Function at 0x1a6a4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x10d8
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x10c8], rax
mov r8d, 0x4d6d4366
mov edx, 0x2fc
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0xc80], rax
mov eax, 4
mov word [rsp + 0xc40], ax
mov eax, 8
mov word [rsp + 0x10a0], ax
mov qword [rsp + 0x310], 0x274
mov r8d, 0x28
mov edx, 0xff
lea rcx, [rsp + 0x30]
call fcn.0001b210
mov r8d, 0xd0
xor edx, edx
lea rcx, [rsp + 0x320]
call fcn.0001b210
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0xc50]
call fcn.0001b210
mov dword [rsp + 0x60], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0xc20], eax
lea r8, [0x0001b970]
lea rdx, [0x0001e440]
mov ecx, 0xae
call fcn.00017160
lea rdx, [rsp + 0x808]
lea rcx, [rsp + 0xc70]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov rax, qword [0x00023598]
add rax, 0x4901
mov qword [rsp + 0x318], rax
xor eax, eax
mov word [rsp + 0x10b0], ax
jmp 0x1a7c6
movzx eax, word [rsp + 0x10b0]
add eax, 4
mov word [rsp + 0x10b0], ax
movzx eax, word [rsp + 0x10b0]
cmp eax, 0x1c0
jge 0x1a83f
mov edx, 0xfcb5
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
mov r11, qword [0x00023540]
mov al, byte [r11]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0xc20]
xor eax, 0xc00000b4
sub ecx, eax
mov rax, qword [rsp + 0x318]
mov byte [rax], cl
mov rax, qword [rsp + 0x318]
add rax, 1
mov qword [rsp + 0x318], rax
mov rax, qword [0x00023540]
add rax, 1
mov qword [0x00023540], rax
jmp 0x1a7b3
call fcn.0001913c
mov rax, qword [0x00023598]
add rax, 0x47ef
mov qword [rsp + 0x800], rax
xor eax, eax
mov word [rsp + 0x10b0], ax
jmp 0x1a878
movzx eax, word [rsp + 0x10b0]
add eax, 4
mov word [rsp + 0x10b0], ax
movzx eax, word [rsp + 0x10b0]
cmp eax, 0x268
jge 0x1a901
mov rax, qword [rsp + 0x10e0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0xc20], 0xc0000022
jne 0x1a8b1
mov dword [rsp + 0x10b4], 0x10
jmp 0x1a8bc
mov dword [rsp + 0x10b4], 0x55af
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x10b4]
mov rax, qword [rsp + 0x800]
mov byte [rax], cl
mov rax, qword [rsp + 0x800]
add rax, 1
mov qword [rsp + 0x800], rax
mov rax, qword [rsp + 0x10e0]
add rax, 1
mov qword [rsp + 0x10e0], rax
jmp 0x1a865
lea rcx, [rsp + 0x400]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023598]
add rax, 0x49f2
mov qword [rsp + 0x810], rax
xor eax, eax
mov word [rsp + 0x10b0], ax
jmp 0x1a943
movzx eax, word [rsp + 0x10b0]
add eax, 4
mov word [rsp + 0x10b0], ax
movzx eax, word [rsp + 0x10b0]
cmp eax, 0x214
jge 0x1a9e6
mov rax, qword [0x00023548]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0xc20], 0xc0000022
jne 0x1a97f
mov dword [rsp + 0x10b8], 0x85
jmp 0x1a98a
mov dword [rsp + 0x10b8], 0xb326
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x10b8]
mov rax, qword [rsp + 0x810]
mov byte [rax], cl
xor r8d, r8d
lea rdx, [rsp + 0x10a0]
lea rcx, [rsp + 0xc40]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov rax, qword [rsp + 0x810]
add rax, 1
mov qword [rsp + 0x810], rax
mov rax, qword [0x00023548]
add rax, 1
mov qword [0x00023548], rax
jmp 0x1a930
lea rcx, [rsp + 0x820]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023598]
add rax, 0x4aeb
mov qword [rsp + 0x68], rax
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x10bc], eax
cmp dword [rsp + 0x10bc], 1
je 0x1aa56
cmp dword [rsp + 0x10bc], 2
je 0x1aa64
cmp dword [rsp + 0x10bc], 0x1000
je 0x1aa77
cmp dword [rsp + 0x10bc], 0x2000
je 0x1aa84
cmp dword [rsp + 0x10bc], 0x4004
je 0x1aa92
jmp 0x1aaae
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x1aaae
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x1aaae
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x1aaae
lea rcx, [0x00021270]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1aaae
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
xor eax, eax
mov word [rsp + 0x10b0], ax
jmp 0x1aacd
movzx eax, word [rsp + 0x10b0]
add eax, 4
mov word [rsp + 0x10b0], ax
movzx eax, word [rsp + 0x10b0]
cmp eax, 0x2ac
jge 0x1ab4f
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.ntoskrnl.exe_RtlFindMostSignificantBit]
mov byte [rsp + 0xc38], al
mov rax, qword [0x00023550]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0xc20]
xor eax, 0xc00000fc
add ecx, eax
mov rax, qword [rsp + 0x68]
mov byte [rax], cl
mov rax, qword [rsp + 0x68]
add rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xca0]
call qword [sym.imp.ntoskrnl.exe_KeQueryPriorityThread]
mov rax, qword [0x00023550]
add rax, 1
mov qword [0x00023550], rax
jmp 0x1aaba
lea rcx, [0x0001d550]
call fcn.00019dc8
xor r8d, r8d
lea rdx, [rsp + 0xc28]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlSetGroupSecurityDescriptor]
mov rax, qword [0x00023598]
add rax, 0x4889
mov qword [rsp + 0xc90], rax
xor eax, eax
mov word [rsp + 0x10b0], ax
jmp 0x1aba5
movzx eax, word [rsp + 0x10b0]
add eax, 4
mov word [rsp + 0x10b0], ax
movzx eax, word [rsp + 0x10b0]
cmp eax, 0x1e0
jge 0x1ac0a
mov rax, qword [0x00023558]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0xc20]
xor eax, 0xc0000030
sub ecx, eax
mov rax, qword [rsp + 0xc90]
mov byte [rax], cl
mov rax, qword [rsp + 0xc90]
add rax, 1
mov qword [rsp + 0xc90], rax
mov rax, qword [0x00023558]
add rax, 1
mov qword [0x00023558], rax
jmp 0x1ab92
mov rax, qword [0x00023598]
add rax, 0x4971
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x320]
call qword [sym.imp.ntoskrnl.exe_IoSetHardErrorOrVerifyDevice]
xor eax, eax
mov word [rsp + 0x10b0], ax
jmp 0x1ac51
movzx eax, word [rsp + 0x10b0]
add eax, 4
mov word [rsp + 0x10b0], ax
movzx eax, word [rsp + 0x10b0]
cmp eax, 0x204
jge 0x1ace6
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc50]
call qword [sym.imp.ntoskrnl.exe_IoReleaseRemoveLockEx]
mov r11, qword [0x00023560]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0xc20], 0xc0000022
jne 0x1aca1
mov dword [rsp + 0x10c0], 0x75
jmp 0x1acac
mov dword [rsp + 0x10c0], 0x607e
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x10c0]
mov rax, qword [rsp + 0x58]
mov byte [rax], cl
mov rax, qword [rsp + 0x58]
add rax, 1
mov qword [rsp + 0x58], rax
mov rax, qword [0x00023560]
add rax, 1
mov qword [0x00023560], rax
jmp 0x1ac3e
lea rcx, [rsp + 0x400]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023598]
add rax, 0x4a77
mov qword [rsp + 0xc88], rax
xor eax, eax
mov word [rsp + 0x10b0], ax
jmp 0x1ad28
movzx eax, word [rsp + 0x10b0]
add eax, 4
mov word [rsp + 0x10b0], ax
movzx eax, word [rsp + 0x10b0]
cmp eax, 0x1d0
jge 0x1ada0
mov rax, qword [0x00023568]
mov al, byte [rax]
mov byte [0x000235a4], al
mov edx, 0x873e
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0xc20]
xor eax, 0xc00000fa
add ecx, eax
mov rax, qword [rsp + 0xc88]
mov byte [rax], cl
mov rax, qword [rsp + 0xc88]
add rax, 1
mov qword [rsp + 0xc88], rax
mov rax, qword [0x00023568]
add rax, 1
mov qword [0x00023568], rax
jmp 0x1ad15
cmp qword [rsp + 0xc80], 0
je 0x1adbe
mov edx, 0x4d6d4366
mov rcx, qword [rsp + 0xc80]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x10c8]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x10d8
ret