Function at 0x1a8a4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x223d0], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0x60]
mov dword [ebp - 4], eax
je 0x1a8df
inc byte [edi + 0x23]
add esi, 0x24
mov dword [edi + 0x60], esi
mov ecx, dword [eax + 4]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1aa95
cmp byte [esi], 0xe
push ebx
jne 0x1a91b
cmp dword [esi + 0xc], 0x82200
jne 0x1a91b
mov eax, dword [edi + 0xc]
lea ebx, [edi + 0x18]
push ebx
push dword [esi + 4]
push eax
push dword [esi + 8]
push eax
call fcn.000195fc
cmp dword [ebx], 0
jne 0x1a918
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebx]
jmp 0x1aa94
and dword [ebx], 0
cmp byte [esi], 0
jne 0x1aa7f
push dword [esi + 0x18]
call fcn.00019c34
test al, al
jne 0x1aa7f
and dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x18]
call fcn.00019ce4
test eax, eax
jne 0x1aa7f
push 1
push 0x24790
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
mov ebx, 0x400
test eax, eax
jne 0x1a9ca
push 0x48524452
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp + 8], eax
test eax, eax
je 0x1a9ca
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1a997
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x18]
mov ecx, ebx
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x18]
push ebx
push 0
push dword [eax + 0x34]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x24550
jmp 0x1aa48
cmp byte [0x224bc], 0
je 0x1aa77
push 1
push 0x24798
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x1aa77
push 0x48524452
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp + 8], eax
test eax, eax
je 0x1aa77
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1aa17
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x18]
mov ecx, ebx
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x18]
push ebx
push 0
push dword [eax + 0x34]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x247a0
mov eax, dword [esi + 0x18]
add eax, 0x30
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push dword [ebp - 8]
call fcn.000153f8
and dword [edi + 0x1c], 0
mov esi, 0x104
xor dl, dl
mov ecx, edi
mov dword [edi + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x1aa94
push dword [ebp - 8]
call fcn.000153f8
mov eax, dword [ebp - 4]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov ecx, dword [eax + 4]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop ebx
pop edi
pop esi
leave
ret 8