Function at 0x165b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r12, r8
mov rbp, rdx
mov esi, ecx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [0x0001d1e0]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rdi, qword [0x0001d1a0]
xor r13d, r13d
cmp rdi, r13
je 0x16646
cmp dword [rdi + 0x18], esi
jne 0x1661d
mov rcx, qword [rdi + 8]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r13d
jne 0x1661d
mov rcx, qword [rdi + 0x10]
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r13d
je 0x16626
mov rdi, qword [rdi + 0x20]
cmp rdi, r13
jne 0x165f4
cmp rdi, r13
je 0x16646
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov rax, rdi
jmp 0x16851
mov edx, 0x28
xor ecx, ecx
mov r8d, 0x74647461
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r13
je 0x16817
movabs rcx, 0xfffff78000000014
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx]
mov qword [rsp + 0x88], rcx
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movsx r8d, word [rsp + 0x42]
movsx edi, word [rsp + 0x3e]
imul edi, edi, 0x2710
movsx ecx, word [rsp + 0x40]
add r8d, 0x12c
imul ecx, ecx, 0x64
cmp r8d, 0x3c
jbe 0x166f5
mov r9d, 0x88888889
inc ecx
mov eax, r9d
mul r8d
shr edx, 5
imul edx, edx, 0xffffffc4
add r8d, edx
cmp ecx, 0x3c
jbe 0x166f5
inc edi
mov eax, r9d
mul ecx
shr edx, 5
imul edx, edx, 0xffffffc4
add ecx, edx
cmp edi, 0x17
cmova edi, r13d
lea eax, [r8 + rcx]
mov r8d, 0x74647461
xor ecx, ecx
add eax, edi
mov edi, 0x400
mov dword [rbx + 0x18], esi
mov rdx, rdi
mov dword [rbx + 4], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, 0x200
mov qword [rbx + 8], rax
cmp rax, r13
je 0x1678d
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00017320
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
mov rax, qword [rbx + 8]
not rcx
dec rcx
mov rdi, rcx
cmp rcx, 0x7ffffffe
ja 0x16784
mov rcx, rsi
sub rbp, rax
cmp rdi, r13
je 0x1677b
movzx edx, word [rax + rbp]
cmp dx, r13w
je 0x1677b
dec rcx
mov word [rax], dx
dec rdi
add rax, 2
cmp rcx, r13
jne 0x1675a
cmp rcx, r13
jne 0x16784
sub rax, 2
mov edi, 0x400
mov word [rax], r13w
mov r8d, 0x74647461
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x10], rax
cmp rax, r13
je 0x16805
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00017320
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
mov rax, qword [rbx + 0x10]
not rcx
dec rcx
cmp rcx, 0x7ffffffe
ja 0x16801
sub r12, rax
cmp rcx, r13
je 0x167f8
movzx edx, word [r12 + rax]
cmp dx, r13w
je 0x167f8
dec rsi
mov word [rax], dx
dec rcx
add rax, 2
cmp rsi, r13
jne 0x167d6
cmp rsi, r13
jne 0x16801
sub rax, 2
mov word [rax], r13w
mov rax, qword [0x0001d1a0]
mov qword [0x0001d1a0], rbx
mov qword [rbx + 0x20], rax
lea rcx, [0x0001d1e0]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov rdx, qword [rbx + 0x10]
mov r9, qword [rbx + 8]
mov r8d, dword [rbx + 0x18]
mov qword [rsp + 0x20], rdx
lea rdx, [0x00019a20]
lea rcx, [0x00019a40]
call sub.ntoskrnl.exe_DbgPrint
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret