Function at 0x1b6f8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor r14d, r14d
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
cmp rdx, r14
je 0x1bec7
cmp edi, r14d
jle 0x1bec7
cmp byte [0x000266c2], r14b
je 0x1b74b
lea rcx, [0x00021ce0]
mov r8d, edi
call sub.ntoskrnl.exe_DbgPrint
cmp edi, r14d
jbe 0x1b7af
cmp byte [0x000266c2], r14b
je 0x1b7af
lea eax, [rdi + 1]
xor ecx, ecx
mov edx, eax
mov r12d, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
cmp rax, r14
je 0x1b7af
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.0001dc60
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.0001dd60
cmp byte [0x000266c2], r14b
je 0x1b7a4
lea rcx, [0x00021d10]
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add dword [rbx + 0x2c], edi
mov r12d, 4
cmp dword [rbx + 0x28], r12d
jae 0x1bb22
cmp edi, r12d
jl 0x1b809
lea rdx, [0x00021d30]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1b809
cmp byte [0x000266c2], r14b
je 0x1b7f4
lea rcx, [0x00021d40]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rbx
call fcn.00019e8c
mov ebp, 1
mov dword [rbx + 0x28], ebp
jmp 0x1bedc
mov eax, dword [rbx + 0x28]
cmp eax, r14d
jne 0x1b865
cmp edi, r12d
jl 0x1bb01
lea rdx, [0x00021d60]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
je 0x1b84e
lea rdx, [0x00021d70]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1bb01
cmp byte [0x000266c2], r14b
je 0x1b7fc
lea rcx, [0x00021d80]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1b7fc
mov ebp, 1
cmp eax, ebp
jne 0x1b8fe
lea r8d, [rbp + 9]
cmp edi, r8d
jle 0x1bb01
lea rdx, [0x00021da0]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1bb01
cmp byte [0x000266c2], r14b
je 0x1b8ad
lea rcx, [0x00021db0]
call sub.ntoskrnl.exe_DbgPrint
lea edx, [rdi - 0xa]
lea rcx, [rsi + 0xa]
call fcn.00019f44
mov rdi, rax
cmp rax, r14
je 0x1b8f2
cmp byte [0x000266c2], r14b
je 0x1b8d9
lea rcx, [0x00021dd0]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 8]
cmp rcx, r14
je 0x1b8ee
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 8], r14
mov qword [rbx + 8], rdi
mov dword [rbx + 0x28], 2
jmp 0x1bb01
cmp eax, 2
jne 0x1b993
cmp edi, 8
jle 0x1bb01
lea r8d, [rax + 6]
lea rdx, [0x00021df0]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1bb01
cmp byte [0x000266c2], r14b
je 0x1b942
lea rcx, [0x00021e00]
call sub.ntoskrnl.exe_DbgPrint
lea edx, [rdi - 8]
lea rcx, [rsi + 8]
call fcn.00019f44
mov rdi, rax
cmp rax, r14
je 0x1b987
cmp byte [0x000266c2], r14b
je 0x1b96e
lea rcx, [0x00021e20]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
je 0x1b983
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x10], rdi
mov dword [rbx + 0x28], 3
jmp 0x1bb01
cmp eax, 3
jne 0x1bb01
cmp edi, r12d
jl 0x1b9d7
lea rdx, [0x00021e40]
mov r8, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1b9d7
cmp byte [0x000266c2], r14b
je 0x1b9ce
lea rcx, [0x00021e50]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rbx + 0x28], r12d
jmp 0x1bb01
cmp edi, 8
jle 0x1bb01
lea rdx, [0x00021df0]
mov r8d, 8
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r14d
jne 0x1bb01
cmp byte [0x000266c2], r14b
je 0x1ba14
lea rcx, [0x00021e00]
call sub.ntoskrnl.exe_DbgPrint
lea edx, [rdi - 8]
lea rcx, [rsi + 8]
call fcn.00019f44
mov rsi, rax
cmp rax, r14
je 0x1bb01
cmp byte [0x000266c2], r14b
je 0x1ba44
lea rcx, [0x00021e20]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rdi, qword [rbx + 0x10]
cmp rdi, r14
jne 0x1ba56
mov qword [rbx + 0x10], rsi
jmp 0x1bb01
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
repne scasb al, byte [rdi]
mov rdi, rsi
not rcx
sub rcx, rbp
mov rdx, rcx
mov rcx, r13
repne scasb al, byte [rdi]
not rcx
sub rcx, rbp
lea eax, [rdx + rcx + 2]
xor ecx, ecx
mov edx, eax
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r12, rax
cmp rax, r14
je 0x1baf6
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0001dc60
mov rax, qword [rbx + 0x10]
mov rcx, r12
mov dl, byte [rax]
add rax, rbp
mov byte [rcx], dl
add rcx, rbp
cmp dl, r14b
jne 0x1baa4
xor eax, eax
mov rdi, r12
mov rcx, r13
repne scasb al, byte [rdi]
movzx eax, word [0x000205e0]
mov rcx, r13
sub rdi, rbp
mov word [rdi], ax
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
sub rdi, rbp
xor ecx, ecx
mov al, byte [rsi + rcx]
mov byte [rdi + rcx], al
add rcx, rbp
test al, al
jne 0x1bad9
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x10], r12
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x000266c2], r14b
je 0x1bedc
mov edx, dword [rbx + 0x28]
lea rcx, [0x00021e70]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1bedc
jne 0x1bc82
mov dword [rbx + 0x28], 6
cmp byte [0x000266c2], r14b
je 0x1bb5b
lea rcx, [0x00021ea0]
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x000266c2], r14b
je 0x1bb5b
lea rcx, [0x00021ed0]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
mov edx, edi
mov rcx, rsi
call fcn.0001a518
mov rbp, rax
cmp rax, r14
je 0x1bbb9
cmp byte [0x000266c2], r14b
je 0x1bb85
lea rcx, [0x00021ef0]
mov rdx, rax
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbx + 0x10]
mov rdx, rbp
call fcn.0001a2fc
xor edx, edx
mov rcx, rbp
mov qword [rbx + 0x10], rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x000266c2], r14b
je 0x1bbb9
mov rdx, qword [rbx + 0x10]
lea rcx, [0x00021f10]
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 9
jle 0x1bc82
lea r8, [0x000209a0]
mov r9d, 9
mov edx, edi
mov rcx, rsi
call fcn.00019890
or r13, 0xffffffffffffffff
cmp eax, r13d
je 0x1bc82
sub edi, eax
add eax, 9
xor r8d, r8d
movsxd rcx, eax
sub edi, 9
add rcx, rsi
mov edx, edi
mov rsi, rcx
call fcn.0001a00c
mov rbp, rax
cmp rax, r14
je 0x1bc82
sub ebp, esi
cmp qword [rbx + 0x18], r14
jne 0x1bc82
lea ecx, [rbp + 1]
mov r12d, ecx
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx + 0x18], rax
cmp rax, r14
je 0x1bc82
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.0001dc60
mov rcx, qword [rbx + 0x18]
mov r8d, ebp
mov rdx, rsi
call fcn.0001dd60
mov rcx, qword [rbx + 0x18]
mov edx, ebp
call fcn.0001a058
mov rbp, rax
cmp rax, r14
je 0x1bc69
mov rcx, qword [rbx + 0x18]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x18], rbp
cmp byte [0x000266c2], r14b
je 0x1bc82
mov rdx, qword [rbx + 0x18]
lea rcx, [0x00021f40]
call sub.ntoskrnl.exe_DbgPrint
mov edx, dword [rbx + 0x28]
cmp edx, 8
jne 0x1bca3
cmp byte [0x000266c2], r14b
je 0x1bedc
lea rcx, [0x00021f60]
jmp 0x1bed7
cmp edx, 6
je 0x1bcb1
cmp edx, 7
jne 0x1be9b
mov r12, rsi
mov r13d, edi
mov bpl, r14b
cmp byte [0x000266c2], r14b
je 0x1bccf
lea rcx, [0x00021f80]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rbx + 0x58]
cmp eax, r14d
jbe 0x1bd7b
lea r13d, [rax + rdi]
xor ecx, ecx
mov ebp, 1
mov edx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r12, rax
cmp rax, r14
jne 0x1bd2b
mov rcx, qword [rbx + 0x60]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x60], r14
mov dword [rbx + 0x58], r14d
mov dword [rbx + 0x28], 8
cmp byte [0x000266c2], r14b
je 0x1bedc
lea rcx, [0x00021fb0]
jmp 0x1bed7
mov r8d, dword [rbx + 0x58]
mov rdx, qword [rbx + 0x60]
mov rcx, rax
call fcn.0001dd60
cmp byte [0x000266c2], r14b
je 0x1bd56
mov edx, dword [rbx + 0x58]
lea rcx, [0x00021fd0]
mov r8, r12
call sub.ntoskrnl.exe_DbgPrint
mov ecx, dword [rbx + 0x58]
mov r8d, edi
mov rdx, rsi
add rcx, r12
call fcn.0001dd60
mov rcx, qword [rbx + 0x60]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rbx + 0x60], r14
mov dword [rbx + 0x58], r14d
cmp r13d, r14d
mov rdi, r12
mov eax, r13d
jle 0x1bdd0
mov esi, dword [rbx + 0x28]
cmp esi, 6
jne 0x1bd9e
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.0001a764
jmp 0x1bdb1
cmp esi, 7
jne 0x1bdb6
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.0001b1f4
mov rdi, rax
jmp 0x1bdb9
mov rdi, r14
cmp rdi, r14
je 0x1bdd5
cmp esi, dword [rbx + 0x28]
je 0x1bdd0
mov eax, r12d
sub eax, edi
add eax, r13d
cmp eax, r14d
jg 0x1bd86
cmp rdi, r14
jne 0x1bdf2
mov dword [rbx + 0x28], 8
cmp byte [0x000266c2], r14b
je 0x1be6f
lea rcx, [0x00022020]
jmp 0x1be6a
sub edi, r12d
cmp r13d, edi
jle 0x1be6f
sub r13d, edi
xor ecx, ecx
mov edx, r13d
mov esi, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx + 0x60], rax
cmp rax, r14
je 0x1be53
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.0001dc60
mov rcx, qword [rbx + 0x60]
movsxd rdx, edi
add rdx, r12
mov r8, rsi
call fcn.0001dd60
mov dword [rbx + 0x58], esi
cmp byte [0x000266c2], r14b
je 0x1be6f
mov r8, qword [rbx + 0x60]
lea rcx, [0x00022050]
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1be6f
mov dword [rbx + 0x28], 8
cmp byte [0x000266c2], r14b
je 0x1be6f
lea rcx, [0x000220a0]
call sub.ntoskrnl.exe_DbgPrint
cmp bpl, r14b
je 0x1be7f
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp byte [0x000266c2], r14b
je 0x1beb7
mov r8d, dword [rbx + 0x58]
mov edx, dword [rbx + 0x28]
lea rcx, [0x000220d0]
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x000266c2], r14b
je 0x1beb7
mov r8, qword [rbx + 0x50]
mov edx, dword [rbx + 0x2c]
lea rcx, [0x00022110]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [rbx + 0x50], r14
jne 0x1bedc
mov rcx, rbx
call fcn.000187c0
jmp 0x1bede
cmp byte [0x000266c2], r14b
je 0x1bedc
lea rcx, [0x00021cc0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret