Function at 0x1bea5
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [eax + 0xc]
push edi
call sub.ntoskrnl.exe_PsGetProcessExitTime
test byte [esi + 0xe], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
jne 0x1c3cc
lea edi, [esi + 0x1c]
push ebx
lea edx, [ebp - 0x1c]
mov ecx, edi
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
push 0
push 0x20
push esi
call fcn.000103d2
mov ax, word [esi]
mov ecx, 0x1000
or dword [esi + 0xc], ecx
cmp ax, 0xafd1
je 0x1c357
cmp ax, 0x1afd
je 0x21015
cmp ax, 0xafd
je 0x210a1
and ax, 0xafd2
cmp ax, 0xafd2
je 0x1c8ad
xor edi, edi
test edi, edi
jne 0x1c74e
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
mov ax, word [esi]
and ax, 0xafd4
cmp ax, 0xafd4
je 0x211f7
test byte [esi + 0xe], 0x10
jne 0x21293
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea edi, [esi + 0x98]
cmp dword [edi], edi
jne 0x1e5f3
xor edi, edi
cmp dword [esi + 0xb8], edi
lea ecx, [ebp - 0x1c]
jne 0x21350
call ebx
cmp dword [esi + 0x88], edi
pop ebx
je 0x1bf95
test byte [esi + 0xc], 1
jne 0x213bc
cmp word [esi], 0xafd1
je 0x1c3a3
xor ecx, ecx
mov eax, 0x1254c
inc ecx
lock xadd dword [eax], ecx
pop edi
xor eax, eax
pop esi
leave
ret
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
mov al, byte [esi + 2]
cmp al, 2
je 0x1c371
cmp al, 3
jne 0x1bf40
and dword [esi + 0x44], 0
and dword [esi + 0x40], 0
push fcn.00029359
mov edi, 0xc0000120
push edi
push esi
lea eax, [esi + 0x28]
push eax
call fcn.0001c010
push fcn.00029359
push edi
push esi
lea eax, [esi + 0x30]
push eax
call fcn.0001c010
jmp 0x1bf40
push edi
push edi
push 4
push dword [esi + 0x10]
call fcn.00012dbb
push edi
push edi
push 0xa
push dword [esi + 0x10]
call fcn.00012dbb
push edi
push edi
push 2
push dword [esi + 0x10]
call fcn.00012dbb
jmp 0x1bf95
push 0
push 0x20
push esi
call fcn.00010545
jmp 0x1beca
xor edx, edx
lea eax, [edi + 0x20]
inc edx
lock xadd dword [eax], edx
mov al, byte [esi + 2]
cmp al, 3
jne 0x210ea
mov edx, dword [edi + 4]
test ecx, edx
je 0x1ffc6
test byte [esi + 0xa], 1
jne 0x1ffc6
mov eax, dword [esi + 0x80]
test al, 4
mov dword [ebp - 0x10], eax
jne 0x1ffc6
test al, 1
jne 0x210f7
mov edx, dword [edi + 4]
test dl, 0x10
jne 0x1ffc6
and edx, 1
jne 0x2119d
xor eax, eax
cmp word [edi + 0x40], ax
setne al
test eax, eax
jne 0x1fd8f
xor ebx, ebx
cmp edx, ebx
jne 0x211ca
xor eax, eax
cmp word [edi + 0x42], bx
setne al
cmp eax, ebx
jne 0x1fd8f
mov eax, dword [esi + 4]
shr eax, 9
and al, 1
jne 0x1c7e5
cmp dword [edi + 0x44], ebx
ja 0x1fd8f
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 8]
jne 0x1fd8f
cmp dword [esi + 0x84], ebx
jne 0x1fd8f
cmp dword [esi + 0xbc], ebx
jne 0x1fd8f
test al, al
jne 0x1c823
lea eax, [edi + 0x28]
cmp dword [eax], eax
jne 0x1fd8f
lea eax, [edi + 0x48]
cmp dword [eax], eax
jne 0x1fd8f
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
or eax, 2
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x80], eax
call ebx
push 0
push 0
push esi
call fcn.0001cafa
test eax, eax
jl 0x1fd9a
mov eax, dword [esi + 4]
shr eax, 9
test al, 1
jne 0x1c87b
push 0
push 0xc0000120
push esi
lea eax, [edi + 0x28]
push eax
call fcn.0001c010
push 0x110bb
push 0xc0000120
push esi
lea eax, [edi + 0x48]
push eax
call fcn.0001c010
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
or byte [edi + 6], 0x10
push 1
push edi
call fcn.0001c5e5
lea ecx, [ebp - 0x1c]
call ebx
or ecx, 0xffffffff
lea eax, [edi + 0x20]
lock xadd dword [eax], ecx
jne 0x1bf2f
jmp 0x211ec
mov edi, dword [esi + 0x60]
jmp 0x1bf1c
mov ecx, dword [edi]
mov eax, dword [ecx]
mov dword [edi], eax
mov dword [eax + 4], edi
and dword [ecx], 0
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x1c]
call ebx
mov eax, dword [ebp - 0x10]
push eax
push esi
call dword [eax + 8]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
jmp 0x1bf5c
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
push edi
call fcn.0001fb6b
jmp 0x1c84c
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
jmp 0x1c84c
cmp al, 6
je 0x1c763
jmp 0x1ffc6
cmp byte [edi + 0x59], 0
jne 0x1fd8f
jmp 0x1c7b7
mov eax, dword [edi + 0x40]
cmp eax, ecx
jbe 0x1c7d2
jmp 0x1fd8f
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea eax, [esi + 0x38]
cmp dword [eax], eax
lea ecx, [ebp - 0x1c]
je 0x2109a
call ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
mov ecx, edi
jmp 0x21073
mov edi, dword [esi + 0x38]
sub edi, 0x58
xor eax, eax
lea ecx, [edi + 0x38]
xchg dword [ecx], eax
test eax, eax
mov dword [ebp - 0x10], eax
je 0x2107c
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
mov al, byte [ebp - 4]
push edi
mov byte [edi + 0x25], al
mov byte [edi + 0x24], 1
push dword [0x127f8]
call dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea ecx, [esi + 0x1c]
lea edx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
lea eax, [esi + 0x38]
cmp dword [eax], eax
jne 0x21035
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
jmp 0x1bf40
call ebx
jmp 0x1bf40
mov ebx, dword [sym.imp.HAL.dll_KeReleaseInStackQueuedSpinLock]
lea ecx, [ebp - 0x1c]
call ebx
cmp esi, dword [0x1258c]
jne 0x1bf40
call dword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
push 1
push dword [0x127fc]
call dword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov ecx, dword [0x127fc]
and dword [0x1258c], 0
call dword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call dword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
jmp 0x1bf40
cmp al, 2
jne 0x1ffd6
jmp 0x1c763
and edx, 1
je 0x2112c
mov ecx, dword [edi + 0x38]
add ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x3c]
adc eax, dword [edi + 0x34]
mov ebx, dword [edi + 0x2c]
cmp ebx, eax
jg 0x1c791
jl 0x21120
mov eax, dword [edi + 0x28]
cmp eax, ecx
ja 0x1c791
cmp byte [edi + 0x59], 0
jne 0x1c791
jmp 0x2113d
xor eax, eax
cmp word [edi + 0x40], ax
setne al
test eax, eax
jne 0x1c791
xor ebx, ebx
cmp edx, ebx
je 0x21168
mov ecx, dword [edi + 0x50]
add ecx, dword [edi + 0x48]
mov eax, dword [edi + 0x54]
adc eax, dword [edi + 0x4c]
mov edx, dword [edi + 0x44]
cmp edx, eax
jg 0x1c791
jl 0x21179
mov eax, dword [edi + 0x40]
cmp eax, ecx
jbe 0x21179
jmp 0x1c791
xor eax, eax
cmp word [edi + 0x42], bx
setne al
cmp eax, ebx
jne 0x1c791
mov eax, dword [esi + 4]
shr eax, 9
test al, 1
jne 0x2118c
cmp dword [edi + 0x44], ebx
ja 0x1c791
cmp dword [esi + 0xbc], ebx
jne 0x1c791
jmp 0x1ffc6
mov ecx, dword [edi + 0x38]
add ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x3c]
adc eax, dword [edi + 0x34]
mov ebx, dword [edi + 0x2c]
cmp ebx, eax
jg 0x1fd8f
jl 0x1ffe0
mov eax, dword [edi + 0x28]
cmp eax, ecx
jbe 0x1ffe0
jmp 0x1fd8f
mov ecx, dword [edi + 0x50]
add ecx, dword [edi + 0x48]
mov eax, dword [edi + 0x54]
adc eax, dword [edi + 0x4c]
mov edx, dword [edi + 0x44]
cmp edx, eax
jg 0x1fd8f
jge 0x1ffef
jmp 0x1c7d2
push edi
call fcn.0001c0b1
jmp 0x1bf2f
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
lea edi, [esi + 0x38]
jmp 0x2127b
mov eax, dword [edi]
mov ecx, dword [eax]
mov dword [edi], ecx
mov dword [ecx + 4], edi
and dword [eax], 0
lea ecx, [eax - 0x58]
mov eax, dword [ecx + 0x60]
cmp byte [eax], 0xf
mov dword [ebp - 4], ecx
jne 0x2122f
push 0xc0000120
push ecx
call fcn.00024dce
jmp 0x2123a
and dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0xc0000120
lea ecx, [ebp - 0x1c]
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
add ecx, 0x38
xchg dword [ecx], eax
test eax, eax
jne 0x21260
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
mov dl, byte [0x12011]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.HAL.dll_KeAcquireInStackQueuedSpinLock]
cmp dword [edi], edi
jne 0x21208
lea ecx, [ebp - 0x1c]
call ebx
push esi
call fcn.00025bcb
and dword [esi + 0x50], 0
jmp 0x1bf40
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
and byte [esi + 0xe], 0xef
mov eax, dword [esi + 0xc]
test eax, 0x200000
je 0x212c8
and eax, 0xffdfffff
mov dword [ebp - 0x10], 0x17
mov dword [esi + 0xc], eax
jmp 0x212cf
mov dword [ebp - 0x10], 2
lea eax, [esi + 0x90]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [ebp - 4], ecx
je 0x21331
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
xor edi, edi
lea eax, [ecx + 8]
xchg dword [eax], edi
test edi, edi
je 0x21326
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
mov al, byte [ebp - 8]
push edi
mov byte [edi + 0x25], al
call fcn.000276fb
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
lea eax, [esi + 0x90]
cmp dword [ebp - 4], eax
jne 0x212de
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
push dword [ebp - 0x10]
call fcn.000180fa
jmp 0x1bf4a
call ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireCancelSpinLock]
lea edx, [ebp - 0x1c]
lea ecx, [esi + 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLockAtDpcLevel]
mov ebx, dword [esi + 0xb8]
cmp ebx, edi
je 0x213a5
mov byte [ebx + 0x24], 1
lea eax, [ebx + 0x38]
xchg dword [eax], edi
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
test edi, edi
je 0x21395
mov al, byte [ebp - 8]
push ebx
push 0
mov byte [ebx + 0x25], al
call edi
jmp 0x2139e
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
xor edi, edi
jmp 0x1bf77
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLockFromDpcLevel]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_IoReleaseCancelSpinLock]
jmp 0x1bf77
push edi
push edi
push edi
push dword [esi + 0x10]
call fcn.00012dbb
jmp 0x1bf8a