Function at 0x90d40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6a0
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov r12, rcx
mov r13, r8
lea rcx, [rsp + 0x5c2]
xor r15d, r15d
xor edx, edx
mov r8d, 0xc6
mov rdi, r9
mov word [rsp + 0x5c0], r15w
call fcn.00091d10
lea r8d, [r15 + 0x28]
lea rcx, [rsp + 0xa8]
xor edx, edx
mov dword [rsp + 0xa0], r15d
call fcn.00091d10
xor eax, eax
lea rcx, [rsp + 0x104]
xor edx, edx
mov r8d, 0x9c
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x98], r15
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x80], r15b
mov qword [rsp + 0x81], rax
mov qword [rsp + 0x89], rax
mov dword [rsp + 0x91], eax
mov word [rsp + 0x95], ax
mov byte [rsp + 0x97], al
mov dword [rsp + 0x100], r15d
call fcn.00091d10
lea rcx, [rsp + 0x1a8]
xor edx, edx
mov r8d, 0x418
mov qword [rsp + 0x1a0], r15
call fcn.00091d10
xor eax, eax
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov rcx, r15
lea rax, [0x0009e5d0]
movzx eax, word [rcx + rax]
add rcx, 2
mov word [rsp + rcx + 0x5be], ax
cmp ax, r15w
jne 0x90e47
mov rax, qword [r13 + 8]
lea rdx, [rsp + 0x5c0]
movzx ecx, word [rax]
mov word [rsp + 0x5c8], cx
lea rcx, [rsp + 0xe8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xe8]
lea rcx, [0x0009e5e0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], 0x20
mov esi, 1
mov eax, 0x200
mov dword [rsp + 0xb8], eax
lea rax, [rsp + 0xe8]
mov dword [rsp + 0x38], esi
mov qword [rsp + 0xb0], rax
lea eax, [rsi + 6]
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x30], eax
lea eax, [rsi + 0x7f]
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov r9, rdi
mov edx, 0x80100000
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0x20], r15
mov qword [rsp + 0xc8], r15
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, r15d
mov ebx, eax
jge 0x90f51
mov edx, eax
lea rcx, [0x0009e5f0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x9133d
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x98]
mov r8, qword [r8]
xor r9d, r9d
mov edx, esi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, r15d
mov ebx, eax
jge 0x90f9a
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, ebx
lea rcx, [0x0009e610]
jmp 0x90f47
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax + 8]
mov r14, qword [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov cl, byte [rbp + 0x4c]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IoAllocateIrp]
mov rbx, rax
cmp rax, r15
jne 0x90ff3
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [0x0009e640]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
jmp 0x9133f
lea rcx, [rsp + 0x80]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rdx, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], r15
mov dword [rsp + 0xb8], 0x40
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], r15
mov rdx, qword [rdx]
mov eax, 0xd8
mov dword [rsp + 0x30], r15d
lea r8, [rsp + 0xa0]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], r15
call sub.ntoskrnl.exe_ObCreateObject
cmp eax, r15d
mov esi, eax
jge 0x91096
mov edx, eax
lea rcx, [0x0009e660]
call sub.ntoskrnl.exe_DbgPrint
mov eax, esi
jmp 0x9133f
mov rcx, qword [rsp + 0x70]
mov esi, 0xd8
xor edx, edx
mov r8, rsi
call fcn.00091d10
mov rax, qword [rsp + 0x70]
mov r11d, 5
mov word [rax], r11w
mov rax, qword [rsp + 0x70]
xor ecx, ecx
mov word [rax + 2], si
mov rax, qword [rsp + 0x70]
mov esi, 0x200
mov qword [rax + 8], r14
mov rax, qword [rsp + 0x70]
mov rdx, rsi
mov dword [rax + 0x50], 2
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x60], rax
mov rax, qword [rsp + 0x70]
mov r14d, 4
mov word [rax + 0x5a], si
movzx ecx, word [r13]
mov rax, qword [rsp + 0x70]
sub cx, r14w
mov r8, rsi
xor edx, edx
mov word [rax + 0x58], cx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x60]
call fcn.00091d10
mov rcx, qword [rsp + 0x70]
mov rdx, qword [r13 + 8]
movzx r8d, word [rcx + 0x58]
mov rcx, qword [rcx + 0x60]
add rdx, r14
call fcn.00091720
mov rdx, qword [rsp + 0x70]
lea rcx, [0x0009e680]
add rdx, 0x58
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x70]
lea edx, [r14 - 3]
sub rcx, 0xffffffffffffff80
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
add rcx, 0x98
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rcx, [rsp + 0x1a0]
xor edx, edx
mov r8d, 0x420
call fcn.00091d10
call qword [sym.imp.ntoskrnl.exe_IoGetFileObjectGenericMapping]
mov r13d, 0xc0000000
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x100]
mov r8d, r13d
mov r9, rax
call sub.ntoskrnl.exe_SeCreateAccessState
cmp eax, r15d
mov esi, eax
jge 0x911e5
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeIrp]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov edx, esi
lea rcx, [0x0009e6a0]
jmp 0x9108a
mov qword [rsp + 0xd0], r15
mov dword [rsp + 0xe0], r13d
mov dword [rsp + 0xe4], r15d
lea rax, [rsp + 0x100]
lea rcx, [0x00090ce8]
mov qword [rsp + 0xd8], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rbx + 8], r15
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x10], 0x84
mov byte [rbx + 0x40], r15b
mov qword [rbx + 0x48], rdi
mov byte [rbx + 0x41], r15b
mov byte [rbx + 0x44], r15b
mov qword [rbx + 0x68], r15
lea rax, [rsp + 0x80]
mov qword [rbx + 0x50], rax
mov rax, qword gs:[0x188]
mov rdx, qword [rbx + 0xb8]
mov qword [rbx + 0x98], rax
mov qword [rbx + 0xa0], r15
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0xc0], rax
mov byte [rdx - 0x48], r15b
mov qword [rdx - 0x20], rbp
mov rax, qword [rsp + 0x70]
mov dword [rdx - 0x38], 0x1000020
mov dword [rdx - 0x28], r15d
mov qword [rdx - 0x18], rax
lea rax, [rsp + 0xd0]
mov qword [rdx - 0x40], rax
mov eax, 0x80
mov word [rdx - 0x30], ax
mov eax, 7
mov word [rdx - 0x2e], ax
mov rax, qword [rbx + 0xb8]
mov rdx, rbx
mov qword [rax - 0x10], rcx
mov rcx, rbp
mov qword [rax - 8], r15
mov byte [rax - 0x45], 0xe0
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x912f1
lea rcx, [rsp + 0x80]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ebx, dword [rdi]
cmp ebx, r15d
jge 0x91311
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [0x0009e6d0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x9133d
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
lock add dword [rcx + r14], 1
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x10], r15
je 0x91339
mov rax, qword [rax + 0x10]
lock add dword [rax + 0x1c], 1
mov rax, qword [rsp + 0x70]
mov qword [r12], rax
mov eax, ebx
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.000916b0
mov rbx, qword [rsp + 0x6e8]
add rsp, 0x6a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret