Function at 0x16934
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa58
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0xa48], rax
mov r8d, 0x28
mov edx, 0xff
lea rcx, [rsp + 0x9f0]
call fcn.0001b210
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x8d0]
call fcn.0001b210
mov dword [rsp + 0x48], 0xcf8
mov r8d, 0xd0
xor edx, edx
lea rcx, [rsp + 0x900]
call fcn.0001b210
mov qword [rsp + 0x40], 0x304
mov dword [rsp + 0xa24], 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x9f0]
call qword [sym.imp.ntoskrnl.exe_RtlGetGroupSecurityDescriptor]
xor edx, edx
lea rcx, [rsp + 0xa24]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0xa18], eax
call fcn.000163fc
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023598]
add rax, 0x2e22
mov qword [rsp + 0x8f0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.ntoskrnl.exe_IoReleaseRemoveLockEx]
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x16a37
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x24c
jge 0x16aaa
lea rcx, [rsp + 0x48]
call fcn.00011008
mov r11, qword [0x00023370]
mov al, byte [r11]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0xa18]
xor eax, 0xc00000e4
add ecx, eax
mov rax, qword [rsp + 0x8f0]
mov byte [rax], cl
mov rax, qword [rsp + 0x8f0]
add rax, 1
mov qword [rsp + 0x8f0], rax
mov rax, qword [0x00023370]
add rax, 1
mov qword [0x00023370], rax
jmp 0x16a24
lea rdx, [0x000210c0]
mov ecx, 0xd91f
call qword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023598]
add rax, 0x2eb5
mov qword [rsp + 0x9e0], rax
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x16afe
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x2c4
jge 0x16bc9
mov rax, qword [0x00023378]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0xa18], 0xc0000022
jne 0x16b3a
mov dword [rsp + 0xa28], 4
jmp 0x16b45
mov dword [rsp + 0xa28], 0xef41
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0xa28]
mov rax, qword [rsp + 0x9e0]
mov byte [rax], cl
mov edx, 0xc000002d
lea rcx, [rsp + 0x900]
call qword [sym.imp.ntoskrnl.exe_IoReuseIrp]
mov rax, qword [rsp + 0x9e0]
add rax, 1
mov qword [rsp + 0x9e0], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_IoCsqInitialize]
mov rax, qword [0x00023378]
add rax, 1
mov qword [0x00023378], rax
jmp 0x16aeb
mov rax, qword [0x00023598]
add rax, 0x2f66
mov qword [rsp + 0x68], rax
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x16bfa
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x21c
jge 0x16cb0
mov edx, 0xc000008c
lea rcx, [rsp + 0x900]
call qword [sym.imp.ntoskrnl.exe_IoReuseIrp]
mov r11, qword [0x00023380]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0xa18], 0xc0000022
jne 0x16c4a
mov dword [rsp + 0xa2c], 0xab
jmp 0x16c55
mov dword [rsp + 0xa2c], 0x2345
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0xa2c]
mov rax, qword [rsp + 0x68]
mov byte [rax], cl
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [rsp + 0x68]
add rax, 1
mov qword [rsp + 0x68], rax
mov edx, 0xc00000b1
lea rcx, [rsp + 0x900]
call qword [sym.imp.ntoskrnl.exe_IoReuseIrp]
mov rax, qword [0x00023380]
add rax, 1
mov qword [0x00023380], rax
jmp 0x16be7
call fcn.00011028
mov rax, qword [0x00023598]
add rax, 0x2fed
mov qword [rsp + 0x9e8], rax
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x16ce9
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x2ac
jge 0x16d6f
mov rax, qword [0x00023388]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0xa18], 0xc0000022
jne 0x16d21
mov dword [rsp + 0xa30], 0x69
jmp 0x16d2c
mov dword [rsp + 0xa30], 0x5a83
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0xa30]
mov rax, qword [rsp + 0x9e8]
mov byte [rax], cl
mov rax, qword [rsp + 0x9e8]
add rax, 1
mov qword [rsp + 0x9e8], rax
mov rax, qword [0x00023388]
add rax, 1
mov qword [0x00023388], rax
jmp 0x16cd6
lea rcx, [rsp + 0x48]
call fcn.00011008
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlFindLeastSignificantBit]
mov byte [rsp + 0xa1c], al
mov rax, qword [0x00023598]
add rax, 0x3098
mov qword [rsp + 0x9d0], rax
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x16dbf
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x238
jge 0x16e36
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov r11, qword [0x00023390]
mov al, byte [r11]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0xa18]
xor eax, 0xc0000003
sub ecx, eax
mov rax, qword [rsp + 0x9d0]
mov byte [rax], cl
mov rax, qword [rsp + 0x9d0]
add rax, 1
mov qword [rsp + 0x9d0], rax
mov rax, qword [0x00023390]
add rax, 1
mov qword [0x00023390], rax
jmp 0x16dac
mov rax, qword [0x00023598]
add rax, 0x3126
mov qword [rsp + 0x9d8], rax
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x16e6a
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x2b8
jge 0x16ef3
mov rax, qword [rsp + 0xa60]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0xa18], 0xc0000022
jne 0x16ea3
mov dword [rsp + 0xa34], 0x4a
jmp 0x16eae
mov dword [rsp + 0xa34], 0xd8fc
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0xa34]
mov rax, qword [rsp + 0x9d8]
mov byte [rax], cl
mov rax, qword [rsp + 0x9d8]
add rax, 1
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0xa60]
add rax, 1
mov qword [rsp + 0xa60], rax
jmp 0x16e57
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0xa38], eax
cmp dword [rsp + 0xa38], 1
je 0x16f43
cmp dword [rsp + 0xa38], 2
je 0x16f51
cmp dword [rsp + 0xa38], 0x1000
je 0x16f64
cmp dword [rsp + 0xa38], 0x2000
je 0x16f71
cmp dword [rsp + 0xa38], 0x4004
je 0x16f7f
jmp 0x16f9b
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x16f9b
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x16f9b
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x16f9b
lea rcx, [0x000211d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x16f9b
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023598]
add rax, 0x31d4
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.ntoskrnl.exe_KeQueryPriorityThread]
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x16fda
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x248
jge 0x17081
lea rdx, [0x00021080]
mov ecx, 0xea32
call qword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov r11, qword [0x00023398]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0xa18], 0xc0000022
jne 0x17029
mov dword [rsp + 0xa3c], 0x60
jmp 0x17034
mov dword [rsp + 0xa3c], 0x5a76
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0xa3c]
mov rax, qword [rsp + 0x60]
mov byte [rax], cl
mov edx, 0xc00000b7
lea rcx, [rsp + 0x900]
call qword [sym.imp.ntoskrnl.exe_IoReuseIrp]
mov rax, qword [rsp + 0x60]
add rax, 1
mov qword [rsp + 0x60], rax
mov rax, qword [0x00023398]
add rax, 1
mov qword [0x00023398], rax
jmp 0x16fc7
mov rax, qword [0x00023598]
add rax, 0x3266
mov qword [rsp + 0x4c0], rax
xor eax, eax
mov word [rsp + 0xa20], ax
jmp 0x170b5
movzx eax, word [rsp + 0xa20]
add eax, 4
mov word [rsp + 0xa20], ax
movzx eax, word [rsp + 0xa20]
cmp eax, 0x234
jge 0x17141
call fcn.00011028
mov r11, qword [0x000233a0]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0xa18], 0xc0000022
jne 0x170f3
mov dword [rsp + 0xa40], 0x13
jmp 0x170fe
mov dword [rsp + 0xa40], 0xbc89
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0xa40]
mov rax, qword [rsp + 0x4c0]
mov byte [rax], cl
mov rax, qword [rsp + 0x4c0]
add rax, 1
mov qword [rsp + 0x4c0], rax
mov rax, qword [0x000233a0]
add rax, 1
mov qword [0x000233a0], rax
jmp 0x170a2
mov rcx, qword [rsp + 0xa48]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0xa58
ret