Function at 0x14000dd40
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
lea rcx, [0x140017e00]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [0x14001b160], 0
jne 0x14000dd5e
jmp 0x14000e374
lea rcx, [0x140017e40]
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400108c0]
call fcn.140002470
mov byte [0x14001b150], 0
cmp qword [0x14001b480], 0
je 0x14000dde0
lea rcx, [0x140017e80]
call sub.ntoskrnl.exe_DbgPrint
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001b4a0]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001b480]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [0x14001b480]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [0x14001b480], 0
cmp qword [0x14001b500], 0
je 0x14000de55
mov dword [rsp + 0x30], 0
jmp 0x14000ddfe
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [0x14001b4f8]
cmp dword [rsp + 0x30], eax
jge 0x14000de55
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
add rax, 0x88
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
add rax, 0x70
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
jmp 0x14000ddf4
cmp qword [0x14001b6d8], 0
je 0x14000dea7
lea rcx, [0x140017ea0]
call sub.ntoskrnl.exe_DbgPrint
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001b6c0]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001b6d8]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [0x14001b6d8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [0x14001b6d8], 0
cmp qword [0x14001b500], 0
je 0x14000e33a
lea rcx, [0x140017ec0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x30], 0
jmp 0x14000ded5
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [0x14001b4f8]
cmp dword [rsp + 0x30], eax
jge 0x14000e305
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
test rax, rax
je 0x14000e300
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
add rax, 0x40
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
add rax, 0x58
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov edx, dword [rsp + 0x30]
lea rcx, [0x140017ef0]
call sub.ntoskrnl.exe_DbgPrint
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x108], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x20], 0
je 0x14000dffb
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x20], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x10], 0
je 0x14000e074
lfence
cmp dword [0x14001b164], 0
je 0x14000e03d
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x14000e05c
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x10], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x28], 0
je 0x14000e0c0
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x20], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x18], 0
je 0x14000e139
lfence
cmp dword [0x14001b164], 0
je 0x14000e102
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x14000e121
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x18], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
cmp qword [rax], 0
je 0x14000e184
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 8], 0
je 0x14000e1d2
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetElementGenericTable]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000e21f
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTable]
jmp 0x14000e1d2
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x30], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlGetElementGenericTable]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000e2a0
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rax + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTable]
jmp 0x14000e253
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x38], 0
movsxd rax, dword [rsp + 0x30]
xor edx, edx
mov rcx, qword [0x14001b500]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001b500]
mov qword [rcx + rax*8], 0
jmp 0x14000decb
xor edx, edx
mov rcx, qword [0x14001b500]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [0x14001b508]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x14001b500], 0
lea rcx, [0x140017f20]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x14001b158], 0
je 0x14000e368
xor edx, edx
mov rcx, qword [0x14001b158]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x14001b158], 0
mov dword [0x14001b510], 0
lea rcx, [0x140017f40]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x48
ret