Function at 0x17e78
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
movzx r10d, byte [r8 + 1]
mov rsi, r9
mov rbp, rdx
cmp r10d, 9
mov r12, rcx
jg 0x18059
je 0x1804f
xor ebx, ebx
lea edi, [rbx + 1]
cmp r10d, ebx
je 0x1803a
sub r10d, edi
je 0x18015
sub r10d, edi
je 0x17f9f
sub r10d, edi
je 0x17f98
sub r10d, edi
je 0x17f83
sub r10d, edi
je 0x17f6e
sub r10d, edi
je 0x17f56
sub r10d, edi
je 0x17f0a
cmp r10d, edi
jne 0x18160
mov rcx, r9
call fcn.00013054
jmp 0x17ff3
mov rax, qword [rdx + 0xb8]
cmp dword [rax + 8], 4
jne 0x18160
mov edx, 0x10
mov r8d, 0x62735556
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
cmp rax, rbx
je 0x180cb
mov dword [rax], edi
mov rax, qword [rsi]
mov qword [r12 + 8], rax
mov rcx, qword [rsi]
call qword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
mov qword [rbp + 0x38], r12
jmp 0x18163
cmp dword [r9 + 0xc], 2
jne 0x18163
mov eax, dword [r9 + 0x10]
mov dword [r9 + 0xc], eax
jmp 0x18163
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 2
mov dword [r9 + 0x10], eax
jmp 0x18163
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 3
mov dword [r9 + 0x10], eax
jmp 0x18163
cmp dword [r9 + 0xc], 4
jmp 0x17f5b
cmp byte [r9 + 0x49], bl
je 0x17ffa
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 6
mov dword [r9 + 0x10], eax
mov rax, qword [r9 + 0x20]
cmp rax, rbx
je 0x17fe8
mov rbx, qword [rax + 0x40]
lea rcx, [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov rax, qword [rsi + 0x40]
mov rdx, qword [rsi + 0x38]
mov qword [rax], rdx
mov qword [rdx + 8], rax
dec dword [rbx + 0x40]
lea rcx, [rbx + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov rdx, rsi
mov rcx, r12
call fcn.000179b0
mov ebx, eax
jmp 0x18163
cmp byte [r9 + 0x48], bl
je 0x18163
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], ebx
mov dword [r9 + 0x10], eax
jmp 0x18163
cmp dword [r9 + 0x4c], ebx
je 0x18025
mov ebx, 0xc0000001
jmp 0x18163
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0xc], 4
mov dword [r9 + 0x10], eax
jmp 0x18163
mov eax, dword [r9 + 0xc]
mov dword [r9 + 0x1c], edi
mov dword [r9 + 0xc], edi
mov dword [r9 + 0x10], eax
jmp 0x18163
mov rcx, r9
call fcn.00018194
jmp 0x17ff3
sub r10d, 0xa
je 0x18160
mov edi, 1
sub r10d, edi
je 0x18160
sub r10d, edi
je 0x18106
sub r10d, 5
je 0x180fe
sub r10d, 2
je 0x180f1
sub r10d, 2
je 0x180b1
sub r10d, edi
je 0x1801b
cmp r10d, edi
jne 0x18160
mov eax, dword [r9 + 0xc]
xor ebx, ebx
mov dword [r9 + 0xc], 5
mov dword [r9 + 0x10], eax
jmp 0x18163
mov edx, 0x18
mov r8d, 0x62735556
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor ebx, ebx
cmp rax, rbx
jne 0x180d5
mov ebx, 0xc000009a
jmp 0x18163
movdqu xmm0, xmmword [0x000104d0]
mov dword [rax + 0x10], 0xf
mov dword [rax + 0x14], ebx
movdqu xmmword [rax], xmm0
mov qword [rbp + 0x38], rax
jmp 0x18163
mov rcx, r9
call fcn.00018260
jmp 0x17ff3
xor ebx, ebx
mov byte [r9 + 0x48], bl
jmp 0x18163
mov rcx, qword [rdx + 0xb8]
xor ebx, ebx
mov edx, dword [rcx + 8]
cmp edx, ebx
je 0x1811b
mov ebx, dword [rbp + 0x30]
jmp 0x18163
cmp qword [rbp + 0x38], rbx
jne 0x18163
mov edx, 0x48
mov r8d, 0x62735556
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, rbx
je 0x180cb
lea r9, [0x00023f90]
lea r8, [0x00023fa0]
lea rdx, [0x00023fb0]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov qword [rbp + 0x38], rdi
jmp 0x18163
mov ebx, dword [rdx + 0x30]
xor edx, edx
mov rcx, rbp
mov dword [rbp + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret