Function at 0x130fc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov al, byte [0x000266c2]
xor r14d, r14d
mov sil, dl
mov rbx, rcx
mov byte [rsp + 0xc0], r14b
cmp al, r14b
je 0x1314c
movzx r8d, dl
mov edx, dword [0x00026758]
lea rcx, [0x0001e580]
call sub.ntoskrnl.exe_DbgPrint
mov al, byte [0x000266c2]
cmp byte [0x000266c1], r14b
je 0x13175
cmp al, r14b
je 0x13a55
lea rcx, [0x0001e5b0]
mov edx, dword [0x00026758]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x13a55
cmp byte [0x000266c0], r14b
je 0x13190
cmp al, r14b
je 0x13a55
lea rcx, [0x0001e5f0]
jmp 0x13165
mov r13d, 1
add dword [0x00026758], r13d
call fcn.00015554
cmp sil, r14b
je 0x131af
mov dword [0x000266f8], eax
jmp 0x131b5
mov dword [0x000266fc], eax
mov eax, dword [0x000251a0]
test eax, eax
jne 0x131e6
mov edx, dword [0x00026758]
or ebx, 0xffffffff
add edx, ebx
mov dword [0x00026758], edx
cmp byte [0x000266c2], r14b
je 0x13a55
lea rcx, [0x0001e620]
jmp 0x1316b
cmp eax, r13d
jne 0x13219
mov edx, dword [0x00026758]
or ebx, 0xffffffff
add edx, ebx
mov dword [0x00026758], edx
cmp byte [0x000266c2], r14b
je 0x13211
lea rcx, [0x0001e650]
call sub.ntoskrnl.exe_DbgPrint
mov eax, r13d
jmp 0x13a57
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x48], rdi
cmp byte [rbx + 0x28], r14b
jne 0x1328a
xor r9d, r9d
xor r10d, r10d
xor r11d, r11d
mov rdx, rdi
cmp rdi, r14
je 0x1327b
mov ebp, 0xfff
mov r8d, dword [rdx + 0x28]
add r9d, r8d
cmp r8d, r14d
jne 0x1324f
mov eax, r13d
jmp 0x1326d
mov ecx, dword [rdx + 0x2c]
mov eax, r8d
shr r8d, 0xc
add ecx, dword [rdx + 0x20]
and eax, ebp
and ecx, ebp
lea eax, [rcx + rax + 0xfff]
shr eax, 0xc
add eax, r8d
mov rdx, qword [rdx]
add r10d, eax
add r11d, r13d
cmp rdx, r14
jne 0x1323e
mov dword [rbx + 0x20], r11d
mov dword [rbx + 4], r9d
mov dword [rbx], r10d
mov byte [rbx + 0x28], r13b
mov ebp, dword [rbx + 0x20]
mov r12d, dword [rbx + 4]
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x40], r12d
test rdi, rdi
je 0x13a4c
test ebp, ebp
je 0x13a4c
cmp ebp, 3
jb 0x132dd
jne 0x132b9
add dword [0x0002675c], r13d
cmp ebp, 4
jne 0x132c5
add dword [0x00026760], r13d
cmp ebp, 5
jne 0x132d1
add dword [0x00026764], r13d
cmp ebp, 7
jne 0x132dd
add dword [0x0002676c], r13d
test byte [0x0002519c], r13b
je 0x13323
test sil, sil
je 0x13301
lock add dword [0x00026700], r13d
mov eax, dword [rsp + 0x40]
lock xadd dword [0x0002670c], eax
jmp 0x13315
lock add dword [0x00026704], r13d
mov eax, dword [rsp + 0x40]
lock xadd dword [0x00026714], eax
mov ebp, dword [rsp + 0x44]
mov r12d, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
test byte [rdi + 0xa], 5
je 0x1332f
mov r8, qword [rdi + 0x18]
jmp 0x13350
xor r9d, r9d
mov r8d, r13d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r8, rax
mov edx, dword [rdi + 0x28]
mov qword [rsp + 0x68], r8
test r8, r8
je 0x13a4c
cmp edx, 0xe
jb 0x13a4c
movzx ecx, word [r8 + 0xc]
or ebx, 0xffffffff
mov word [rsp + 0xc8], cx
mov al, byte [rsp + 0xc9]
mov byte [rsp + 0x51], cl
add ebp, ebx
mov byte [rsp + 0x50], al
movzx eax, word [rsp + 0x50]
mov ecx, 0x806
mov dword [rsp + 0x44], ebp
cmp ax, cx
je 0x139e6
mov ecx, 0x8035
cmp ax, cx
je 0x139e6
mov ecx, 0x800
cmp ax, cx
jne 0x13a4f
lea esi, [rdx - 0xe]
cmp esi, 0x14
jb 0x133d1
lea r14, [r8 + 0xe]
mov qword [rsp + 0x58], r14
jmp 0x13437
test ebp, ebp
je 0x13a4f
mov rdi, qword [rdi]
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x13a4f
test byte [rdi + 0xa], 5
je 0x133f6
mov r14, qword [rdi + 0x18]
jmp 0x13417
xor r9d, r9d
mov r8d, r13d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r14, rax
mov esi, dword [rdi + 0x28]
mov qword [rsp + 0x58], r14
test r14, r14
je 0x13a4f
cmp esi, 0x14
jb 0x13a4f
add ebp, ebx
mov dword [rsp + 0x44], ebp
mov al, byte [r14]
and al, 0xf0
cmp al, 0x40
jne 0x13a4f
mov al, byte [r14]
and al, 0xf
cmp al, 5
jne 0x13a4f
movzx ecx, word [r14 + 2]
movzx r13d, byte [r14]
and r13d, 0xf
mov word [rsp + 0x50], cx
mov al, byte [rsp + 0x51]
shl r13d, 2
mov byte [rsp + 0x61], cl
mov byte [rsp + 0x60], al
movzx r15d, word [rsp + 0x60]
mov dword [rsp + 0x64], r13d
test r15d, r15d
jne 0x134b0
cmp r12d, 0xe
jbe 0x134b0
cmp byte [r14 + 9], 6
jne 0x134b0
cmp byte [0x000266c2], 0
lea r15d, [r12 - 0xe]
je 0x134e1
lea rcx, [0x0001e680]
mov r8d, r12d
mov edx, r15d
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x000266c2], 0
je 0x134e1
lea eax, [r12 - 0xe]
lea rcx, [0x0001e6c0]
mov r9d, esi
mov dword [rsp + 0x30], eax
mov r8d, r13d
mov edx, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
call sub.ntoskrnl.exe_DbgPrint
cmp r15d, r13d
jb 0x139a9
cmp esi, r13d
jb 0x139a9
lea eax, [r12 - 0xe]
cmp r15d, eax
ja 0x139a9
movzx ecx, byte [r14 + 9]
sub ecx, 1
je 0x136df
sub ecx, 5
je 0x135f8
cmp ecx, 0xb
jne 0x13a4f
mov r12b, byte [rsp + 0xb8]
lea r14d, [rcx - 3]
test byte [0x0002519c], r14b
je 0x1356a
lea eax, [r15 + 0xe]
test r12b, r12b
je 0x13551
lock add dword [0x00026738], 1
lock xadd dword [0x0002674c], eax
jmp 0x13561
lock add dword [0x0002673c], 1
lock xadd dword [0x00026754], eax
mov ebp, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x48]
sub esi, r13d
cmp esi, r14d
jb 0x1357c
mov rax, qword [rsp + 0x58]
add r13, rax
jmp 0x135d8
test ebp, ebp
je 0x13a4f
mov rdi, qword [rdi]
test rdi, rdi
je 0x13a4f
test byte [rdi + 0xa], 5
je 0x1359c
mov r13, qword [rdi + 0x18]
jmp 0x135be
xor r9d, r9d
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r13, rax
mov esi, dword [rdi + 0x28]
test r13, r13
je 0x13a4f
cmp esi, r14d
jb 0x13a4f
mov rax, qword [rsp + 0x58]
cmp dword [0x00026774], 0
je 0x1376f
mov r8b, r12b
mov rdx, r13
mov rcx, rax
call fcn.00012f4c
jmp 0x1376f
test byte [0x0002519c], 0x10
mov r12b, byte [rsp + 0xb8]
je 0x1363d
lea eax, [r15 + 0xe]
test r12b, r12b
je 0x13624
lock add dword [0x00026718], 1
lock xadd dword [0x0002672c], eax
jmp 0x13634
lock add dword [0x0002671c], 1
lock xadd dword [0x00026734], eax
mov ebp, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x48]
sub esi, r13d
cmp esi, 0x14
jb 0x1364a
add r13, r14
jmp 0x136a3
test ebp, ebp
je 0x13a4f
mov rdi, qword [rdi]
test rdi, rdi
je 0x13a4f
test byte [rdi + 0xa], 5
je 0x1366a
mov r13, qword [rdi + 0x18]
jmp 0x1368c
xor r9d, r9d
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r13, rax
mov esi, dword [rdi + 0x28]
test r13, r13
je 0x13a4f
cmp esi, 0x14
jb 0x13a4f
add ebp, ebx
movzx r14d, word [r13 + 0xc]
shr r14d, 4
and r14d, 0xf
shl r14d, 2
cmp esi, r14d
jb 0x13a4f
cmp dword [0x00026770], 0
je 0x1376f
mov rcx, qword [rsp + 0x58]
mov r8b, r12b
mov rdx, r13
call fcn.00012e58
jmp 0x1376f
sub esi, r13d
mov r14d, 8
cmp esi, r14d
jb 0x136f7
mov rax, qword [rsp + 0x58]
add r13, rax
jmp 0x13753
test ebp, ebp
je 0x13a4f
mov rdi, qword [rdi]
test rdi, rdi
je 0x13a4f
test byte [rdi + 0xa], 5
je 0x13717
mov r13, qword [rdi + 0x18]
jmp 0x13739
xor r9d, r9d
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r13, rax
mov esi, dword [rdi + 0x28]
test r13, r13
je 0x13a4f
cmp esi, r14d
jb 0x13a4f
mov rax, qword [rsp + 0x58]
cmp dword [0x00026778], 0
je 0x1376f
