Function at 0x140018940
Capabilities:
Print debug messages

Disassembly:
push r13
xor eax, eax
push r12
push rbp
push rdi
push rsi
mov rsi, rcx
mov ecx, 0x82
push rbx
sub rsp, 0x288
mov qword [rsp + 0x68], 0
lea rdi, [rsp + 0x78]
rep stosd dword [rdi], eax
xor eax, eax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
test rsi, rsi
je 0x140018cf9
mov rcx, rsi
lea rdi, [rsp + 0x78]
call sym.StringLengthA
mov rdx, rsi
mov rcx, rdi
mov r8, rax
call sym.CharStringToWCharString
mov rcx, rdi
call sym.StringLengthW
mov rcx, rdi
mov rbp, rax
call sym.LdrModuleSearch
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140018cf9
mov rbx, qword [0x14002d650]
lea r12, str.LdrModuleLoad
mov rax, qword [rbx]
mov dl, byte [rax + 0xe2]
test dl, dl
je 0x140018c13
cmp dl, 1
jne 0x140018aa8
cmp qword [rax + 0x188], 0
je 0x140018c13
lea r9, str.Loading_module_using_RtlRegisterWait
mov r8d, 0xfc
mov rdx, r12
lea rcx, [0x14002b990]
call sym.printf.constprop.0_1
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rsp + 0x50]
mov r9d, 1
mov edx, 0x1f0003
call sym.SysNtCreateEvent
test eax, eax
js 0x140018c13
mov rax, qword [rbx]
mov r9, rdi
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r8, qword [rax + 0x2f8]
mov dword [rsp + 0x28], 0xc
mov dword [rsp + 0x20], 0
call qword [rax + 0x188]
mov r9d, eax
test eax, eax
js 0x140018a96
mov r13d, 5
jmp 0x140018bd4
mov r8d, 0x105
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__RtlRegisterWait:__p_n
jmp 0x140018b00
cmp dl, 2
jne 0x140018b5c
cmp qword [rax + 0x180], 0
je 0x140018c13
lea r9, str.Loading_module_using_RtlCreateTimer
mov r8d, 0x10d
mov rdx, r12
lea rcx, [0x14002b990]
call sym.printf.constprop.0_1
mov rax, qword [rbx]
lea rcx, [rsp + 0x58]
call qword [rax + 0x198]
mov r9d, eax
test eax, eax
jns 0x140018b0a
mov r8d, 0x111
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__RtlCreateTimerQueue_Failed____p_n
call sym.DbgPrint
jmp 0x140018c13
mov rax, qword [rbx]
mov r9, rdi
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r8, qword [rax + 0x2f8]
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [rax + 0x180]
mov r9d, eax
test eax, eax
jns 0x140018a8b
mov r8d, 0x117
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__RtlCreateTimer:__p_n
jmp 0x140018b00
cmp dl, 3
jne 0x140018c13
cmp qword [rax + 0x190], 0
je 0x140018c13
lea r9, str.Loading_module_using_RtlQueueWorkItem
mov r8d, 0x11e
mov rdx, r12
lea rcx, [0x14002b990]
call sym.printf.constprop.0_1
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rax + 0x2f8]
call qword [rax + 0x190]
mov r9d, eax
test eax, eax
jns 0x140018a8b
mov r8d, 0x122
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__RtlQueueWorkItem_Failed:__p_n
jmp 0x140018b00
mov ecx, 0x64
call sym.SharedSleep
dec r13d
je 0x140018beb
mov rcx, rdi
call sym.LdrModulePebByString
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140018bc5
jmp 0x140018c92
cmp qword [rsp + 0x48], 0
jne 0x140018c92
lea r9, str.Module_was_not_loaded__try_with_default_technique
mov r8d, 0x145
mov rdx, r12
lea rcx, [0x14002b990]
call sym.printf.constprop.0_1
mov rax, qword [rbx]
cmp qword [rax + 0x130], 0
je 0x140018c92
lea r9, str.Loading_module_using_LdrLoadDll
mov r8d, 0x14f
mov rdx, r12
add ebp, ebp
lea rcx, [0x14002b990]
call sym.printf.constprop.0_1
mov rax, qword [rbx]
mov word [rsp + 0x68], bp
add ebp, 2
mov word [rsp + 0x6a], bp
lea r9, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x70], rdi
lea r8, [rsp + 0x68]
call qword [rax + 0x130]
mov ebp, eax
test eax, eax
jns 0x140018c92
mov r9d, eax
mov r8d, 0x157
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__LdrLoadDll_Failed:__p_n
call sym.DbgPrint
mov rax, qword [rbx]
mov rax, qword [rax + 0x8c2]
mov dword [rax + 0x68], ebp
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov ecx, 0x10
lea rdi, [rsp + 0x68]
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x48]
lea rcx, str._DEBUG::_s::_d__Module___s_:__p_n
mov r9, rsi
mov rdx, r12
mov r8d, 0x162
mov qword [rsp + 0x20], rax
call sym.DbgPrint
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140018ce1
call sym.SysNtClose
mov qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140018cf4
mov rax, qword [rbx]
call qword [rax + 0x1a0]
mov rax, qword [rsp + 0x48]
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret