Function at 0x1256c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x270
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
mov rbp, rdx
mov r12d, 0x208
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, r12
mov ebx, 0xc0000001
call fcn.00091d10
mov r13d, 0xc0000000
test rsi, rsi
je 0x128e4
test rbp, rbp
je 0x128e4
movzx eax, word [rbp]
mov r14d, 2
xor ecx, ecx
add ax, r14w
mov r8d, 0x6c616e41
movzx edx, ax
mov word [rsi + 0xc6], dx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi + 0xcc], rax
test rax, rax
jne 0x12612
mov ebx, 0xc0000017
lea rcx, [0x00092630]
jmp 0x128f0
movzx r8d, word [rsi + 0xc6]
xor edx, edx
mov rcx, rax
call fcn.00091d10
lea rcx, [rsi + 0xc4]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
cmp word [rsi + 0xc4], r12w
jb 0x1264f
mov ebx, 0xc0000004
lea rcx, [0x00092660]
jmp 0x128f0
movzx r8d, word [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rsp + 0x50]
call fcn.00091720
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe__wcslwr]
lea rcx, [rsp + 0x50]
mov edx, 0x5c
call qword [sym.imp.ntoskrnl.exe_wcsrchr]
mov rdx, rax
test rax, rax
jne 0x12696
lea rcx, [0x000926a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x128f7
or rcx, 0xffffffffffffffff
add rdx, r14
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx - 2]
lea rcx, [rsi + 0xe4]
call fcn.00091720
lea rdx, [rsi + 0xe4]
lea rcx, [rsi + 0xd4]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsi + 0xe4]
call qword [sym.imp.ntoskrnl.exe__wcslwr]
lea rdx, [rsi + 0xd4]
lea rcx, [rsp + 0x38]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov ecx, eax
mov ebx, eax
and ecx, r13d
cmp ecx, r13d
jne 0x12709
mov edx, eax
lea rcx, [0x000926b0]
jmp 0x128f2
movzx r8d, word [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsi + 0x2ec]
call fcn.00091720
lea rcx, [rsi + 0x2ec]
call qword [sym.imp.ntoskrnl.exe__strlwr]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
mov rdx, qword [rbp + 8]
lea rax, [rsp + 0x30]
lea r9, [rsi + 0x400]
lea r8, [0x000926e0]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r12d
call fcn.00034470
mov ebx, eax
and eax, r13d
cmp eax, r13d
jne 0x12776
lea rcx, [0x00092700]
jmp 0x128f0
lea rdx, [rsi + 0x400]
lea rcx, [rsi + 0x3f0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsi + 0x3f0]
lea rcx, [rsp + 0x38]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov ebx, eax
and eax, r13d
cmp eax, r13d
jne 0x127b5
lea rcx, [0x000926b0]
jmp 0x128f0
movzx r8d, word [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsi + 0x608]
call fcn.00091720
lea rcx, [rsi + 0x608]
call qword [sym.imp.ntoskrnl.exe__strlwr]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
mov rdx, qword [rbp + 8]
lea rax, [rsp + 0x30]
lea r9, [rsi + 4]
lea r8, [0x00092730]
mov edi, 4
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], edi
call fcn.00034470
mov ecx, eax
and ecx, r13d
cmp ecx, r13d
jne 0x1282c
cmp eax, 0xc0000034
je 0x1282c
lea rcx, [0x00092740]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rbp + 8]
lea rax, [rsp + 0x30]
lea r9, [rsi + 8]
lea r8, [0x00092770]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], edi
call fcn.00034470
mov ecx, eax
and ecx, r13d
cmp ecx, r13d
jne 0x1286a
lea rcx, [0x00092780]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
jmp 0x12888
mov edx, dword [rsi + 8]
lea rcx, [0x000927b0]
call sub.ntoskrnl.exe_DbgPrint
mov edx, dword [rsi + 8]
shr edx, 3
and dl, 1
mov byte [0x000b50f8], dl
mov rdx, qword [rbp + 8]
lea rax, [rsp + 0x30]
lea r9, [rsi + 0x86638]
lea r8, [0x000927e0]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x258
call fcn.00034470
mov ecx, eax
and ecx, r13d
cmp ecx, r13d
jne 0x128cd
lea rcx, [0x00092800]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
jmp 0x128e0
lea rdx, [rsi + 0x86638]
lea rcx, [0x00092830]
call sub.ntoskrnl.exe_DbgPrint
xor ebx, ebx
jmp 0x128f7
mov ebx, 0xc000000d
lea rcx, [0x00092600]
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
and eax, r13d
cmp eax, r13d
jne 0x12931
mov rcx, qword [rsi + 0xcc]
test rcx, rcx
je 0x12931
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x12931
mov rcx, qword [rsi + 0xcc]
mov edx, 0x6c616e41
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rsi + 0xcc], 0
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.000916b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret