Function at 0x14000c738
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r14d, 0x200
lea rbx, [0x14006cee0]
mov r8d, r14d
mov rcx, rbx
xor edx, edx
call fcn.1400115c0
lea rdx, [0x140013c70]
mov qword [0x14006d0e8], rbx
lea rcx, [rsp + 0x40]
mov dword [0x14006d0e0], 0x2000000
xor ebp, ebp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rsi, [0x14006d0e0]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14000b02c
mov ebx, eax
test eax, eax
jns 0x14000c7c1
lfence
mov edx, eax
lea rcx, [0x140013cb0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x14000cadb
mov rbx, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov r15d, 2
mov qword [rsp + 0x30], rsi
movzx r9d, bl
lea r8, [0x140013d00]
mov qword [rsp + 0x28], rdi
mov edx, r15d
mov qword [rsp + 0x20], rax
lea ecx, [r15 + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
call fcn.14000b588
mov esi, 0x6e4d7350
mov ecx, eax
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [rsp + 0x50], 0x2000000
mov rbx, rax
test rax, rax
jne 0x14000c83f
lea rcx, [0x140013d60]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000022
jmp 0x14000cadb
lea rcx, [0x14006d188]
call fcn.14000e120
mov edi, eax
test eax, eax
jns 0x14000c874
lfence
mov edx, eax
lea rcx, [0x140013d90]
call sub.ntoskrnl.exe_DbgPrint
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x14000cadb
xor r8d, r8d
lea rdx, [0x14000cff0]
lea ecx, [r8 + 4]
call section..text
lea rcx, [0x14006d180]
call fcn.14000e120
mov edi, eax
test eax, eax
jns 0x14000c8b8
lfence
mov edx, eax
lea rcx, [0x140013de0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x14006d188]
call fcn.14000e058
jmp 0x14000c862
xor r8d, r8d
lea rdx, [0x14000d100]
lea ecx, [r8 + 5]
call section..text
lea rcx, [0x14006d178]
call fcn.14000e120
mov edi, eax
test eax, eax
jns 0x14000c903
lfence
mov edx, eax
lea rcx, [0x140013e30]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [0x14006d188]
call fcn.14000e058
mov rcx, qword [0x14006d180]
jmp 0x14000c8b1
xor r8d, r8d
lea rdx, [0x14000cfb0]
lea ecx, [r8 + 6]
call section..text
mov r14d, 1
mov qword [0x14006d148], rbp
mov edx, r14d
mov dword [0x14006d140], r14d
xor r8d, r8d
mov dword [0x14006d150], ebp
lea rcx, [0x14006d158]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rcx, [0x14006d100]
call qword [sym.imp.ntoskrnl.exe_KeInitializeGuardedMutex]
lea rcx, [fcn.14000beb0]
call fcn.14000e4b8
mov edi, eax
test eax, eax
jns 0x14000c989
lfence
mov rcx, qword [0x14006d188]
call fcn.14000e058
mov rcx, qword [0x14006d180]
call fcn.14000e058
mov rcx, qword [0x14006d178]
jmp 0x14000c8b1
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
lea rdx, [0x140013e80]
mov qword [0x14006d1e0], rax
mov ecx, 3
lea rax, [0x14000d280]
mov dword [0x14006d1e8], ecx
mov qword [0x14006d1f0], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsThreadType]
mov qword [0x14006d200], rax
lea rax, [0x14000dab0]
mov qword [0x14006d210], rax
lea rax, [0x14006d1e0]
mov dword [0x14006d208], ecx
lea rcx, [0x14006d1a8]
mov qword [0x14006d1c0], rax
mov byte [0x14006ce08], r14b
mov qword [0x14006d1f8], rbp
mov qword [0x14006d218], rbp
mov dword [0x14006d1a0], 0x20100
mov qword [0x14006d1b8], rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x14006ce10]
lea rcx, [0x14006d1a0]
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
mov ebx, eax
test eax, eax
jns 0x14000ca5a
lea rcx, [0x140013e90]
mov edx, ebx
lfence
call sub.ntoskrnl.exe_DbgPrint
call fcn.14000c4dc
jmp 0x14000c7ba
xor edx, edx
lea rcx, [0x14000c1d0]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
mov ebx, eax
test eax, eax
jns 0x14000ca78
lea rcx, [0x140013ee0]
jmp 0x14000ca46
lea rcx, [0x14000d030]
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
mov esi, eax
lfence
test eax, eax
jns 0x14000caa3
mov edx, eax
lea rcx, [0x140013f30]
call sub.ntoskrnl.exe_DbgPrint
call fcn.14000c4dc
jmp 0x14000cad9
mov rdi, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
movzx r9d, dil
lea r8, [0x140013f80]
mov edx, r15d
mov qword [rsp + 0x28], rbx
mov ecx, 0x4d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret