Function at 0x19448
Capabilities:
Complete processing asynchronous io request
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r14, rdx
xor ecx, ecx
xor edx, edx
call fcn.00019c50
xor esi, esi
lea r13, [r14 + 0x30]
mov rbp, rax
mov rax, qword [r14 + 0xb8]
mov dword [r13], esi
mov qword [r14 + 0x38], rsi
cmp byte [rax], 0xe
je 0x19498
mov esi, 0xc00000bb
jmp 0x19be8
mov r8d, dword [rax + 0x10]
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0x18]
mov rdi, qword [r14 + 0x18]
mov edx, 0x801726a8
cmp eax, edx
ja 0x1989c
je 0x1988d
mov ecx, 0x80172694
cmp eax, ecx
ja 0x19717
je 0x196e8
cmp eax, 0x80172680
je 0x195b3
cmp eax, 0x80172684
je 0x19584
cmp eax, 0x80172688
je 0x19555
cmp eax, 0x8017268c
je 0x19526
cmp eax, 0x80172690
jne 0x1948e
cmp r8d, 0xc
jb 0x197cf
mov r9d, dword [rdi + 4]
lea eax, [r9 - 1]
lea rcx, [rax*4 + 0xc]
cmp r8, rcx
jb 0x197cf
lea rdx, [rbp + 0x340]
jmp 0x19b73
cmp r8d, 0xc
jb 0x197cf
mov r9d, dword [rdi + 4]
lea eax, [r9 - 1]
lea rcx, [rax*4 + 0xc]
cmp r8, rcx
jb 0x197cf
lea rdx, [rbp + 0x280]
jmp 0x19b73
cmp r8d, 0xc
jb 0x197cf
mov r9d, dword [rdi + 4]
lea eax, [r9 - 1]
lea rcx, [rax*4 + 0xc]
cmp r8, rcx
jb 0x197cf
lea rdx, [rbp + 0x1c0]
jmp 0x19b73
cmp r8d, 0xc
jb 0x197cf
mov r9d, dword [rdi + 4]
lea eax, [r9 - 1]
lea rcx, [rax*4 + 0xc]
cmp r8, rcx
jb 0x197cf
lea rdx, [rbp + 0x100]
jmp 0x19b73
cmp r8d, 0x2e
jb 0x197cf
cmp dword [rdi + 0x10], esi
je 0x197cf
cmp dword [rdi + 0xc], esi
je 0x197cf
cmp rbp, rsi
jne 0x195de
mov esi, 0xc0000001
jmp 0x19be8
lea rcx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov ecx, dword [rdi + 0x10]
mov r12d, 1
mov dword [rbp + 0xf40], ecx
movzx ecx, word [rdi]
mov dl, al
mov word [rbp + 0xf48], cx
movzx ecx, word [rdi + 2]
mov word [rbp + 0xf4a], cx
movzx ecx, word [rdi + 4]
mov word [rbp + 0xf4c], cx
movzx ecx, word [rdi + 6]
mov word [rbp + 0xf52], cx
movzx ecx, word [rdi + 8]
mov word [rbp + 0xf4e], cx
movzx ecx, word [rdi + 0xa]
mov word [rbp + 0xf50], cx
movzx eax, word [rdi + 0x14]
lea rcx, [rbp + 0x30]
mov word [rbp + 0xf54], ax
movzx eax, word [rdi + 0x16]
mov word [rbp + 0xf56], ax
movzx eax, word [rdi + 0x18]
mov word [rbp + 0xf58], ax
movzx eax, word [rdi + 0x1a]
mov word [rbp + 0xf5a], ax
movzx eax, word [rdi + 0x1c]
mov word [rbp + 0xf5c], ax
movzx eax, word [rdi + 0x1e]
mov word [rbp + 0xf5e], ax
movzx eax, word [rdi + 0x20]
mov word [rbp + 0xf60], ax
movzx eax, word [rdi + 0x22]
mov word [rbp + 0xf62], ax
movzx eax, word [rdi + 0x24]
mov word [rbp + 0xf64], ax
movzx eax, word [rdi + 0x26]
mov word [rbp + 0xf66], ax
movzx eax, word [rdi + 0x28]
mov word [rbp + 0xf68], ax
movzx eax, word [rdi + 0x2a]
mov word [rbp + 0xf6a], ax
movzx eax, word [rdi + 0x2c]
mov word [rbp + 0xf6c], ax
mov eax, dword [rdi + 0xc]
mov byte [rbp + 0xf6e], r12b
mov dword [rbp + 0xf44], eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x19be8
cmp r8d, 0xc
jb 0x197cf
mov r9d, dword [rdi + 4]
lea eax, [r9 - 1]
lea rcx, [rax*4 + 0xc]
cmp r8, rcx
jb 0x197cf
lea rdx, [rbp + 0x400]
jmp 0x19b73
cmp eax, 0x80172698
je 0x1985e
cmp eax, 0x8017269c
je 0x197c9
cmp eax, 0x801726a0
je 0x19751
cmp eax, 0x801726a4
jne 0x1948e
mov edx, r8d
mov rcx, rdi
call fcn.00014a04
mov esi, eax
jmp 0x19be8
mov edx, 0xc000000d
cmp rdi, rsi
je 0x19be6
cmp r8d, 0x10
jbe 0x19be6
cmp dword [rdi], 0x55535255
jne 0x19be6
lea rdx, [0x00214790]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00214810]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, dword [rdi + 8]
lea r9, [rdi + 0xc]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r8d, 3
mov dword [rsp + 0x20], eax
call fcn.00017b24
mov edx, eax
mov eax, dword [rdi + 4]
mov dword [0x00216ddc], eax
jmp 0x19be6
cmp r8d, 8
jae 0x197d9
mov esi, 0xc000000d
jmp 0x19be8
mov edx, dword [rdi]
lea eax, [rdx - 1]
lea rcx, [rax*4 + 8]
cmp r8, rcx
jb 0x197cf
add rbp, 0x40
cmp edx, esi
jbe 0x19be8
add rdi, 4
mov rbx, rdx
mov r12d, 1
xor eax, eax
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov eax, dword [rdi]
mov dword [rsp + 0x50], eax
call fcn.0001a250
cmp rax, rsi
jne 0x19850
lea rdx, [rsp + 0x40]
mov r8d, 0x18
mov rcx, rbp
call fcn.0001a1e4
cmp rax, rsi
je 0x19850
mov rdx, rax
mov rcx, rbp
call fcn.0001a304
add rdi, 4
sub rbx, r12
jne 0x19804
jmp 0x19be8
cmp r8d, 0xc
jb 0x197cf
mov r9d, dword [rdi + 4]
lea eax, [r9 - 1]
lea rcx, [rax*4 + 0xc]
cmp r8, rcx
jb 0x197cf
lea rdx, [rbp + 0x4c0]
jmp 0x19b73
mov ecx, 1
call fcn.00014334
jmp 0x19be8
mov edx, 0x801726c4
cmp eax, edx
ja 0x199f5
je 0x1999c
cmp eax, 0x801726ac
je 0x1998a
cmp eax, 0x801726b0
je 0x19978
cmp eax, 0x801726b4
je 0x19900
cmp eax, 0x801726b8
je 0x198ee
cmp eax, 0x801726c0
jne 0x1948e
mov edx, r8d
mov rcx, rdi
call fcn.000152ac
jmp 0x1974a
mov edx, ecx
mov r8, r13
mov rcx, rdi
call fcn.00014f2c
jmp 0x1974a
mov edx, 0xc000000d
cmp rdi, rsi
je 0x19be6
cmp r8d, 0x10
jbe 0x19be6
cmp dword [rdi], 0x55535255
jne 0x19be6
lea rdx, [0x00214790]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x000200a0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, dword [rdi + 8]
lea r9, [rdi + 0xc]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r8d, 3
mov dword [rsp + 0x20], eax
call fcn.00017b24
mov ecx, dword [rdi + 4]
mov dword [0x002170e4], ecx
mov edx, eax
jmp 0x19be6
mov edx, ecx
mov r8, r13
mov rcx, rdi
call fcn.00014e4c
jmp 0x1974a
mov edx, ecx
mov r8, r13
mov rcx, rdi
call fcn.00014ba4
jmp 0x1974a
mov edx, 0xc000000d
cmp rdi, rsi
je 0x19be6
cmp ecx, 0xa48
jb 0x19be6
cmp dword [rdi], 0x55535255
jne 0x19be6
lea rdx, [0x00617e20]
add rdi, 0x48
mov r12d, 1
sub rdi, rdx
mov al, byte [rdx]
mov byte [rdx + rdi], al
add rdx, r12
cmp al, sil
jne 0x199d6
cmp r13, rsi
je 0x19be4
mov qword [r13 + 8], rcx
jmp 0x19be4
cmp eax, 0x801726c8
je 0x19b81
cmp eax, 0x801726cc
je 0x19a3d
cmp eax, 0x801726d0
je 0x19a2b
cmp eax, 0x801726d4
jne 0x1948e
mov r12d, 1
mov byte [0x00618235], r12b
jmp 0x19be8
mov edx, ecx
mov r8, r13
mov rcx, rdi
call fcn.00015394
jmp 0x1974a
cmp r8d, 0xc
jb 0x197cf
mov r9d, dword [rdi + 4]
lea eax, [r9 - 1]
lea rcx, [rax*4 + 0xc]
cmp r8, rcx
jb 0x197cf
mov eax, dword [rdi]
cmp eax, 0xa
ja 0x19aed
je 0x19ae1
mov r12d, 1
sub eax, r12d
je 0x19578
sub eax, r12d
je 0x195a7
sub eax, r12d
je 0x19549
sub eax, r12d
je 0x1951a
sub eax, r12d
je 0x1970b
sub eax, r12d
je 0x19ad5
sub eax, r12d
je 0x19ac9
sub eax, r12d
je 0x19abd
cmp eax, r12d
jne 0x19be8
jmp 0x19881
lea rdx, [rbp + 0x580]
jmp 0x19b73
lea rdx, [rbp + 0x700]
jmp 0x19b73
lea rdx, [rbp + 0x640]
jmp 0x19b73
lea rdx, [rbp + 0x7c0]
jmp 0x19b73
sub eax, 0xb
je 0x19b6c
mov r12d, 1
sub eax, r12d
je 0x19b63
sub eax, r12d
je 0x19b5a
sub eax, r12d
je 0x19b51
sub eax, r12d
je 0x19b48
sub eax, r12d
je 0x19b3f
sub eax, r12d
je 0x19b36
sub eax, r12d
je 0x19b2d
cmp eax, r12d
jne 0x19be8
lea rdx, [rbp + 0xe80]
jmp 0x19b73
lea rdx, [rbp + 0xdc0]
jmp 0x19b73
lea rdx, [rbp + 0xd00]
jmp 0x19b73
lea rdx, [rbp + 0xc40]
jmp 0x19b73
lea rdx, [rbp + 0xb80]
jmp 0x19b73
lea rdx, [rbp + 0xac0]
jmp 0x19b73
lea rdx, [rbp + 0xa00]
jmp 0x19b73
lea rdx, [rbp + 0x940]
jmp 0x19b73
lea rdx, [rbp + 0x880]
lea r8, [rdi + 8]
mov rcx, rbp
call fcn.0001a374
jmp 0x19be8
mov al, byte [0x00618234]
mov edx, 0xc000000d
cmp al, sil
jne 0x19be8
cmp rdi, rsi
je 0x19be6
cmp r8d, 0x44
jbe 0x19be6
cmp dword [rdi], 0x55535255
jne 0x19be6
cmp dword [rdi + 4], 0x53574543
jne 0x19bb7
mov rcx, rdi
call fcn.00016ce8
jmp 0x19be4
cmp dword [rdi + 4], 0x53575250
jne 0x19bca
mov rcx, rdi
call fcn.00016fc4
jmp 0x19be4
cmp dword [rdi + 4], 0x53574544
movzx eax, al
mov r12d, 1
cmove eax, r12d
mov byte [0x00618234], al
mov edx, esi
mov esi, edx
xor edx, edx
mov rcx, r14
mov dword [r13], esi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret