Function at 0x12f68
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x7c8
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x7b8], rax
mov dword [rsp + 0x584], 0xcf8
mov eax, 4
mov word [rsp + 0x310], ax
mov eax, 8
mov word [rsp + 0x30], ax
mov r8d, 0xd0
xor edx, edx
lea rcx, [rsp + 0x490]
call fcn.0001b210
mov dword [rsp + 0x1a0], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x580], eax
mov rax, qword [0x00023598]
add rax, 0x1f92
mov qword [rsp + 0x480], rax
xor eax, eax
mov word [rsp + 0x798], ax
jmp 0x13013
movzx eax, word [rsp + 0x798]
add eax, 4
mov word [rsp + 0x798], ax
movzx eax, word [rsp + 0x798]
cmp eax, 0x220
jge 0x130b5
mov rax, qword [0x000231f8]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x580], 0xc0000022
jne 0x1304f
mov dword [rsp + 0x79c], 0x3a
jmp 0x1305a
mov dword [rsp + 0x79c], 0x17bd
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x79c]
mov rax, qword [rsp + 0x480]
mov byte [rax], cl
lea r8, [rsp + 0x320]
xor edx, edx
lea rcx, [rsp + 0x568]
call qword [sym.imp.ntoskrnl.exe_IoCheckEaBufferValidity]
mov rax, qword [rsp + 0x480]
add rax, 1
mov qword [rsp + 0x480], rax
mov rax, qword [0x000231f8]
add rax, 1
mov qword [0x000231f8], rax
jmp 0x13000
mov rax, qword [0x00023598]
add rax, 0x201a
mov qword [rsp + 0x578], rax
xor eax, eax
mov word [rsp + 0x798], ax
jmp 0x130e9
movzx eax, word [rsp + 0x798]
add eax, 4
mov word [rsp + 0x798], ax
movzx eax, word [rsp + 0x798]
cmp eax, 0x1e0
jge 0x13164
mov rax, qword [rsp + 0x7d0]
mov al, byte [rax]
mov byte [0x000235a4], al
mov edx, 0x94a1
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x580]
xor eax, 0xc0000049
sub ecx, eax
mov rax, qword [rsp + 0x578]
mov byte [rax], cl
mov rax, qword [rsp + 0x578]
add rax, 1
mov qword [rsp + 0x578], rax
mov rax, qword [rsp + 0x7d0]
add rax, 1
mov qword [rsp + 0x7d0], rax
jmp 0x130d6
lea rcx, [rsp + 0x590]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
mov rax, qword [0x00023598]
add rax, 0x2092
mov qword [rsp + 0x40], rax
xor eax, eax
mov word [rsp + 0x798], ax
jmp 0x131a3
movzx eax, word [rsp + 0x798]
add eax, 4
mov word [rsp + 0x798], ax
movzx eax, word [rsp + 0x798]
cmp eax, 0x268
jge 0x13245
mov edx, 0xc51f
lea rcx, [rsp + 0x330]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
mov r11, qword [0x00023200]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0x580], 0xc0000022
jne 0x131f3
mov dword [rsp + 0x7a0], 0xed
jmp 0x131fe
mov dword [rsp + 0x7a0], 0x6613
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x7a0]
mov rax, qword [rsp + 0x40]
mov byte [rax], cl
mov rax, qword [rsp + 0x40]
add rax, 1
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x584]
call fcn.00011008
mov rax, qword [0x00023200]
add rax, 1
mov qword [0x00023200], rax
jmp 0x13190
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x310]
call qword [sym.imp.ntoskrnl.exe_RtlEqualString]
mov rax, qword [0x00023598]
add rax, 0x212c
mov qword [rsp + 0x308], rax
xor eax, eax
mov word [rsp + 0x798], ax
jmp 0x1328f
movzx eax, word [rsp + 0x798]
add eax, 4
mov word [rsp + 0x798], ax
movzx eax, word [rsp + 0x798]
cmp eax, 0x284
jge 0x13315
mov rax, qword [0x00023208]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x580], 0xc0000022
jne 0x132c7
mov dword [rsp + 0x7a4], 0xd5
jmp 0x132d2
mov dword [rsp + 0x7a4], 0xfdf2
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x7a4]
mov rax, qword [rsp + 0x308]
mov byte [rax], cl
mov rax, qword [rsp + 0x308]
add rax, 1
mov qword [rsp + 0x308], rax
mov rax, qword [0x00023208]
add rax, 1
mov qword [0x00023208], rax
jmp 0x1327c
lea r8, [rsp + 0x320]
xor edx, edx
lea rcx, [rsp + 0x568]
call qword [sym.imp.ntoskrnl.exe_IoCheckEaBufferValidity]
mov rax, qword [0x00023598]
add rax, 0x21cd
mov qword [rsp + 0x790], rax
xor eax, eax
mov word [rsp + 0x798], ax
jmp 0x13361
movzx eax, word [rsp + 0x798]
add eax, 4
mov word [rsp + 0x798], ax
movzx eax, word [rsp + 0x798]
cmp eax, 0x25c
jge 0x13401
mov rax, qword [0x00023210]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x580], 0xc0000022
jne 0x1339d
mov dword [rsp + 0x7a8], 0x43
jmp 0x133a8
mov dword [rsp + 0x7a8], 0xb1f1
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x7a8]
mov rax, qword [rsp + 0x790]
mov byte [rax], cl
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x490]
call qword [sym.imp.ntoskrnl.exe_IoSetHardErrorOrVerifyDevice]
mov rax, qword [rsp + 0x790]
add rax, 1
mov qword [rsp + 0x790], rax
mov rax, qword [0x00023210]
add rax, 1
mov qword [0x00023210], rax
jmp 0x1334e
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x310]
call qword [sym.imp.ntoskrnl.exe_RtlEqualString]
mov rax, qword [0x00023598]
add rax, 0x2264
mov qword [rsp + 0x488], rax
mov edx, 0x99ae
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
xor eax, eax
mov word [rsp + 0x798], ax
jmp 0x1345b
movzx eax, word [rsp + 0x798]
add eax, 4
mov word [rsp + 0x798], ax
movzx eax, word [rsp + 0x798]
cmp eax, 0x234
jge 0x1358d
mov rax, qword [0x00023218]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x580], 0xc0000022
jne 0x13497
mov dword [rsp + 0x7ac], 0x42
jmp 0x134a2
mov dword [rsp + 0x7ac], 0x1b3b
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x7ac]
mov rax, qword [rsp + 0x488]
mov byte [rax], cl
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x7b0], eax
cmp dword [rsp + 0x7b0], 1
je 0x1350a
cmp dword [rsp + 0x7b0], 2
je 0x13518
cmp dword [rsp + 0x7b0], 0x1000
je 0x1352b
cmp dword [rsp + 0x7b0], 0x2000
je 0x13538
cmp dword [rsp + 0x7b0], 0x4004
je 0x13546
jmp 0x13562
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x13562
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x13562
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x13562
lea rcx, [0x000210e0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x13562
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [rsp + 0x488]
add rax, 1
mov qword [rsp + 0x488], rax
mov rax, qword [0x00023218]
add rax, 1
mov qword [0x00023218], rax
jmp 0x13448
mov rcx, qword [rsp + 0x7b8]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x7c8
ret