Function at 0x16b90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x8d0
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x8c0], rax
mov dword [rsp + 0x870], 0xc0000001
mov qword [rsp + 0x888], 0
mov qword [rsp + 0x890], 0
mov dword [rsp + 0x468], 0
mov qword [rsp + 0x460], 0
xor eax, eax
mov word [rsp + 0x60], ax
lea rdi, [rsp + 0x62]
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov qword [rsp + 0x48], 0
xor eax, eax
mov word [rsp + 0x470], ax
lea rdi, [rsp + 0x472]
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov qword [rsp + 0x878], 0
lea rax, [rsp + 0x470]
mov qword [rsp + 0x40], rax
call fcn.00011030
movzx eax, al
cmp eax, 1
jle 0x16c66
call fcn.00011030
movzx edx, al
lea rcx, [0x000181d0]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00011020
cmp qword [0x000203b0], 0
jne 0x16c7c
mov eax, dword [rsp + 0x870]
jmp 0x16ea9
call qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
mov byte [rsp + 0x880], al
movsx eax, byte [rsp + 0x880]
test eax, eax
jne 0x16c9a
jmp 0x16e87
lea rax, [rsp + 0x888]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rsp + 0x8e0]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x870], eax
cmp dword [rsp + 0x870], 0
jl 0x16e87
lea rax, [rsp + 0x468]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x468]
xor r8d, r8d
mov edx, 0x1b
mov rcx, qword [rsp + 0x888]
call qword [0x000203b0]
mov dword [rsp + 0x870], eax
cmp dword [rsp + 0x870], 0xc0000004
jne 0x16e79
cmp dword [rsp + 0x468], 0x200
jbe 0x16d61
mov edx, dword [rsp + 0x468]
lea rax, [0x000187e0]
mov r8d, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x878], rax
mov rax, qword [rsp + 0x878]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x468]
mov r8, qword [rsp + 0x40]
mov edx, 0x1b
mov rcx, qword [rsp + 0x888]
call qword [0x000203b0]
mov dword [rsp + 0x870], eax
cmp dword [rsp + 0x870], 0
jl 0x16e79
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x898], rax
mov dx, 0x5c
mov rcx, qword [rsp + 0x898]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ntoskrnl.exe_wcsrchr]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x16e79
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x8a0], rax
mov rax, qword [rsp + 0x8e8]
mov qword [rsp + 0x8a8], rax
mov rax, qword [rsp + 0x8a8]
mov qword [rsp + 0x8b0], rax
mov rax, qword [rsp + 0x8a0]
movzx eax, word [rax]
mov word [rsp + 0x8b8], ax
mov rcx, qword [rsp + 0x8a8]
movzx eax, word [rsp + 0x8b8]
mov word [rcx], ax
mov rax, qword [rsp + 0x8a0]
add rax, 2
mov qword [rsp + 0x8a0], rax
mov rax, qword [rsp + 0x8a8]
add rax, 2
mov qword [rsp + 0x8a8], rax
cmp word [rsp + 0x8b8], 0
jne 0x16e12
mov rcx, qword [rsp + 0x8e8]
call qword [sym.imp.ntoskrnl.exe__wcslwr]
mov rcx, qword [rsp + 0x888]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp qword [rsp + 0x878], 0
je 0x16ea2
xor edx, edx
mov rcx, qword [rsp + 0x878]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rsp + 0x870]
mov rcx, qword [rsp + 0x8c0]
xor rcx, rsp
call fcn.00017030
add rsp, 0x8d0
pop rdi
ret