Function at 0x14000de40
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
lea rcx, [0x140018010]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [0x14001c160], 0
jne 0x14000de5e
jmp 0x14000e47a
lea rcx, [0x140018050]
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140010a00]
call fcn.140002490
mov byte [0x14001c150], 0
cmp qword [0x14001c480], 0
je 0x14000dee0
lea rcx, [0x140018090]
call sub.ntoskrnl.exe_DbgPrint
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001c4a0]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001c480]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [0x14001c480]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [0x14001c480], 0
cmp qword [0x14001c500], 0
je 0x14000df55
mov dword [rsp + 0x30], 0
jmp 0x14000defe
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [0x14001c4f8]
cmp dword [rsp + 0x30], eax
jge 0x14000df55
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x88
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x70
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
jmp 0x14000def4
cmp qword [0x14001c6d8], 0
je 0x14000dfa7
lea rcx, [0x1400180b0]
call sub.ntoskrnl.exe_DbgPrint
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001c6c0]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001c6d8]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [0x14001c6d8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [0x14001c6d8], 0
cmp qword [0x14001c500], 0
je 0x14000e440
lea rcx, [0x1400180d0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x30], 0
jmp 0x14000dfd5
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [0x14001c4f8]
cmp dword [rsp + 0x30], eax
jge 0x14000e405
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
test rax, rax
je 0x14000e400
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x40
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x58
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov edx, dword [rsp + 0x30]
lea rcx, [0x140018100]
call sub.ntoskrnl.exe_DbgPrint
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x108], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x20], 0
je 0x14000e0fb
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x20], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x10], 0
je 0x14000e174
lfence
cmp dword [0x14001c164], 0
je 0x14000e13d
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x14000e15c
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x10], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x28], 0
je 0x14000e1c0
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x20], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x18], 0
je 0x14000e239
lfence
cmp dword [0x14001c164], 0
je 0x14000e202
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x14000e221
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x18], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
cmp qword [rax], 0
je 0x14000e284
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 8], 0
je 0x14000e2d2
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetElementGenericTable]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000e31f
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTable]
jmp 0x14000e2d2
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x30], 0
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlGetElementGenericTable]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000e3a0
lfence
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rax + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTable]
jmp 0x14000e353
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
xor edx, edx
mov rcx, qword [rax + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x38], 0
movsxd rax, dword [rsp + 0x30]
xor edx, edx
mov rcx, qword [0x14001c500]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [0x14001c500]
mov qword [rcx + rax*8], 0
jmp 0x14000dfcb
mov edx, 0x666e4950
mov rcx, qword [0x14001c500]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, 0x52443255
mov rcx, qword [0x14001c508]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x14001c500], 0
lea rcx, [0x140018130]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x14001c158], 0
je 0x14000e46e
xor edx, edx
mov rcx, qword [0x14001c158]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x14001c158], 0
mov dword [0x14001c510], 0
lea rcx, [0x140018150]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x48
ret