Function at 0x1b902
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x24930], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0x60]
mov dword [ebp - 4], eax
je 0x1b93d
inc byte [edi + 0x23]
add esi, 0x24
mov dword [edi + 0x60], esi
mov ecx, dword [eax + 4]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x1baf3
cmp byte [esi], 0xe
push ebx
jne 0x1b979
cmp dword [esi + 0xc], 0x82200
jne 0x1b979
mov eax, dword [edi + 0xc]
lea ebx, [edi + 0x18]
push ebx
push dword [esi + 4]
push eax
push dword [esi + 8]
push eax
call fcn.0001a5f2
cmp dword [ebx], 0
jne 0x1b976
xor dl, dl
mov ecx, edi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebx]
jmp 0x1baf2
and dword [ebx], 0
cmp byte [esi], 0
jne 0x1badd
push dword [esi + 0x18]
call fcn.0001ac86
test al, al
jne 0x1badd
and dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x18]
call fcn.0001ad36
test eax, eax
jne 0x1badd
push 1
push 0x27118
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
mov ebx, 0x400
test eax, eax
jne 0x1ba28
push 0x48524452
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp + 8], eax
test eax, eax
je 0x1ba28
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1b9f5
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x18]
mov ecx, ebx
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x18]
push ebx
push 0
push dword [eax + 0x34]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x26ed0
jmp 0x1baa6
cmp byte [0x24e34], 0
je 0x1bad5
push 1
push 0x27120
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x1bad5
push 0x48524452
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp + 8], eax
test eax, eax
je 0x1bad5
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1ba75
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov word [eax + 0x30], cx
mov eax, dword [esi + 0x18]
mov ecx, ebx
mov word [eax + 0x32], cx
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x18]
push ebx
push 0
push dword [eax + 0x34]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x27128
mov eax, dword [esi + 0x18]
add eax, 0x30
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push dword [ebp - 8]
call fcn.00015b00
and dword [edi + 0x1c], 0
mov esi, 0x104
xor dl, dl
mov ecx, edi
mov dword [edi + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x1baf2
push dword [ebp - 8]
call fcn.00015b00
mov eax, dword [ebp - 4]
inc byte [edi + 0x23]
add dword [edi + 0x60], 0x24
mov ecx, dword [eax + 4]
mov edx, edi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
pop ebx
pop edi
pop esi
leave
ret 8