Function at 0x140001000
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
xorps xmm0, xmm0
xorps xmm1, xmm1
xor bl, bl
mov rdi, rcx
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 9], xmm1
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp - 0x49], xmm1
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp + 0x37], xmm1
movups xmmword [rbp + 0x17], xmm0
cmp byte [rcx + 0x20], bl
jne 0x1400012e4
cmp dword [rcx + 0x58], 5
je 0x1400012e4
lea rdx, [rcx + 0x8d0]
lea rcx, [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rdi + 0x60]
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rdi + 0xba0]
lea rcx, [rbp + 0x17]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r14, [rdi + 0x330]
mov rdx, r14
lea rcx, [rbp + 0x37]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140009ab0]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140009ad0]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140009af0]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x19]
lea r15d, [r9 + 1]
mov r8b, r15b
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x140001129
xorps xmm0, xmm0
lea rdx, [0x140009b10]
lea rcx, [rbp - 0x59]
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x39]
mov r8b, r15b
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
movzx ebx, bl
cmovne ebx, r15d
xor r9d, r9d
lea rdx, [rbp - 0x49]
mov r8b, r15b
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x140001176
xorps xmm0, xmm0
lea rdx, [0x140009b10]
lea rcx, [rbp - 0x59]
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x39]
mov r8b, r15b
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
movzx ebx, bl
cmovne ebx, r15d
xor r9d, r9d
lea rdx, [rbp - 0x49]
mov r8b, r15b
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x1400011c3
xorps xmm0, xmm0
lea rdx, [0x140009b10]
lea rcx, [rbp - 0x59]
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x39]
mov r8b, r15b
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
movzx ebx, bl
cmovne ebx, r15d
lea rdx, [0x140009b30]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x49]
mov r8b, r15b
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x140001239
xor r9d, r9d
lea rdx, [rbp + 0x17]
mov r8b, r15b
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x140001239
xorps xmm0, xmm0
lea rdx, [0x140009b70]
lea rcx, [rbp - 0x59]
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x39]
mov r8b, r15b
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
movzx ebx, bl
cmovne ebx, r15d
lea rdx, [0x140009b80]
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x49]
mov r8b, r15b
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x1400012aa
xorps xmm0, xmm0
lea rdx, [0x140009ba0]
lea rcx, [rbp - 0x59]
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x39]
mov r8b, r15b
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x1400012aa
xor r9d, r9d
lea rdx, [rbp + 0x37]
mov r8b, r15b
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x1400012ae
test bl, bl
je 0x1400012e4
lea r9, [rdi + 0x60]
mov qword [rsp + 0x20], r14
mov r8d, 0x77
lea rdx, [0x140009bb0]
lea rcx, [0x140009bd0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rdi + 0x10]
mov ecx, 5
mov r8d, 0xe60
call fcn.1400020dc
lea r11, [rsp + 0xd0]
xor al, al
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret