Function at 0x163fc
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x2c8
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov qword [rsp + 0x48], 0x12c
mov dword [rsp + 0x68], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x2a4], eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlFindMostSignificantBit]
mov byte [rsp + 0x40], al
mov rax, qword [0x00023598]
add rax, 0x3623
mov qword [rsp + 0x290], rax
xor eax, eax
mov word [rsp + 0x2a0], ax
jmp 0x1647d
movzx eax, word [rsp + 0x2a0]
add eax, 4
mov word [rsp + 0x2a0], ax
movzx eax, word [rsp + 0x2a0]
cmp eax, 0x1e0
jge 0x1651c
mov rax, qword [0x00023340]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x2a4], 0xc0000022
jne 0x164b9
mov dword [rsp + 0x2a8], 0xd8
jmp 0x164c4
mov dword [rsp + 0x2a8], 0x4297
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x2a8]
mov rax, qword [rsp + 0x290]
mov byte [rax], cl
mov rax, qword [rsp + 0x290]
add rax, 1
mov qword [rsp + 0x290], rax
lea r8, [rsp + 0x288]
xor edx, edx
mov ecx, 0x8c00ffff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuotaBufferValidity]
mov rax, qword [0x00023340]
add rax, 1
mov qword [0x00023340], rax
jmp 0x1646a
mov rax, qword [0x00023598]
add rax, 0x369b
mov qword [rsp + 0x38], rax
xor eax, eax
mov word [rsp + 0x2a0], ax
jmp 0x1654d
movzx eax, word [rsp + 0x2a0]
add eax, 4
mov word [rsp + 0x2a0], ax
movzx eax, word [rsp + 0x2a0]
cmp eax, 0x23c
jge 0x165b7
mov rax, qword [0x00023348]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x2a4]
xor eax, 0xc00000f2
add ecx, eax
mov rax, qword [rsp + 0x38]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
mov rax, qword [0x00023348]
add rax, 1
mov qword [0x00023348], rax
jmp 0x1653a
mov rax, qword [0x00023598]
add rax, 0x372a
mov qword [rsp + 0x280], rax
xor eax, eax
mov word [rsp + 0x2a0], ax
jmp 0x165eb
movzx eax, word [rsp + 0x2a0]
add eax, 4
mov word [rsp + 0x2a0], ax
movzx eax, word [rsp + 0x2a0]
cmp eax, 0x228
jge 0x16671
mov rax, qword [0x00023350]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x2a4], 0xc0000022
jne 0x16623
mov dword [rsp + 0x2ac], 0xbb
jmp 0x1662e
mov dword [rsp + 0x2ac], 0x6382
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x2ac]
mov rax, qword [rsp + 0x280]
mov byte [rax], cl
mov rax, qword [rsp + 0x280]
add rax, 1
mov qword [rsp + 0x280], rax
mov rax, qword [0x00023350]
add rax, 1
mov qword [0x00023350], rax
jmp 0x165d8
mov rax, qword [0x00023598]
add rax, 0x37b4
mov qword [rsp + 0x58], rax
xor eax, eax
mov word [rsp + 0x2a0], ax
jmp 0x166a2
movzx eax, word [rsp + 0x2a0]
add eax, 4
mov word [rsp + 0x2a0], ax
movzx eax, word [rsp + 0x2a0]
cmp eax, 0x238
jge 0x1670c
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExQueryPoolBlockSize]
mov r11, qword [0x00023358]
mov al, byte [r11]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x2a4]
xor eax, 0xc000008c
add ecx, eax
mov rax, qword [rsp + 0x58]
mov byte [rax], cl
mov rax, qword [rsp + 0x58]
add rax, 1
mov qword [rsp + 0x58], rax
mov rax, qword [0x00023358]
add rax, 1
mov qword [0x00023358], rax
jmp 0x1668f
mov rax, qword [0x00023598]
add rax, 0x3842
mov qword [rsp + 0x298], rax
xor eax, eax
mov word [rsp + 0x2a0], ax
jmp 0x16740
movzx eax, word [rsp + 0x2a0]
add eax, 4
mov word [rsp + 0x2a0], ax
movzx eax, word [rsp + 0x2a0]
cmp eax, 0x1e0
jge 0x167d9
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
mov r11, qword [0x00023360]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0x2a4], 0xc0000022
jne 0x1678b
mov dword [rsp + 0x2b0], 0xbe
jmp 0x16796
mov dword [rsp + 0x2b0], 0xee03
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x2b0]
mov rax, qword [rsp + 0x298]
mov byte [rax], cl
mov rax, qword [rsp + 0x298]
add rax, 1
mov qword [rsp + 0x298], rax
mov rax, qword [0x00023360]
add rax, 1
mov qword [0x00023360], rax
jmp 0x1672d
mov rax, qword [0x00023598]
add rax, 0x38ba
mov qword [rsp + 0x60], rax
xor eax, eax
mov word [rsp + 0x2a0], ax
jmp 0x1680a
movzx eax, word [rsp + 0x2a0]
add eax, 4
mov word [rsp + 0x2a0], ax
movzx eax, word [rsp + 0x2a0]
cmp eax, 0x254
jge 0x16915
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x2b4], eax
cmp dword [rsp + 0x2b4], 1
je 0x1686d
cmp dword [rsp + 0x2b4], 2
je 0x1687b
cmp dword [rsp + 0x2b4], 0x1000
je 0x1688e
cmp dword [rsp + 0x2b4], 0x2000
je 0x1689b
cmp dword [rsp + 0x2b4], 0x4004
je 0x168a9
jmp 0x168c5
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x168c5
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x168c5
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x168c5
lea rcx, [0x000211c0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x168c5
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x00023368]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x2a4]
xor eax, 0xc00000d4
add ecx, eax
mov rax, qword [rsp + 0x60]
mov byte [rax], cl
mov rax, qword [rsp + 0x60]
add rax, 1
mov qword [rsp + 0x60], rax
mov rax, qword [0x00023368]
add rax, 1
mov qword [0x00023368], rax
jmp 0x167f7
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x2c8
ret