Function at 0x2c9f7
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x2b4d0]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x44], eax
mov dword [ecx], esi
mov dword [eax], esi
mov eax, dword [ebp + 0x20]
and eax, 1
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x1c], edi
push eax
je 0x2ded6
push 0x2cc80
call fcn.0002c8a0
cmp eax, esi
jl 0x2cc72
mov edi, dword [edi + 0x154]
push ebx
inc edi
mov ebx, edi
imul ebx, ebx, 0xe
push 0x6a74624e
lea eax, [ebx + 0x28]
push eax
push esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x31546
push 0x6b74624e
add ebx, 0xc
push ebx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x31565
and dword [esi], 0
imul edi, edi, 0xe
push 0x11
lea eax, [esi + 8]
push 0x2cc88
add edi, 0xb
push eax
mov byte [esi + 4], 0
mov byte [esi + 5], 0x10
mov word [esi + 6], di
call dword [sym.imp.ntoskrnl.exe_memmove]
movzx eax, byte [esi + 5]
lea eax, [eax + esi + 9]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp dword [eax + 0xbc], 1
je 0x2cc9e
mov edi, dword [ebp + 0x1c]
mov ax, word [ebp + 0x18]
mov ch, al
bswap edi
mov dword [ebp - 0x12], edi
lea edi, [ebp - 0xe]
push 0xe
mov cl, ah
mov ax, cx
mov word [ebp - 0x14], ax
mov word [ebp - 0x16], ax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebx + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_memmove]
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x20], 0
add esp, 0xc
mov word [ebx + 4], 0xe
mov word [ebx + 6], 2
cmp dword [eax + 0x154], 0
ja 0x31577
mov eax, dword [ebp - 0x4c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x3c]
add eax, 0xb
push eax
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
xor edi, edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x64], 0x18
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x58], 0x240
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], edi
movzx eax, word [esi + 6]
movzx ecx, byte [esi + 5]
lea eax, [eax + ecx + 0xc]
push eax
mov ax, word [ebp + 0x18]
neg ax
push esi
push edi
push 3
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
push eax
push 0x80
push edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0xc0100000
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
push edi
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 0x18], eax
call ebx
push edi
push esi
call ebx
push edi
push dword [ebp - 0x2c]
call ebx
cmp dword [ebp - 0x18], edi
jl 0x2cc6e
mov eax, dword [ebp - 0x6c]
cmp eax, edi
jl 0x2cc71
push edi
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, edi
mov dword [ebp - 0x18], eax
jl 0x2fe00
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x40]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
push eax
mov dword [esi], eax
call dword [sym.imp.ntoskrnl.exe_IoGetRelatedDeviceObject]
push dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x44]
push 0x2a33f
push 2
mov dword [ebx], eax
push dword [esi]
push eax
call fcn.0002ccaa
cmp eax, edi
mov dword [ebp - 0x18], eax
jl 0x2cc6e
cmp dword [ebp - 0x38], edi
je 0x2e66d
push dword [ebp - 0x1c]
push 0x10e40
push 3
push dword [esi]
push dword [ebx]
call fcn.0002ccaa
cmp eax, edi
mov dword [ebp - 0x18], eax
jl 0x2fdf7
push dword [ebp - 0x1c]
push 0x13f6d
push 1
push dword [esi]
push dword [ebx]
call fcn.0002ccaa
cmp eax, edi
mov dword [ebp - 0x18], eax
jl 0x2fdf7
test byte [ebp + 0x20], 2
jne 0x2dee8
mov eax, dword [ebp - 0x18]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.00010615
leave
ret 0x1c
xor edi, edi
jmp 0x2cadb
push 0x2dee0
jmp 0x2ca3f
push dword [ebp - 0x1c]
push 0x1caa1
push edi
jmp 0x2e689
mov eax, dword [ebp - 0x1c]
mov cx, word [ebp + 0x18]
cmp cx, word [eax + 0x1fc]
push eax
jne 0x2fded
push 0x10669
push 4
push dword [esi]
push dword [ebx]
call fcn.0002ccaa
cmp eax, edi
mov dword [ebp - 0x18], eax
jge 0x2cc6e
jmp 0x2fdf7
push fcn.00010d25
jmp 0x2e687
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x2cc6e
push 0x315d0
call fcn.0002af36
pop ecx
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc000009a
jmp 0x2cc71
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push eax
push dword [ebp - 0x2c]
call edi
push ebx
push esi
call edi
jmp 0x3155b
add eax, 0x220
lea edi, [ebx + 0xa]
mov dword [ebp - 0x28], eax
mov ax, word [ebp - 0x16]
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
bswap eax
mov dword [ebp - 0x12], eax
push 0xe
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.ntoskrnl.exe_memmove]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x28], 4
add esp, 0xc
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov word [edi], 0xe
mov word [edi + 2], 2
add edi, 6
cmp ecx, dword [eax + 0x154]
jb 0x31582
jmp 0x2cb2d