 0x456]
mov r9d, 4
mov r8, rax
lea rdx, [0x00013108]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x1f8]
call fcn.0002c360
cdqe
cmp rax, 0x1000
jae 0x23a38
mov rcx, qword [rsp + 0x1f8]
call fcn.0002c360
cdqe
mov qword [rsp + 0x80], rax
jmp 0x23a44
mov qword [rsp + 0x80], 0x1000
mov rax, qword [rsp + 0x1f8]
add rax, 0x4a6
mov r9d, dword [rsp + 0x80]
mov r8, rax
lea rdx, [0x00012198]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x1f8]
lea rax, [rcx + rax + 0x440]
mov r9d, 0xe
mov r8, rax
lea rdx, [0x00013110]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov dword [rsp + 0x88], eax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x1f8]
lea rax, [rcx + rax + 0x44e]
mov r9d, 8
mov r8, rax
lea rdx, [0x00013120]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x40], 0
jl 0x23ef4
cmp dword [rsp + 0x74], 0
jge 0x23c19
mov rax, qword [rsp + 0x1f8]
mov eax, dword [rax + 0x43c]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
xor eax, 0x9071966
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0
jmp 0x23b34
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 8
jae 0x23b5a
mov eax, dword [rsp + 0x58]
and eax, 7
mov ecx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x90], al
mov eax, dword [rsp + 0x58]
shr eax, 3
mov dword [rsp + 0x58], eax
jmp 0x23b2a
mov rax, qword [rsp + 0x1f8]
add rax, 0x44e
mov r8d, 8
xor edx, edx
mov rcx, rax
call fcn.000139e0
mov dword [rsp + 0x50], 0
jmp 0x23b8c
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 8
jae 0x23c19
mov dword [rsp + 0x54], 0
jmp 0x23bab
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 8
jae 0x23c14
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
movzx ecx, byte [rsp + rcx + 0x90]
lea rdx, [0x00019190]
lea rcx, [rdx + rcx*8]
mov edx, dword [rsp + 0x54]
movzx ecx, byte [rcx + rdx]
mov dword [rsp + 0x78], ecx
mov edx, 7
sub edx, dword [rsp + 0x50]
movzx ecx, dl
mov edx, dword [rsp + 0x78]
shl edx, cl
mov ecx, edx
mov rdx, qword [rsp + 0x1f8]
movzx eax, byte [rdx + rax + 0x44e]
or eax, ecx
mov ecx, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x1f8]
mov byte [rdx + rcx + 0x44e], al
jmp 0x23ba1
jmp 0x23b82
mov eax, 1
imul rax, rax, 4
mov rcx, qword [rsp + 0x1f8]
lea rax, [rcx + rax + 0x456]
mov r9d, 0xc
mov r8, rax
lea rdx, [0x00013138]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
test eax, eax
je 0x23d2c
mov eax, 1
imul rax, rax, 4
mov rcx, qword [rsp + 0x1f8]
lea rax, [rcx + rax + 0x456]
mov r8d, 0xc
mov edx, 0xff
mov rcx, rax
call fcn.000139e0
mov rax, qword [rsp + 0x1f8]
movzx eax, byte [rax + 0x43b]
cmp eax, 4
jne 0x23ce1
mov eax, 1
imul rax, rax, 0xa
mov rcx, qword [rsp + 0x1f8]
mov byte [rcx + rax + 0x456], 0xff
mov eax, 1
imul rax, rax, 0xb
mov rcx, qword [rsp + 0x1f8]
mov byte [rcx + rax + 0x456], 0xff
mov eax, 1
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x1f8]
mov byte [rcx + rax + 0x456], 0xfe
jmp 0x23d2c
mov eax, 1
imul rax, rax, 0xa
mov rcx, qword [rsp + 0x1f8]
mov byte [rcx + rax + 0x456], 0
mov eax, 1
imul rax, rax, 0xb
mov rcx, qword [rsp + 0x1f8]
mov byte [rcx + rax + 0x456], 0
mov eax, 1
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x1f8]
mov byte [rcx + rax + 0x456], 0
mov rax, qword [rsp + 0x1f8]
add rax, 0x14a6
mov r8d, 0x18
xor edx, edx
mov rcx, rax
call fcn.000139e0
mov rax, qword [rsp + 0x1f8]
add rax, 0x14a6
mov r9d, 1
mov r8, rax
lea rdx, [0x00013150]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov rax, qword [rsp + 0x1f8]
add rax, 0x14a7
mov r9d, 1
mov r8, rax
lea rdx, [0x00013168]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov rax, qword [rsp + 0x1f8]
movzx eax, byte [rax + 0x14a6]
test eax, eax
jne 0x23ddc
mov rax, qword [rsp + 0x1f8]
movzx eax, byte [rax + 0x14a7]
test eax, eax
jne 0x23ddc
mov rax, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1f8]
mov ecx, dword [rcx + 0x43c]
mov dword [rax + 0x14ba], ecx
mov rax, qword [rsp + 0x1f8]
add rax, 0x44e
mov rcx, qword [rsp + 0x1f8]
add rcx, 0x14a8
mov r8d, 8
mov rdx, rax
call fcn.00013690
mov rax, qword [rsp + 0x1f8]
add rax, 0x49e
mov r9d, 8
mov r8, rax
lea rdx, [0x000121c8]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov rax, qword [rsp + 0x1f8]
add rax, 0x466
mov r9d, 0x38
mov r8, rax
lea rdx, [0x000121a8]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov rax, qword [rsp + 0x1f8]
add rax, 0x1520
mov r9d, 0x10
mov r8, rax
lea rdx, [0x00013188]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
test eax, eax
jge 0x23ef4
mov byte [rsp + 0x60], 0x79
mov byte [rsp + 0x61], 0x4c
mov byte [rsp + 0x62], 0xe1
mov byte [rsp + 0x63], 0x88
mov byte [rsp + 0x64], 0xcb
mov byte [rsp + 0x65], 0xc1
mov byte [rsp + 0x66], 0x78
mov byte [rsp + 0x67], 0x53
mov byte [rsp + 0x68], 0x11
mov byte [rsp + 0x69], 0x69
mov byte [rsp + 0x6a], 0xe0
mov byte [rsp + 0x6b], 0xb2
mov byte [rsp + 0x6c], 0xca
mov byte [rsp + 0x6d], 0x97
mov byte [rsp + 0x6e], 0xc9
mov byte [rsp + 0x6f], 0x76
mov rax, qword [rsp + 0x1f8]
add rax, 0x1520
mov r8d, 0x10
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.00013690
mov rax, qword [rsp + 0x1f8]
movzx eax, byte [rax]
cmp eax, 2
jne 0x2404a
mov rax, qword [rsp + 0x1f8]
add rax, 0x14
mov r9d, 1
mov r8, rax
lea rdx, [0x00013198]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0x10
mov r9d, 4
mov r8, rax
lea rdx, [0x000131b0]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
movzx eax, byte [rax + 0x14]
test eax, eax
je 0x23fae
mov rax, qword [rsp + 0x1f8]
add rax, 0x15
mov r9d, 0x80
mov r8, rax
lea rdx, [0x000131b8]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0x95
mov r9d, 2
mov r8, rax
lea rdx, [0x000131d0]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0x97
mov r9d, 2
mov r8, rax
lea rdx, [0x000131e0]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0x99
mov r9d, 2
mov r8, rax
lea rdx, [0x000131f0]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
movzx eax, byte [rax]
cmp eax, 3
jne 0x240fa
mov rax, qword [rsp + 0x1f8]
add rax, 0xa3
mov r9d, 1
mov r8, rax
lea rdx, [0x000130e8]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0xa4
mov r9d, 0x200
mov r8, rax
lea rdx, [0x00013200]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0x2a4
mov r9d, 0x100
mov r8, rax
lea rdx, [0x00013218]
mov rcx, qword [rsp + 0x48]
call fcn.00018600
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x1f8]
add rax, 0x14f8
mov r8d, 0x28
xor edx, edx
mov rcx, rax
call fcn.000139e0
mov rax, qword [rsp + 0x1f0]
add rax, 0xc
mov rcx, qword [rsp + 0x1f8]
add rcx, 0x14f8
mov r8d, 0x28
mov rdx, rax
call fcn.00013690
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x2415c
cmp dword [rsp + 0x70], 0
jge 0x2415c
mov eax, 0xc000000d
jmp 0x2415e
xor eax, eax
add rsp, 0x1e8
ret