mov r8b, byte [rsp + 0xb8]
mov rdx, r13
mov rcx, rax
call fcn.00013040
mov ecx, dword [rsp + 0x64]
mov eax, r15d
sub eax, ecx
cmp esi, eax
jb 0x1378a
mov r12d, r14d
add r12, r13
sub esi, r14d
jmp 0x1388b
xor r12d, r12d
test ebp, ebp
je 0x13889
and dword [rsp + 0x40], r12d
mov esi, r15d
sub esi, r14d
sub esi, ecx
mov rdi, qword [rdi]
test rdi, rdi
je 0x13864
test byte [rdi + 0xa], 5
je 0x137ba
mov rcx, qword [rdi + 0x18]
jmp 0x137dc
xor r9d, r9d
xor edx, edx
mov rcx, rdi
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov rcx, rax
mov eax, dword [rdi + 0x28]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0xc8], eax
test rcx, rcx
je 0x13864
test eax, eax
je 0x13864
add ebp, ebx
test r12, r12
jne 0x13824
cmp eax, esi
jae 0x138d8
mov edx, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r12, rax
test rax, rax
je 0x13864
mov eax, dword [rsp + 0xc8]
mov byte [rsp + 0xc0], 1
mov edx, dword [rsp + 0x40]
mov ecx, esi
sub ecx, edx
cmp eax, ecx
cmova eax, ecx
lea rcx, [r12 + rdx]
mov rdx, qword [rsp + 0x48]
mov r8d, eax
mov dword [rsp + 0xc8], eax
call fcn.0001dd60
mov eax, dword [rsp + 0x40]
add eax, dword [rsp + 0xc8]
mov dword [rsp + 0x40], eax
cmp eax, esi
je 0x1388b
test ebp, ebp
jne 0x137a2
cmp byte [rsp + 0xc0], 0
je 0x1387e
test r12, r12
je 0x1387e
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov byte [rsp + 0xc0], 0
xor r12d, r12d
xor esi, esi
mov r11, qword [rsp + 0x58]
sub r15d, r14d
sub r15d, dword [rsp + 0x64]
lea rdi, [r11 + 0xc]
cmp esi, r15d
cmova esi, r15d
xor r14d, r14d
cmp rdi, r14
je 0x13934
cmp byte [0x000266c2], r14b
je 0x138df
movzx ebp, byte [rsp + 0xb8]
mov r8d, dword [rdi]
lea rcx, [0x0001e770]
mov edx, ebp
call sub.ntoskrnl.exe_DbgPrint
mov r11, qword [rsp + 0x58]
jmp 0x138e7
mov r12, rcx
mov esi, eax
jmp 0x1388b
mov bpl, byte [rsp + 0xb8]
cmp bpl, r14b
jne 0x1393c
mov ecx, dword [rdi]
call fcn.00019024
cmp al, r14b
je 0x1393c
cmp byte [0x000266c2], r14b
je 0x1390d
lea rcx, [0x0001e7b0]
call sub.ntoskrnl.exe_DbgPrint
cmp byte [rsp + 0xc0], r14b
je 0x13a4f
cmp r12, r14
je 0x13a4f
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x13a4f
mov bpl, byte [rsp + 0xb8]
mov rcx, qword [rsp + 0x68]
mov r9, r14
cmp esi, r14d
mov r8, r13
mov rdx, r11
cmova r9, r12
mov byte [rsp + 0x28], bpl
mov dword [rsp + 0x20], esi
call fcn.00013a78
mov edi, eax
cmp byte [rsp + 0xc0], r14b
je 0x1397b
cmp r12, r14
je 0x1397b
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [0x00026758]
add edx, ebx
mov dword [0x00026758], edx
cmp byte [0x000266c2], r14b
je 0x139a2
lea rcx, [0x0001e7e0]
movzx r8d, bpl
call sub.ntoskrnl.exe_DbgPrint
mov eax, edi
jmp 0x13a57
add dword [0x00026758], ebx
cmp byte [0x000266c2], 0
je 0x13a55
lea eax, [r12 - 0xe]
lea rcx, [0x0001e710]
mov r9d, esi
mov dword [rsp + 0x30], eax
mov r8d, r13d
mov edx, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r13d
call sub.ntoskrnl.exe_DbgPrint
jmp 0x13a55
lea eax, [rdx - 0xe]
cmp eax, 0x1c
jae 0x13a2f
test ebp, ebp
je 0x13a4f
mov rdi, qword [rdi]
test rdi, rdi
je 0x13a4f
test byte [rdi + 0xa], 5
je 0x13a06
mov rax, qword [rdi + 0x18]
jmp 0x13a24
xor r9d, r9d
mov r8d, r13d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test rax, rax
je 0x13a4f
cmp dword [rdi + 0x28], 0x1c
jb 0x13a4f
add dword [0x00026758], ebx
cmp byte [0x000266c2], 0
je 0x13a55
lea rcx, [0x0001e560]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x13a55
or ebx, 0xffffffff
add dword [0x00026758], ebx
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret