Function at 0x283c0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x185f1
mov eax, dword [rsp]
and rax, 0xff
movzx eax, al
mov ecx, dword [rsp + 0x10]
and rcx, 0xff
movzx ecx, cl
add eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and rax, 0xff
movzx eax, al
and eax, 1
test eax, eax
jne 0x18533
mov eax, dword [rsp]
xor eax, 0xe4
mov dword [rsp], eax
mov eax, dword [rsp]
shr eax, 1
mov dword [rsp], eax
mov eax, dword [rsp + 0x10]
and rax, 0xff
movzx eax, al
mov ecx, dword [rsp]
and rcx, 0xff
movzx ecx, cl
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 4]
and rax, 0xff
movzx eax, al
mov ecx, dword [rsp]
and rcx, 0xff
movzx ecx, cl
add eax, ecx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
and rax, 0xff
movzx eax, al
and eax, 1
test eax, eax
jne 0x1859c
mov eax, dword [rsp + 4]
add eax, 0x148
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 1
mov dword [rsp + 4], eax
movsxd rax, dword [rsp + 8]
and al, 8
and al, 8
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp], eax
mov eax, dword [rsp]
and rax, 0xff
movzx eax, al
mov ecx, dword [rsp + 4]
and rcx, 0xff
movzx ecx, cl
add eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and rax, 0xff
movsxd rcx, dword [rsp + 8]
mov rdx, qword [rsp + 0x30]
mov byte [rdx + rcx], al
jmp 0x184e1
add rsp, 0x28
ret
jl 0x1868f
xor al, 0x34
add byte [rax], al
sal byte [rdi + rax - 0x7d], 0x7c
and al, 0x30
add byte [rbp + 0xa], dh
mov eax, 0xc0000034
jmp 0x1873f
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x186b1
mov eax, 0xc000009a
jmp 0x1873f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x38]
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jge 0x18708
cmp qword [rsp + 0x38], 0
je 0x18701
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc000000d
jmp 0x1873f
invalid
invalid
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
add rcx, 0xc
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x70]
call fcn.00013690
cmp qword [rsp + 0x38], 0
je 0x1873d
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
add rsp, 0x58
ret
mov rax, qword [rsp + 0x50]
jl 0x188bf
sub byte [rax], al
xor byte [rax], al
add byte [rax], al
add bl, ch
or bh, al
and al, 0x30
add dword [rax], eax
add byte [rax], al
and al, 0x28
add byte [rax], al
add byte [rax], al
int3
invalid
add byte [rax], bl
invalid
or esp, dword [rax]
add byte [rcx], al
adc dword [rdx], eax
add byte [rcx], dl
add dword [rbx], edx
add byte [rcx], al
invalid
invalid
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x28], 0
call fcn.00016210
movzx eax, al
cmp eax, 1
jle 0x28429
call fcn.00016210
movzx eax, al
mov edx, eax
lea rcx, [0x00011090]
call sub.ntoskrnl.exe_DbgPrint
xor r9d, r9d
mov r8d, 0x4ae
lea rdx, [0x00011ef0]
lea rcx, [0x000110e4]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov r8d, 0x4d525356
mov edx, 0x32
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x28451
jmp 0x28d78
mov r8d, 0x32
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.000139e0
mov rax, qword [rsp + 0x28]
mov byte [rax], 1
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x3c], 0
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
sub eax, 0xc
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x81
ja case.default.0x284e3
movsxd rax, dword [rsp + 0x38]
lea rcx, [0x00010000]
movzx eax, byte [rcx + rax + 0x18db0]
mov eax, dword [rcx + rax*4 + 0x18d80]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
mov edx, eax
lea rcx, [0x00012568]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x28bdf
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
cmp dword [rsp + 0x3c], 0
je 0x28c07
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
jmp 0x28d78
movzx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
movzx ecx, byte [rcx + 3]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov byte [rcx + 3], al
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
test eax, eax
jl 0x28c81
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
cmp eax, 0x1f
jg 0x28c81
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 3]
inc al
mov byte [rsp + 0x34], al
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rsp + 0x34]
mov byte [rax + 3], cl
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x34]
mov byte [rax + 1], cl
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
movzx ecx, byte [rcx]
and ecx, 0x7f
mov r8, rax
mov dl, 2
call fcn.000181b0
test eax, eax
je 0x28c3a
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
mov byte [rsp + 0x35], al
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 1]
mov byte [rsp + 0x36], al
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, rax
call fcn.00024920
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x28cd4
mov rax, qword [rsp + 0x28]
add rax, 2
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call fcn.00024920
movzx eax, byte [rsp + 0x35]
test eax, eax
jne 0x28cfe
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0xe]
and eax, 0xff
movzx ecx, byte [rsp + 0x36]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0x70]
mov word [rcx + 0xe], ax
mov eax, dword [rsp + 0x30]
add rax, 2
mov rcx, qword [rsp + 0x80]
mov ecx, dword [rcx]
cmp rax, rcx
jae 0x28d24
mov eax, dword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x48], rax
jmp 0x28d33
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
call fcn.00013690
cmp qword [rsp + 0x28], 0
je 0x28d78
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x68
ret