Function at 0x153a8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, rcx
mov rcx, r9
mov rsi, r9
mov rdi, r8
mov rbp, rdx
call fcn.0001128c
movzx r11d, byte [rdi + 1]
xor r12d, r12d
cmp r11d, r12d
je 0x1576a
lea ebx, [r12 + 1]
sub r11d, ebx
je 0x1573a
sub r11d, ebx
je 0x15644
sub r11d, ebx
je 0x1563e
sub r11d, ebx
je 0x15605
sub r11d, ebx
je 0x155f6
sub r11d, ebx
je 0x155e1
sub r11d, ebx
je 0x15495
cmp r11d, 0x10
jne 0x1574b
mov eax, dword [rsi + 0xc]
mov rcx, rsi
mov dword [rsi + 0xc], 5
mov dword [rsi + 0x10], eax
call fcn.00015850
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea r11, [rsi + 0x30]
mov r9, qword [r11]
mov r10, qword [r9]
jmp 0x15481
mov rax, qword [r9 + 8]
mov rdx, qword [r9]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [r9 + 8], r9
mov qword [r9], r9
mov qword [r9 - 0x18], r12
mov byte [r9 + 0x11], bl
mov r9, r10
mov r10, qword [r10]
cmp r9, r11
jne 0x1545e
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x15747
cmp dword [rdi + 8], r12d
jne 0x1574b
mov rax, qword [r13 + 0x40]
cmp dword [rax + 0xc8], r12d
jle 0x154bc
lock add dword [rax + 0xc8], 0xffffffff
mov rcx, r13
call fcn.00018b4c
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov r14, qword [rbp + 0x38]
cmp r14, r12
je 0x154e7
cmp dword [rsi + 0x40], r12d
mov r13d, dword [r14]
jne 0x154ea
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x1574b
mov r13d, r12d
mov ecx, r12d
lea r12, [rsi + 0x30]
mov rax, qword [r12]
jmp 0x15502
cmp byte [rax + 0x10], 0
je 0x154ff
add ecx, ebx
mov rax, qword [rax]
cmp rax, r12
jne 0x154f7
lea edi, [rcx + r13]
mov r8d, 0x62735556
mov ecx, ebx
lea edx, [rdi*8 + 0xf]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [rsp + 0x90], rax
jne 0x15557
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov ebx, 0xc000009a
xor edx, edx
mov rcx, rbp
mov dword [rbp + 0x30], ebx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rcx, rsi
call fcn.000112c0
jmp 0x15733
test r13d, r13d
je 0x15578
mov r8d, r13d
lea rdx, [r14 + 8]
lea rcx, [rax + 8]
shl r8, 3
call fcn.00011d80
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
mov rdi, qword [r12]
movsxd rcx, r13d
cmp rdi, r12
je 0x155b4
lea r13, [rax + rcx*8 + 8]
cmp byte [rdi + 0x10], 0
je 0x155a9
mov rax, qword [rdi - 0x38]
mov qword [r13], rax
mov rcx, qword [rdi - 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
add r13, 8
jmp 0x155ac
mov byte [rdi + 0x11], bl
mov rdi, qword [rdi]
cmp rdi, r12
jne 0x1558b
test r14, r14
je 0x155c2
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
mov rax, qword [rsp + 0x90]
lea rcx, [rsi + 0x48]
mov qword [rbp + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
and dword [rbp + 0x30], 0
jmp 0x1574b
cmp dword [rsi + 0xc], 2
jne 0x15747
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0xc], eax
jmp 0x15747
mov eax, dword [rsi + 0xc]
mov dword [rsi + 0xc], 2
jmp 0x15744
mov rcx, rsi
call fcn.000112c0
lea rcx, [rsi + 0xa0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, rsi
call fcn.0001128c
mov eax, dword [rsi + 0xc]
mov dword [rsi + 0xc], 3
jmp 0x15744
cmp dword [rsi + 0xc], 4
jmp 0x155e5
cmp dword [rsi + 0xc], 5
je 0x15652
mov rcx, rsi
call fcn.00015850
mov eax, dword [rsi + 0xc]
mov rcx, rsi
mov dword [rsi + 0xc], 6
mov dword [rsi + 0x10], eax
call fcn.000112c0
mov rcx, rsi
call fcn.000112c0
lea rcx, [rsi + 0x88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea r15, [rsi + 0x30]
mov rdi, qword [r15]
mov r12, qword [rdi]
jmp 0x156f3
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
mov rdx, rdi
mov qword [rax], rcx
mov qword [rcx + 8], rax
cmp dword [rdi - 0x2c], 5
jne 0x156c7
mov qword [rdi + 8], rdx
mov qword [rdi], rdx
and qword [rdi - 0x18], 0
mov byte [rdi + 0x11], bl
jmp 0x156ec
add dword [rsi + 0x40], 0xffffffff
mov rcx, qword [rdi - 0x10]
mov r14, qword [rdi - 0x38]
test rcx, rcx
je 0x156e3
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
and qword [rdi - 0x10], 0
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov rdi, r12
mov r12, qword [r12]
cmp rdi, r15
jne 0x1569f
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
and dword [rbp + 0x30], 0
add byte [rbp + 0x43], bl
add qword [rbp + 0xb8], 0x48
mov rcx, qword [rsi + 0x28]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov rcx, qword [rsi + 0x28]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
jmp 0x15829
mov eax, dword [rsi + 0xc]
mov dword [rsi + 0xc], 4
mov dword [rsi + 0x10], eax
mov dword [rbp + 0x30], r12d
add byte [rbp + 0x43], bl
add qword [rbp + 0xb8], 0x48
mov rcx, qword [rsi + 0x28]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
mov ebx, eax
jmp 0x1554a
mov rdi, qword [rsi + 0x28]
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rdx, qword [rbp + 0xb8]
mov r8d, 0x38
lea rbx, [rdx - 0x48]
mov rcx, rbx
call fcn.00011d80
mov byte [rbx + 3], r12b
mov rax, qword [rbp + 0xb8]
lea rcx, [0x0001131c]
mov rdx, rbp
mov byte [rax - 0x45], 0xe0
mov qword [rax - 0x10], rcx
lea rcx, [rsp + 0x30]
mov qword [rax - 8], rcx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
mov edi, eax
jne 0x157ea
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov edi, dword [rbp + 0x30]
cmp edi, r12d
jl 0x15811
mov ebx, 1
lea rcx, [rsi + 0xb8]
mov dl, bl
call qword [sym.imp.ntoskrnl.exe_IoSetDeviceInterfaceState]
mov ecx, dword [rsi + 0xc]
mov dword [rsi + 0x1c], ebx
mov dword [rsi + 0x10], ecx
mov edi, eax
mov dword [rsi + 0xc], ebx
xor edx, edx
mov rcx, rbp
mov dword [rbp + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rcx, rsi
call fcn.000112c0
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret