Function at 0x2e558
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
and dword [rax + 0x20], 0
and dword [rax + 8], 0
and dword [rax + 0x18], 0
mov rbx, rcx
lea rcx, [0x0002e580]
mov rbp, rdx
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x0002e5b0]
lea rcx, [rsp + 0x160]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x0002e5d0]
lea rcx, [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x0002e5f0]
lea rcx, [rsp + 0x140]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edi, 0xc8
lea rcx, [rsp + 0x60]
mov r8, rdi
xor edx, edx
mov qword [0x0002c4b0], rbx
call fcn.0001ce80
and dword [rsp + 0x68], 0
lea rax, [0x00011190]
movdqu xmm0, xmmword [rsp + 0x150]
movdqu xmm1, xmmword [rsp + 0x140]
mov qword [rsp + 0xa0], rax
lea rax, [0x000111b4]
mov byte [rsp + 0x60], 0x8b
movdqu xmmword [rsp + 0x70], xmm0
movdqu xmm0, xmmword [rsp + 0x160]
movdqu xmmword [rsp + 0x80], xmm1
mov qword [rsp + 0xb0], rax
lea rax, [0x00011478]
mov word [rsp + 0x62], di
mov qword [rsp + 0xb8], rax
lea rax, [0x000113e8]
mov byte [rsp + 0x61], 1
movdqu xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xc0], rax
lea rax, [0x00011398]
mov byte [rsp + 0x64], 6
mov qword [rsp + 0xc8], rax
lea rax, [0x00011b28]
mov byte [rsp + 0x65], 0
mov qword [rsp + 0xa8], rax
lea rax, [0x00011590]
mov byte [rsp + 0x66], 1
mov qword [rsp + 0xf8], rax
lea rax, [fcn.000116cc]
mov byte [rsp + 0x67], 0
mov qword [rsp + 0x100], rax
lea rax, [0x0001164c]
lea r9, [0x0002c4b8]
mov qword [rsp + 0x108], rax
lea rax, [0x00011808]
lea r8, [rsp + 0x60]
mov qword [rsp + 0xd0], rax
lea rax, [0x000118f8]
mov rdx, rbx
mov qword [rsp + 0xf0], rax
lea rax, [0x000117f4]
mov rcx, rbx
mov qword [rsp + 0xd8], rax
lea rax, [0x00011974]
mov qword [rsp + 0xe8], rax
lea rax, [0x000117cc]
mov qword [rsp + 0x110], rax
lea rax, [0x000117e0]
mov qword [rsp + 0x118], rax
lea rax, [0x000117b8]
mov qword [rsp + 0x120], rax
lea rax, [0x00011b14]
mov qword [rsp + 0xe0], rax
lea rax, [0x000114e8]
mov qword [rbx + 0x68], rax
and qword [0x0002c4b8], 0
and qword [0x0002c4a0], 0
lea rax, [0x0002c490]
mov qword [0x0002c498], rax
mov qword [0x0002c490], rax
call qword [sym.imp.NDIS.SYS_NdisFRegisterFilterDriver]
lea rcx, [0x0002e640]
mov edx, eax
mov edi, eax
call sub.ntoskrnl.exe_DbgPrint
test edi, edi
jne 0x2e36b
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0xe0
call fcn.0001ce80
lea r11, [0x00011c24]
lea rax, [0x00011b34]
lea rdx, [0x0001d3d0]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x180], r11
mov qword [rsp + 0x210], r11
mov qword [rsp + 0x190], r11
mov qword [rsp + 0x1f0], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x0001d3f0]
lea rcx, [rsp + 0x170]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ebx, [rdi + 0x38]
lea rcx, [rsp + 0x20]
mov r8, rbx
xor edx, edx
call fcn.0001ce80
mov rcx, qword [0x0002c4b8]
lea rax, [rsp + 0x130]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
lea r9, [0x00025748]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x180]
lea r8, [0x00025750]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x20], 0x85
mov byte [rsp + 0x21], 1
mov qword [rsp + 0x38], rax
mov word [rsp + 0x22], bx
mov dword [rsp + 0x40], 0x10
call qword [sym.imp.NDIS.SYS_NdisRegisterDeviceEx]
mov edi, eax
test eax, eax
jne 0x2e34c
mov rcx, qword [0x00025750]
call qword [sym.imp.NDIS.SYS_NdisGetDeviceReservedExtension]
mov dword [rax], 0x46544452
mov rcx, qword [0x0002c4b8]
mov qword [rax + 8], rcx
lea rcx, [0x0002e690]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
test edi, edi
je 0x2e39d
mov rcx, qword [0x0002c4b8]
call qword [sym.imp.NDIS.SYS_NdisFDeregisterFilterDriver]
lea rcx, [0x0002e7c0]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x0002e7f0]
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0x288]
mov eax, edi
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
lea r8, [rsp + 0x280]
lea rdx, [0x0002e6d0]
mov rcx, rbp
call fcn.00011008
movzx edx, byte [0x00025742]
mov ebx, dword [rsp + 0x280]
movzx ecx, bl
test eax, eax
mov r8d, ebx
cmove edx, ecx
lea rcx, [0x0002e6f0]
mov byte [0x00025742], dl
movzx r9d, dl
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
lea r8, [rsp + 0x290]
lea rdx, [0x0002e740]
mov rcx, rbp
call fcn.00011008
mov edx, dword [0x00025a24]
movzx r9d, byte [0x00025742]
test eax, eax
lea rcx, [0x0002e6f0]
mov r8d, ebx
cmove edx, dword [rsp + 0x290]
mov dword [0x00025a24], edx
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
lea r8, [rsp + 0x298]
lea rdx, [0x0002e760]
mov rcx, rbp
call fcn.00011008
movzx edx, byte [0x00025741]
movzx ecx, byte [rsp + 0x298]
test eax, eax
cmove edx, ecx
lea rcx, [0x0002e780]
mov byte [0x00025741], dl
movzx r8d, dl
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
lea r11, [0x000131f8]
test r11, r11
je 0x2e4c0
mov edx, dword [0x000257c4]
cmp edx, 0xa
je 0x2e4c6
lea r8, [0x000257d0]
lea rcx, [rdx + rdx*2]
lea rax, [0x00012ba8]
add rcx, rcx
and qword [r8 + rcx*8 + 0x20], 0
mov qword [r8 + rcx*8 + 8], rax
lea rax, [0x00012ff4]
inc edx
mov qword [r8 + rcx*8 + 0x10], rax
mov qword [r8 + rcx*8 + 0x18], r11
mov dword [0x000257c4], edx
jmp 0x2e4c6
mov edx, dword [0x000257c4]
xor ebx, ebx
test edx, edx
je 0x2e379
lea rsi, [0x000257d8]
mov rax, qword [rsi]
test rax, rax
je 0x2e4e7
call rax
mov edx, dword [0x000257c4]
inc ebx
add rsi, 0x30
cmp ebx, edx
jb 0x2e4d7
jmp 0x2e379
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0002e4fc
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x2e008