Function at 0x17db4
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1c0
mov rax, qword [0x00013200]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xor eax, eax
xor esi, esi
mov ebx, ecx
mov qword [r11 - 0x157], rax
mov dword [rsp + 0x99], eax
mov word [rsp + 0x9d], ax
mov byte [rsp + 0x9f], al
mov qword [rdx], rax
mov byte [rsp + 0xa0], sil
mov qword [r11 - 0x147], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
mov eax, ecx
lea rcx, [r11 - 0x148]
rol eax, 0x10
mov rdi, rdx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x90], esi
mov dword [rsp + 0x94], 0x11111111
mov dword [rsp + 0x98], 0x22222222
mov dword [rdx + 4], eax
mov dword [rsp + 0x9c], 0x33333333
call fcn.00012448
lea r9d, [rsi + 0x10]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x90]
call fcn.0001093c
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x38], ebx
lea rax, str.RegistryMACHINESystemCurrentControlSetR4NDDump
mov qword [rsp + 0x30], rax
lea rax, [0x000187a0]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov dword [rsp + 0x20], 0x800
call fcn.0001061c
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
lea ebx, [rsi + 0x40]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x48]
mov edx, 0x20019
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x18186
mov edx, dword [rdi + 4]
lea rax, [rsp + 0x40]
lea r9, [rdi + 0x40c]
mov qword [rsp + 0x28], rax
lea r8, [0x000187c0]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.00010d94
mov rcx, qword [rsp + 0x48]
lea r9d, [rsi + 4]
lea r8, [rdi + 8]
lea rdx, [0x000187e0]
call fcn.00010ca4
lea r8, [rdi + 0x40c]
lea rdx, [rdi + 0x40c]
lea rcx, [rsp + 0x90]
mov r9d, ebx
mov r14d, eax
call fcn.00010834
cmp dword [rdi + 0x40c], 0x52454e47
jne 0x17fdd
cmp dword [rdi + 0x448], 0x5445414d
jne 0x17fdd
lea rcx, [0x000187f0]
call sub.ntoskrnl.exe_DbgPrint
lea rbx, [rdi + 0xc]
mov ebp, 0x200
lea rdx, [0x00013230]
mov r8, rbp
mov rcx, rbx
call fcn.000127a0
jmp 0x1801f
lea rcx, [0x00018810]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
xor r11d, r11d
lea rbx, [rdi + 0xc]
mov ebp, 0x200
xor edx, edx
mov rcx, rbx
mov r8, rbp
mov word [0x00013224], r11w
mov word [0x00013228], ax
mov dword [0x0001322c], eax
mov dword [0x00013220], eax
call fcn.000126a0
mov rdx, qword [rdi + 0x428]
lea rcx, [0x00013210]
cmp rdx, qword [rcx]
jne 0x18043
mov rdx, qword [rdi + 0x430]
cmp rdx, qword [rcx + 8]
jne 0x18043
mov eax, esi
jmp 0x18048
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x18119
movzx eax, byte [0x00013213]
movzx r9d, byte [0x00013212]
movzx r8d, byte [0x00013211]
movzx edx, byte [0x00013210]
lea rcx, [0x00018830]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov r9d, dword [rdi + 8]
mov r8d, dword [0x00013220]
mov edx, dword [rdi + 4]
lea rcx, [rdi + 0x40c]
call fcn.000124c0
mov r9d, dword [rdi + 8]
mov r8d, dword [0x00013220]
mov edx, dword [rdi + 4]
lea rcx, [0x00018850]
call sub.ntoskrnl.exe_DbgPrint
cmp byte [rdi + 0x411], 1
jne 0x180de
lea rcx, [0x00018890]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x00013230]
mov rcx, rbx
mov r8, rbp
call fcn.000127a0
jmp 0x1816c
lea rcx, [0x000188b0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
xor r11d, r11d
mov r8, rbp
xor edx, edx
mov rcx, rbx
mov word [0x00013224], r11w
mov word [0x00013228], ax
mov dword [0x0001322c], eax
mov dword [0x00013220], eax
call fcn.000126a0
jmp 0x1816c
lea rcx, [0x000188d0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
xor r11d, r11d
mov r8, rbp
xor edx, edx
mov rcx, rbx
mov word [0x00013224], r11w
mov word [0x00013228], ax
mov dword [0x0001322c], eax
mov dword [0x00013220], eax
call fcn.000126a0
mov r9d, dword [rdi + 8]
mov r8d, dword [0x00013220]
mov edx, dword [rdi + 4]
lea rcx, [0x00018850]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000000d
cmp r14d, esi
cmovl esi, eax
mov eax, esi
jmp 0x1818b
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.000125a0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret