Function at 0x180004ae0
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x2a8
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x2d0]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2d0]
mov dword [rax], 0
mov eax, dword [rsp + 0x2c0]
mov dword [rsp + 0x298], eax
mov eax, dword [rsp + 0x298]
sub eax, 0x222004
mov dword [rsp + 0x298], eax
cmp dword [rsp + 0x298], 0x74
ja case.0x180004b6f.2236421
mov eax, dword [rsp + 0x298]
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x590c]
mov eax, dword [rcx + rax*4 + 0x5894]
add rax, rcx
jmp rax
cmp qword [rsp + 0x2c8], 0
je 0x180004b86
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004b93
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800b2890]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov byte [0x1800b44f4], 0
mov qword [0x1800b4510], 0
lea rax, [0x1800b28c8]
mov qword [rsp + 0x28], rax
lea rax, [0x1800b4510]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x34], eax
xor edx, edx
lea rcx, [0x1800b2890]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
cmp dword [rsp + 0x34], 0
jl 0x180004ca0
cmp qword [0x1800b4518], 0
je 0x180004c32
cmp qword [0x1800b4520], 0
jne 0x180004c4e
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [0x1800b4518], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x1800b4520], rax
jmp 0x180004c8c
mov rdx, qword [0x1800b4520]
mov rcx, qword [0x1800b4518]
call fcn.180004090
movzx eax, al
test eax, eax
je 0x180004c8c
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [0x1800b4518], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x1800b4520], rax
call fcn.1800034a0
call fcn.180004750
mov rcx, qword [0x1800b4510]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [0x1800b44f4], 1
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x180004ccb
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004cd8
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 8]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x48], 0
je 0x180004ddc
cmp qword [rsp + 0x40], 0
je 0x180004ddc
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x60], 0
jl 0x180004dcb
cmp qword [rsp + 0x58], 0
je 0x180004dcb
cmp dword [rsp + 0x60], 0
jl 0x180004dcb
cmp qword [rsp + 0x58], 0
je 0x180004dcb
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.180004550
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov dword [rsp + 0x34], 0
cmp qword [rsp + 0x2c8], 0
je 0x180004e03
mov eax, dword [rsp + 0x2d8]
cmp rax, 0x118
jae 0x180004e10
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005883
call fcn.1800033c0
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x180004ee9
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x114], 0x104
jae 0x180004edc
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x114], 0
jbe 0x180004edc
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rcx + 4], rax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rcx + 0xc], rax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x114]
mov rsi, qword [rsp + 0x80]
add rsi, 0x10
mov rdi, qword [rsp + 0x2c8]
add rdi, 0x14
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x80]
mov ecx, dword [rax + 0x114]
mov rax, qword [rsp + 0x2c8]
mov byte [rax + rcx + 0x14], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
mov rcx, qword [rsp + 0x80]
call fcn.180003460
jmp 0x180005883
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x180004efd
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov dword [rsp + 0x88], eax
mov ecx, dword [rsp + 0x88]
call fcn.180004430
mov dword [rsp + 0x34], 0
jmp 0x180005883
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004470
mov dword [rsp + 0x34], 0
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.180006520
mov dword [rsp + 0x34], 0
jmp 0x180005883
call fcn.180006560
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x180004f8d
cmp dword [rsp + 0x30], 8
jae 0x180004f9a
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov dword [0x1800b4528], eax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 4]
mov dword [0x1800b452c], eax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 8]
mov dword [0x1800b4530], eax
mov dword [rsp + 0x34], 0
jmp 0x180005883
jmp 0x180005883
call fcn.1800047f0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x180004ff8
mov byte [rsp + 0x29c], 1
jmp 0x180005000
mov byte [rsp + 0x29c], 0
movzx eax, byte [rsp + 0x29c]
mov byte [0x1800b3e87], al
mov eax, dword [rsp + 0x34]
jmp 0x180005887
cmp qword [rsp + 0x2c8], 0
je 0x180005031
mov eax, dword [rsp + 0x30]
cmp rax, 4
jae 0x18000503e
mov dword [rsp + 0x34], 0xc00000bb
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800b2818]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov byte [0x1800b3e86], 0
mov qword [0x1800b4508], 0
lea rax, [0x1800b2888]
mov qword [rsp + 0x28], rax
lea rax, [0x1800b4508]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x34], eax
xor edx, edx
lea rcx, [0x1800b2818]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
cmp dword [rsp + 0x34], 0
jl 0x1800050d2
mov byte [0x1800b3e86], 1
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x1800050f1
mov eax, dword [rsp + 0x2d8]
cmp rax, 0x414
jae 0x1800050fe
mov dword [rsp + 0x34], 0xc00000bb
jmp 0x180005883
lea rcx, [0x1800b2858]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov byte [rsp + 0xa0], al
mov rcx, qword [rsp + 0x2c8]
mov eax, dword [0x1800b44f0]
mov dword [rcx], eax
mov ecx, dword [0x1800b44f0]
shl rcx, 2
mov rdi, qword [rsp + 0x2c8]
add rdi, 4
lea rsi, [0x1800b40e0]
rep movsb byte [rdi], byte [rsi]
mov dword [0x1800b44f0], 0
lea rdi, [0x1800b40e0]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
movzx edx, byte [rsp + 0xa0]
lea rcx, [0x1800b2858]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call fcn.180006650
mov dword [rsp + 0x34], 0
jmp 0x180005883
call fcn.18002b390
jmp 0x180005883
call fcn.1800043f0
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x1800051ca
mov eax, dword [rsp + 0x30]
cmp rax, 0x18
je 0x1800051d7
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005883
mov rcx, qword [rsp + 0x2c8]
call fcn.18002b760
mov dword [rsp + 0x34], eax
jmp 0x180005883
call fcn.18002c420
mov dword [rsp + 0x34], eax
jmp 0x180005883
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180072070]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
cmp qword [rsp + 0x2c8], 0
je 0x180005291
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x180005291
lea rcx, [rsp + 0xb0]
call fcn.1800049b0
lea rdi, [rsp + 0xb0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0xc8]
mov r8, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
call fcn.1800037b0
movzx eax, al
test eax, eax
jne 0x180005287
mov dword [rsp + 0x34], 0xc0000001
jmp 0x18000528f
mov dword [rsp + 0x34], 0
jmp 0x180005299
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
xor edx, edx
lea rcx, [0x180072070]
call qword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x180005336
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x180005336
lea rcx, [rsp + 0xd0]
call fcn.1800049b0
lea rdi, [rsp + 0xd0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0xd8]
mov ecx, dword [rsp + 0xd0]
call fcn.180003a90
movzx eax, al
test eax, eax
jne 0x18000532c
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005334
mov dword [rsp + 0x34], 0
jmp 0x18000533e
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x1800053cc
mov eax, dword [rsp + 0x30]
cmp rax, 0x20
jb 0x1800053cc
lea rcx, [rsp + 0xf0]
call fcn.1800049b0
lea rdi, [rsp + 0xf0]
mov rsi, qword [rsp + 0x2c8]
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0x108]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0xf0]
call fcn.18002bc50
movzx eax, al
test eax, eax
jne 0x1800053c2
mov dword [rsp + 0x34], 0xc0000001
jmp 0x1800053ca
mov dword [rsp + 0x34], 0
jmp 0x1800053d4
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x110]
call fcn.1800010e0
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax + 4]
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x120]
call fcn.1800013e0
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov eax, dword [rax]
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x128]
call fcn.180001640
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x138], rax
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
call fcn.180002100
mov dword [rsp + 0x34], 0
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov byte [rsp + 0x140], 0
lea rdi, [rsp + 0x141]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
cmp dword [rsp + 0x30], 0
jbe 0x18000556d
cmp dword [rsp + 0x30], 0x104
jae 0x18000556d
mov ecx, dword [rsp + 0x30]
lea rdi, [rsp + 0x140]
mov rsi, qword [rsp + 0x2c8]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x140]
call fcn.180001d30
mov dword [rsp + 0x34], 0
jmp 0x180005575
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov rax, qword [rsp + 0x2c8]
mov rax, qword [rax]
mov qword [rsp + 0x250], rax
mov rcx, qword [rsp + 0x250]
call fcn.180003d80
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x1800055da
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
je 0x1800055f3
lea rcx, str.IOCTL_SUSPENDTHREAD_buf__NULL__len___sizeof_CLIENT_ID_
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005883
mov rcx, qword [rsp + 0x2c8]
call fcn.18002b010
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x18000562f
mov eax, dword [rsp + 0x30]
cmp rax, 0x10
je 0x180005648
lea rcx, str.IOCTL_TERMINATETHREAD_buf__NULL__len___sizeof_CLIENT_ID_
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005883
mov rcx, qword [rsp + 0x2c8]
call fcn.18002b1d0
mov dword [rsp + 0x34], eax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
cmp qword [rsp + 0x2c8], 0
je 0x180005684
mov eax, dword [rsp + 0x30]
cmp rax, 0x28
je 0x180005691
mov dword [rsp + 0x34], 0xc0000001
jmp 0x180005868
cmp dword [0x1800b4580], 0
jne 0x1800056bc
mov dword [0x1800b4580], 1
call fcn.180002500
lea rdx, [0x1800b3ea0]
mov rcx, qword [0x1800b3e98]
call fcn.1800023f0
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x258]
cmp qword [rax + 8], 0
je 0x180005860
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x10], 0
je 0x180005860
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x18], 0
je 0x180005860
mov rax, qword [rsp + 0x258]
cmp qword [rax + 0x20], 0
je 0x180005860
mov rax, qword [rsp + 0x258]
mov rax, qword [rax + 8]
shl rax, 1
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
add rdx, 2
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x278], rax
mov rcx, qword [rsp + 0x260]
add rcx, 2
mov rdi, qword [rsp + 0x278]
xor eax, eax
rep stosb byte [rdi], al
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x278]
mov rsi, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x260]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x258]
mov rax, qword [rax + 0x18]
shl rax, 1
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
add rdx, 2
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x260]
add rcx, 2
mov rdi, qword [rsp + 0x290]
xor eax, eax
rep stosb byte [rdi], al
mov rsi, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsi + 0x20]
mov rcx, qword [rsp + 0x260]
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x278]
lea rcx, [rsp + 0x268]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x280]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0x268]
mov rcx, qword [rsp + 0x258]
mov rcx, qword [rcx]
call fcn.1800026a0
xor edx, edx
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x34], 0
jmp 0x180005868
mov dword [rsp + 0x34], 0xc0000001
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x2c8]
call fcn.180004aa0
jmp 0x180005883
mov dword [rsp + 0x34], 0xc00000bb
mov eax, dword [rsp + 0x34]
add rsp, 0x2a8
pop rdi
pop rsi
ret