Function at 0x140001248
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
xor edi, edi
mov rbx, rcx
cmp qword [0x14006cb60], rdi
je 0x140001277
mov eax, 0xc0000718
jmp 0x14000149a
xor edx, edx
lea rcx, [rbp - 0x57]
lea r8d, [rdx + 0x76]
call fcn.1400115c0
xorps xmm0, xmm0
mov dword [rbp + 0x27], 0x30
lea r8, [rbp + 0x27]
mov qword [rbp + 0x2f], rdi
mov edx, 0xf003f
mov dword [rbp + 0x3f], edi
lea rcx, [rbp + 0x77]
mov qword [rbp + 0x37], rbx
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
jns 0x1400012d1
lfence
mov edx, eax
lea rcx, [0x1400116b0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x14000149a
mov rcx, qword [rbp + 0x77]
lea r8, [rbp + 0x6f]
mov r9d, 1
lea rdx, [0x1400116f0]
call fcn.1400011bc
cmp dword [rbp + 0x6f], edi
lea r8, [rbp + 0x6f]
mov rcx, qword [rbp + 0x77]
lea rdx, [0x140011710]
setne byte [rbp - 0x59]
xor r9d, r9d
call fcn.1400011bc
cmp dword [rbp + 0x6f], edi
lea r9, [rbp - 0x51]
mov rcx, qword [rbp + 0x77]
lea rdx, [0x140011730]
mov ebx, 7
mov qword [rsp + 0x20], rdi
mov r8d, ebx
setne byte [rbp - 0x58]
call fcn.1400014b0
mov rcx, qword [rbp + 0x77]
lea r9, [rbp - 0x41]
mov r8d, ebx
mov qword [rsp + 0x20], rdi
lea rdx, [0x140011760]
call fcn.1400014b0
mov rcx, qword [rbp + 0x77]
lea r9, [rbp - 0x31]
mov r8d, ebx
mov qword [rsp + 0x20], rdi
lea rdx, [0x140011790]
call fcn.1400014b0
mov rcx, qword [rbp + 0x77]
lea r9, [rbp - 0x21]
mov r8d, ebx
mov qword [rsp + 0x20], rdi
lea rdx, [0x1400117c0]
call fcn.1400014b0
mov rcx, qword [rbp + 0x77]
lea r9, [rbp - 0x11]
mov r8d, ebx
mov qword [rsp + 0x20], rdi
lea rdx, [0x1400117f0]
call fcn.1400014b0
mov rcx, qword [rbp + 0x77]
lea r9, [rbp - 1]
mov r8d, ebx
mov qword [rsp + 0x20], rdi
lea rdx, [0x140011820]
call fcn.1400014b0
mov rcx, qword [rbp + 0x77]
lea r9, [rbp + 0xf]
mov r8d, ebx
mov qword [rsp + 0x20], rdi
lea rdx, [0x140011840]
call fcn.1400014b0
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
call fcn.14000b588
mov ecx, eax
lea edx, [rbx + 0x71]
mov r8d, 0x67666e43
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x14006cb60], rax
test rax, rax
jne 0x140001421
lea rcx, [0x140011870]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [rbp - 0x59]
call fcn.140001678
mov eax, 0xc0000017
jmp 0x14000149a
movaps xmm0, xmmword [rbp - 0x59]
movaps xmm1, xmmword [rbp - 0x49]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [rbp - 0x39]
movups xmmword [rax + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x29]
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x19]
movups xmmword [rax + 0x30], xmm1
movaps xmm1, xmmword [rbp - 9]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [rbp + 7]
movups xmmword [rax + 0x50], xmm1
movsd xmm1, qword [rbp + 0x17]
movups xmmword [rax + 0x60], xmm0
movsd qword [rax + 0x70], xmm1
mov rdi, cr8
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov edx, 2
movzx r9d, dil
mov qword [rsp + 0x28], rbx
lea r8, [0x1400118b0]
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x4b]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret