Function at 0x15cb8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x34], 0xcf8
mov qword [rsp + 0x60], 0x2fc
mov qword [rsp + 0x58], 0x138
mov dword [rsp + 0x78], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x44], eax
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 1
je 0x15d59
cmp dword [rsp + 0x9c], 2
je 0x15d67
cmp dword [rsp + 0x9c], 0x1000
je 0x15d7a
cmp dword [rsp + 0x9c], 0x2000
je 0x15d87
cmp dword [rsp + 0x9c], 0x4004
je 0x15d95
jmp 0x15db1
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x15db1
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x15db1
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x15db1
lea rcx, [0x00021190]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x15db1
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023598]
add rax, 0x2bf
mov qword [rsp + 0x38], rax
xor eax, eax
mov word [rsp + 0x98], ax
jmp 0x15de2
movzx eax, word [rsp + 0x98]
add eax, 4
mov word [rsp + 0x98], ax
movzx eax, word [rsp + 0x98]
cmp eax, 0x264
jge 0x15e5c
mov rax, qword [0x00023320]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x44], 0xc0000022
jne 0x15e17
mov dword [rsp + 0xa0], 0x12
jmp 0x15e22
mov dword [rsp + 0xa0], 0x4c7a
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x38]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [0x00023320]
add rax, 1
mov qword [0x00023320], rax
jmp 0x15dcf
mov rax, qword [0x00023598]
add rax, 0x358
mov qword [rsp + 0x70], rax
xor eax, eax
mov word [rsp + 0x98], ax
jmp 0x15e8d
movzx eax, word [rsp + 0x98]
add eax, 4
mov word [rsp + 0x98], ax
movzx eax, word [rsp + 0x98]
cmp eax, 0x234
jge 0x15fb6
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 1
je 0x15ef0
cmp dword [rsp + 0xa4], 2
je 0x15efe
cmp dword [rsp + 0xa4], 0x1000
je 0x15f11
cmp dword [rsp + 0xa4], 0x2000
je 0x15f1e
cmp dword [rsp + 0xa4], 0x4004
je 0x15f2c
jmp 0x15f48
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x15f48
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x15f48
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x15f48
lea rcx, [0x000211a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x15f48
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [rsp + 0xd0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x44], 0xc0000022
jne 0x15f6f
mov dword [rsp + 0xa8], 0x52
jmp 0x15f7a
mov dword [rsp + 0xa8], 0x73c0
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x70]
mov byte [rax], cl
mov rax, qword [rsp + 0x70]
add rax, 1
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xd0]
add rax, 1
mov qword [rsp + 0xd0], rax
jmp 0x15e7a
lea rcx, [rsp + 0x34]
call fcn.00011008
mov rax, qword [0x00023598]
add rax, 0x3e5
mov qword [rsp + 0x48], rax
xor eax, eax
mov word [rsp + 0x98], ax
jmp 0x15ff1
movzx eax, word [rsp + 0x98]
add eax, 4
mov word [rsp + 0x98], ax
movzx eax, word [rsp + 0x98]
cmp eax, 0x21c
jge 0x1604a
mov rax, qword [0x00023328]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x44]
xor eax, 0xc00000a7
sub ecx, eax
mov rax, qword [rsp + 0x48]
mov byte [rax], cl
mov rax, qword [rsp + 0x48]
add rax, 1
mov qword [rsp + 0x48], rax
mov rax, qword [0x00023328]
add rax, 1
mov qword [0x00023328], rax
jmp 0x15fde
lea r8, [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_IoCheckEaBufferValidity]
mov rax, qword [0x00023598]
add rax, 0x46c
mov qword [rsp + 0x68], rax
xor eax, eax
mov word [rsp + 0x98], ax
jmp 0x16090
movzx eax, word [rsp + 0x98]
add eax, 4
mov word [rsp + 0x98], ax
movzx ecx, word [rsp + 0x98]
mov eax, dword [0x000235ac]
shl eax, 2
cmp ecx, eax
jae 0x16110
mov rax, qword [0x00023330]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x44], 0xc0000022
jne 0x160cb
mov dword [rsp + 0xac], 0x84
jmp 0x160d6
mov dword [rsp + 0xac], 0x3c0d
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0xac]
mov rax, qword [rsp + 0x68]
mov byte [rax], cl
mov rax, qword [rsp + 0x68]
add rax, 1
mov qword [rsp + 0x68], rax
mov rax, qword [0x00023330]
add rax, 1
mov qword [0x00023330], rax
jmp 0x1607d
mov rax, qword [0x00023598]
add rax, 0x4e4
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 4
mov ecx, 0xff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuerySetVolumeInformation]
xor eax, eax
mov word [rsp + 0x98], ax
jmp 0x16154
movzx eax, word [rsp + 0x98]
add eax, 4
mov word [rsp + 0x98], ax
movzx eax, word [rsp + 0x98]
cmp eax, 0x1cc
jge 0x16290
mov rax, qword [0x00023338]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x44], 0xc0000022
jne 0x1618d
mov dword [rsp + 0xb0], 0x90
jmp 0x16198
mov dword [rsp + 0xb0], 0x9259
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0xb0]
mov rax, qword [rsp + 0x50]
mov byte [rax], cl
mov rdx, qword [rsp + 0x60]
lea rcx, [0x000235b0]
mov rax, qword [rsp + 0x58]
lock cmpxchg qword [rcx], rdx
mov rax, qword [rsp + 0x50]
add rax, 1
mov qword [rsp + 0x50], rax
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 1
je 0x16221
cmp dword [rsp + 0xb4], 2
je 0x1622f
cmp dword [rsp + 0xb4], 0x1000
je 0x16242
cmp dword [rsp + 0xb4], 0x2000
je 0x1624f
cmp dword [rsp + 0xb4], 0x4004
je 0x1625d
jmp 0x16279
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x16279
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x16279
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x16279
lea rcx, [0x000211b0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x16279
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023338]
add rax, 1
mov qword [0x00023338], rax
jmp 0x16141
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0xc8
ret