Function at 0x1c880
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r13, rdx
mov rdi, rcx
mov ebx, 0xc0000001
cmp byte [0x000266c2], r15b
je 0x1c8d8
mov eax, dword [rcx + 0x20]
mov r9d, dword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov edx, dword [rcx]
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x18]
lea rcx, [0x000221d0]
mov qword [r11 - 0x48], rax
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x80532f3c
cmp dword [rdi], eax
ja 0x1cf08
je 0x1ced7
mov eax, 0x80532f0c
cmp dword [rdi], eax
ja 0x1cb89
je 0x1cb44
cmp dword [rdi], 0x80532eec
je 0x1cb3a
cmp dword [rdi], 0x80532ef0
je 0x1d6bf
cmp dword [rdi], 0x80532ef4
je 0x1ca9b
cmp dword [rdi], 0x80532ef8
je 0x1ca04
cmp dword [rdi], 0x80532efc
je 0x1c9c8
cmp dword [rdi], 0x80532f00
je 0x1c994
cmp dword [rdi], 0x80532f04
jne 0x1d6bf
mov ebx, dword [rdi + 0x10]
mov rsi, qword [rdi + 8]
shr ebx, 4
cmp byte [0x000266c2], r15b
je 0x1c973
lea rcx, [0x000222e0]
mov r8d, ebx
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
cmp rsi, r15
je 0x1cb32
cmp ebx, r15d
jbe 0x1cb32
mov edx, ebx
mov rcx, rsi
call fcn.000196ac
jmp 0x1cb32
mov ebx, dword [rdi + 0x10]
mov rsi, qword [rdi + 8]
shr ebx, 4
cmp byte [0x000266c2], r15b
je 0x1c9b9
lea rcx, [0x000222a0]
mov r8d, ebx
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
mov edx, ebx
mov rcx, rsi
call fcn.0001957c
jmp 0x1cb32
mov rax, qword [rdi + 8]
cmp rax, r15
je 0x1d6bf
cmp dword [rdi + 0x10], 4
jb 0x1d6bf
mov bl, byte [rax]
cmp byte [0x000266c2], r15b
je 0x1c9f9
lea rcx, [0x00022320]
movzx edx, bl
call sub.ntoskrnl.exe_DbgPrint
mov byte [0x00025121], bl
jmp 0x1cb32
mov esi, dword [rdi + 0x10]
mov rbp, qword [rdi + 8]
shr esi, 3
cmp byte [0x000266c2], r15b
je 0x1ca29
lea rcx, [0x00022260]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc8
cmp esi, eax
cmova esi, eax
mov dword [0x00025ea0], esi
cmp rbp, r15
je 0x1ca59
cmp esi, r15d
jbe 0x1ca59
mov r8d, esi
lea rcx, [0x00025ea4]
mov rdx, rbp
shl r8d, 3
call fcn.0001dd60
mov r12d, r15d
cmp esi, r15d
jbe 0x1cb32
mov ebx, 1
cmp byte [0x000266c2], r15b
je 0x1ca8a
mov r9d, dword [rbp + 4]
mov r8d, dword [rbp]
lea rcx, [0x000208a0]
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
add r12d, ebx
add rbp, 8
cmp r12d, esi
jb 0x1ca6a
jmp 0x1cb32
mov rbp, qword [rdi + 8]
cmp rbp, r15
je 0x1d6bf
mov esi, dword [rdi + 0x10]
shr esi, 3
cmp byte [0x000266c2], r15b
je 0x1cac9
lea rcx, [0x00022220]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x14
cmp esi, eax
cmova esi, eax
mov dword [0x000264f0], esi
cmp rbp, r15
je 0x1caf9
cmp esi, r15d
jbe 0x1caf9
mov r8d, esi
lea rcx, [0x000264f4]
mov rdx, rbp
shl r8d, 3
call fcn.0001dd60
mov r12d, r15d
cmp esi, r15d
jbe 0x1cb32
mov ebx, 1
cmp byte [0x000266c2], r15b
je 0x1cb26
mov r9d, dword [rbp + 4]
mov r8d, dword [rbp]
lea rcx, [0x00020870]
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
add r12d, ebx
add rbp, 8
cmp r12d, esi
jb 0x1cb06
mov ebx, r15d
jmp 0x1d6bf
mov ebx, 0xc00000bb
jmp 0x1d6bf
mov rsi, qword [rdi + 8]
cmp rsi, r15
je 0x1d6bf
cmp dword [rdi + 0x10], 8
jb 0x1d6bf
cmp byte [0x000266c2], r15b
je 0x1cb76
mov r8d, dword [rsi + 4]
mov edx, dword [rsi]
lea rcx, [0x00022360]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsi]
mov dword [0x000269d0], eax
mov eax, dword [rsi + 4]
mov dword [0x000269d4], eax
jmp 0x1cb32
cmp dword [rdi], 0x80532f10
je 0x1ce0b
cmp dword [rdi], 0x80532f14
je 0x1cdce
cmp dword [rdi], 0x80532f18
je 0x1cd5a
cmp dword [rdi], 0x80532f1e
je 0x1ccf0
cmp dword [rdi], 0x80532f20
je 0x1ccbf
cmp dword [rdi], 0x80532f26
je 0x1cc45
cmp dword [rdi], 0x80532f28
jne 0x1d6bf
cmp byte [0x000266c2], r15b
je 0x1cbee
lea rcx, [0x000226a0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x00025d80]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [0x00025cc8]
mov byte [0x00025d88], al
cmp rdx, r15
je 0x1cc2b
mov rbx, qword [rdx + 8]
lea rcx, [0x00025d00]
call fcn.000155d0
mov rdx, rbx
cmp rbx, r15
jne 0x1cc0d
mov al, byte [0x00025d88]
mov dword [0x00025cc0], r15d
mov qword [0x00025cc8], r15
lea rcx, [0x00025d80]
jmp 0x1cdc1
mov ecx, dword [rdi + 0x20]
mov rbp, qword [rdi + 0x18]
movabs rax, 0xcccccccccccccccd
mul rcx
mov rsi, rdx
shr rsi, 5
cmp byte [0x000266c2], r15b
je 0x1cc7b
lea rcx, [0x00022620]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
cmp rbp, r15
je 0x1d6bf
cmp esi, r15d
jbe 0x1d6bf
mov edx, esi
mov rcx, rbp
call fcn.000173e4
mov ebx, eax
cmp byte [0x000266c2], r15b
je 0x1ccb4
lea rcx, [0x00022660]
mov r8d, eax
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
lea eax, [rbx + rbx*4]
shl eax, 3
jmp 0x1cece
mov rbx, qword [rdi + 8]
mov esi, dword [rdi + 0x10]
cmp byte [0x000266c2], r15b
je 0x1cce1
lea rcx, [0x00022520]
mov r8d, esi
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov edx, esi
mov rcx, rbx
call fcn.0001718c
jmp 0x1cb32
mov esi, dword [rdi + 0x20]
mov rbp, qword [rdi + 0x18]
shr esi, 5
cmp byte [0x000266c2], r15b
je 0x1cd15
lea rcx, [0x000224a0]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
cmp rbp, r15
je 0x1d6bf
cmp esi, r15d
jbe 0x1d6bf
mov edx, esi
mov rcx, rbp
call fcn.00014ab0
mov ebx, eax
cmp byte [0x000266c2], r15b
je 0x1cd4e
lea rcx, [0x000224e0]
mov r8d, eax
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
shl ebx, 5
mov dword [r13], ebx
jmp 0x1cb32
cmp byte [0x000266c2], r15b
je 0x1cd6f
lea rcx, [0x00022460]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x00025280]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [0x000251c8]
mov byte [0x00025288], al
cmp rdx, r15
je 0x1cdac
mov rbx, qword [rdx + 8]
lea rcx, [0x00025200]
call fcn.000155d0
mov rdx, rbx
cmp rbx, r15
jne 0x1cd8e
mov al, byte [0x00025288]
mov dword [0x000251c0], r15d
mov qword [0x000251c8], r15
lea rcx, [0x00025280]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x1cb32
mov rsi, qword [rdi + 8]
cmp rsi, r15
je 0x1d6bf
cmp dword [rdi + 0x10], 4
jb 0x1d6bf
cmp byte [0x000266c2], r15b
je 0x1cdfc
mov edx, dword [rsi]
lea rcx, [0x00022420]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsi], r15d
setne byte [0x000269da]
jmp 0x1cb32
mov esi, dword [rdi + 0x20]
mov rbp, qword [rdi + 0x18]
shr esi, 2
cmp byte [0x000266c2], r15b
je 0x1ce30
lea rcx, [0x000223a0]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
cmp rbp, r15
je 0x1d6bf
cmp esi, r15d
jbe 0x1d6bf
mov ebx, 1
mov r12d, r15d
lea r14, [0x0002cd60]
lea eax, [rbx + 0x1f]
cmp byte [0x000266c2], r15b
je 0x1ce74
mov r8d, dword [r14]
lea rcx, [0x00020840]
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x20
add r12d, ebx
add r14, 4
cmp r12d, eax
jb 0x1ce54
cmp esi, eax
lea rdx, [0x0002cd60]
mov rcx, rbp
cmova esi, eax
mov ebx, esi
shl rbx, 2
mov r8, rbx
call fcn.0001dd60
lea rcx, [0x0002cd60]
mov r8, rbx
xor edx, edx
call fcn.0001dc60
cmp byte [0x000266c2], r15b
je 0x1cec9
lea rcx, [0x000223e0]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
mov eax, esi
shl eax, 2
mov dword [r13], eax
jmp 0x1cb32
mov rbx, qword [rdi + 8]
mov esi, dword [rdi + 0x10]
cmp byte [0x000266c2], r15b
je 0x1cef9
lea rcx, [0x00022560]
mov r8d, esi
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov edx, esi
mov rcx, rbx
call fcn.00018028
jmp 0x1cb32
mov eax, 0x80532f90
cmp dword [rdi], eax
ja 0x1d25a
je 0x1d1a4
cmp dword [rdi], 0x80532f42
je 0x1d127
cmp dword [rdi], 0x80532f44
je 0x1d0bb
cmp dword [rdi], 0x80532f64
je 0x1d095
cmp dword [rdi], 0x80532f6a
je 0x1d031
cmp dword [rdi], 0x80532f6c
je 0x1cfc9
cmp dword [rdi], 0x80532f70
je 0x1cf98
cmp dword [rdi], 0x80532f8c
jne 0x1d6bf
mov rbx, qword [rdi + 8]
mov esi, dword [rdi + 0x10]
cmp byte [0x000266c2], r15b
je 0x1cf89
lea rcx, [0x000225e0]
mov r8d, esi
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov edx, esi
mov rcx, rbx
call fcn.00018f1c
jmp 0x1cb32
mov rbx, qword [rdi + 8]
mov esi, dword [rdi + 0x10]
cmp byte [0x000266c2], r15b
je 0x1cfba
lea rcx, [0x000225a0]
mov r8d, esi
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov edx, esi
mov rcx, rbx
call fcn.00018a1c
jmp 0x1cb32
cmp byte [0x000266c2], r15b
je 0x1cfde
lea rcx, [0x00022800]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x000258e8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rcx, qword [0x000258e0]
mov byte [0x000258f0], al
cmp rcx, r15
je 0x1d017
mov rbx, qword [rcx + 8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, rbx
cmp rbx, r15
jne 0x1cffd
mov al, byte [0x000258f0]
mov dword [0x000258d8], r15d
mov qword [0x000258e0], r15
lea rcx, [0x000258e8]
jmp 0x1cdc1
mov rsi, qword [rdi + 0x18]
mov ebp, dword [rdi + 0x20]
cmp byte [0x000266c2], r15b
je 0x1d053
lea rcx, [0x00022780]
mov r8d, ebp
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
cmp rsi, r15
je 0x1d6bf
cmp ebp, r15d
jbe 0x1d6bf
mov edx, ebp
mov rcx, rsi
call fcn.00018d74
mov ebx, eax
cmp byte [0x000266c2], r15b
je 0x1cd51
lea rcx, [0x000227c0]
mov r8d, eax
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1cd51
cmp byte [0x000266c2], r15b
je 0x1cb32
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x000225a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1cb32
cmp byte [0x000266c2], r15b
je 0x1d0d0
lea rcx, [0x00022750]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x00025c80]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rdx, qword [0x00025bc8]
mov byte [0x00025c88], al
cmp rdx, r15
je 0x1d10d
mov rbx, qword [rdx + 8]
lea rcx, [0x00025c00]
call fcn.000155d0
mov rdx, rbx
cmp rbx, r15
jne 0x1d0ef
mov al, byte [0x00025c88]
mov dword [0x00025bc0], r15d
mov qword [0x00025bc8], r15
lea rcx, [0x00025c80]
jmp 0x1cdc1
mov esi, dword [rdi + 0x20]
mov rbp, qword [rdi + 0x18]
movabs rax, 0x2492492492492493
mul rsi
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 4
cmp byte [0x000266c2], r15b
je 0x1d163
lea rcx, [0x000226d0]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
cmp rbp, r15
je 0x1d6bf
cmp esi, r15d
jbe 0x1d6bf
mov edx, esi
mov rcx, rbp
call fcn.000182b0
mov ebx, eax
cmp byte [0x000266c2], r15b
je 0x1d19c
lea rcx, [0x00022710]
mov r8d, eax
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
imul ebx, ebx, 0x1c
jmp 0x1cd51
mov al, byte [0x000266c2]
cmp al, r15b
je 0x1d1c7
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x00022830]
movzx r9d, al
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rdi + 8]
cmp rdx, r15
je 0x1d233
cmp dword [rdi + 0x10], 4
jne 0x1d233
mov sil, byte [rdx]
cmp sil, r15b
jne 0x1d203
mov al, byte [0x000266c2]
cmp al, r15b
je 0x1d203
xor r9d, r9d
movzx eax, al
lea rcx, [0x00022880]
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov byte [0x000266c2], sil
mov ebx, r15d
cmp sil, r15b
je 0x1d6f2
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
movzx r9d, sil
lea rcx, [0x000228d0]
mov dword [rsp + 0x20], r9d
call sub.ntoskrnl.exe_DbgPrint
mov al, byte [0x000266c2]
cmp al, r15b
je 0x1d6f2
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
movzx r9d, al
lea rcx, [0x00022920]
jmp 0x1d6ba
cmp dword [rdi], 0x80532f94
je 0x1d617
cmp dword [rdi], 0x80532f98
je 0x1d587
cmp dword [rdi], 0x80532f9c
je 0x1d4c7
cmp dword [rdi], 0x80532fa0
je 0x1d407
cmp dword [rdi], 0x80532fa4
je 0x1d30b
cmp dword [rdi], 0x80532fa8
jne 0x1d6bf
cmp byte [0x000266c2], r15b
je 0x1d2bb
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x00022e20]
call sub.ntoskrnl.exe_DbgPrint
mov rsi, qword [rdi + 8]
cmp rsi, r15
je 0x1d2f2
mov ebx, dword [rdi + 0x10]
shr ebx, 4
cmp byte [0x000266c2], r15b
je 0x1d2e5
lea rcx, [0x00022e70]
mov r8d, ebx
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
mov edx, ebx
mov rcx, rsi
call fcn.000165f0
mov ebx, r15d
cmp byte [0x000266c2], r15b
je 0x1d6f2
lea rcx, [0x00022eb0]
jmp 0x1d3f5
cmp byte [0x000266c2], r15b
je 0x1d328
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x00022d40]
call sub.ntoskrnl.exe_DbgPrint
mov rsi, qword [rdi + 8]
cmp rsi, r15
je 0x1d3e1
mov ebx, dword [rdi + 0x10]
shr ebx, 3
cmp byte [0x000266c2], r15b
je 0x1d356
lea rcx, [0x00022d90]
mov r8d, ebx
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x1f4
mov ebp, ebx
cmp ebx, eax
cmova ebp, eax
cmp byte [0x000266c2], r15b
je 0x1d380
lea rcx, [0x0001f430]
mov r9d, ebp
mov r8d, ebx
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
mov dword [0x000269e0], ebp
cmp rsi, r15
je 0x1d3a6
cmp ebp, r15d
jbe 0x1d3a6
mov r8d, ebp
lea rcx, [0x000269e4]
mov rdx, rsi
shl r8d, 3
call fcn.0001dd60
mov r12d, r15d
cmp ebp, r15d
jbe 0x1d3de
mov ebx, 1
cmp byte [0x000266c2], r15b
je 0x1d3d2
mov r9d, dword [rsi + 4]
mov r8d, dword [rsi]
lea rcx, [0x0001f470]
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
add r12d, ebx
add rsi, 8
cmp r12d, ebp
jb 0x1d3b3
mov ebx, r15d
cmp byte [0x000266c2], r15b
je 0x1d6f2
lea rcx, [0x00022dd0]
mov rdx, qword [rdi + 8]
mov r8d, dword [rdi + 0x10]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1d6bf
cmp byte [0x000266c2], r15b
je 0x1d42c
movzx r9d, byte [0x000269d8]
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x00022c00]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rdi + 8]
cmp rdx, r15
je 0x1d49e
cmp dword [rdi + 0x10], 4
jne 0x1d49e
mov sil, byte [rdx]
cmp sil, r15b
jne 0x1d46a
cmp byte [0x000266c2], r15b
je 0x1d46a
movzx eax, byte [0x000269d8]
xor r9d, r9d
lea rcx, [0x00022c50]
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov byte [0x000269d8], sil
mov ebx, r15d
cmp byte [0x000266c2], r15b
je 0x1d6f2
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
movzx r9d, sil
lea rcx, [0x00022ca0]
mov dword [rsp + 0x20], r9d
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x000266c2], r15b
je 0x1d6f2
movzx r9d, byte [0x000269d8]
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x00022cf0]
jmp 0x1d6ba
cmp byte [0x000266c2], r15b
je 0x1d4ec
movzx r9d, byte [0x000266c3]
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x00022aa0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rdi + 8]
cmp rdx, r15
je 0x1d55e
cmp dword [rdi + 0x10], 4
jne 0x1d55e
mov sil, byte [rdx]
cmp sil, r15b
jne 0x1d52a
cmp byte [0x000266c2], r15b
je 0x1d52a
movzx eax, byte [0x000266c3]
xor r9d, r9d
lea rcx, [0x00022af0]
lea r8d, [r9 + 4]
mov dword [rsp + 0x20], eax
call sub.ntoskrnl.exe_DbgPrint
mov byte [0x000266c3], sil
mov ebx, r15d
cmp byte [0x000266c2], r15b
je 0x1d6f2
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
movzx r9d, sil
lea rcx, [0x00022b50]
mov dword [rsp + 0x20], r9d
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x000266c2], r15b
je 0x1d6f2
movzx r9d, byte [0x000266c3]
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
lea rcx, [0x00022bb0]
jmp 0x1d6ba
mov esi, dword [rdi + 0x10]
mov rbp, qword [rdi + 8]
shr esi, 1
cmp byte [0x000266c2], r15b
je 0x1d5ab
lea rcx, [0x00022a60]
mov r8d, esi
mov rdx, rbp
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x1f4
cmp esi, eax
cmova esi, eax
mov dword [0x000254c0], esi
cmp rbp, r15
je 0x1d5d8
cmp esi, r15d
jbe 0x1d5d8
lea r8d, [rsi + rsi]
lea rcx, [0x000254c4]
mov rdx, rbp
call fcn.0001dd60
mov r12d, r15d
cmp esi, r15d
jbe 0x1cb32
mov ebx, 1
cmp byte [0x000266c2], r15b
je 0x1d606
movzx r8d, word [rbp]
lea rcx, [0x0001f2f0]
mov edx, r12d
call sub.ntoskrnl.exe_DbgPrint
add r12d, ebx
add rbp, 2
cmp r12d, esi
jb 0x1d5e9
jmp 0x1cb32
cmp byte [0x000266c2], r15b
je 0x1d63c
movzx r9d, byte [0x000269d9]
mov r8d, dword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
lea rcx, [0x00022970]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rdi + 0x18]
cmp rdx, r15
je 0x1d69a
cmp dword [rdi + 0x20], 4
jne 0x1d69a
mov eax, dword [0x000269dc]
mov cl, byte [0x000269d9]
mov ebx, 1
cmp eax, ebx
je 0x1d66e
mov ebx, r15d
cmp eax, 2
je 0x1d66e
cmp cl, r15b
setne bl
mov dword [rdx], ebx
mov dword [r13], 4
mov ebx, r15d
cmp byte [0x000266c2], r15b
je 0x1d6f2
movzx r9d, cl
lea rcx, [0x000229c0]
mov r8d, 4
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x000266c2], r15b
je 0x1d6f2
movzx r9d, byte [0x000269d9]
mov r8d, dword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
lea rcx, [0x00022a10]
call sub.ntoskrnl.exe_DbgPrint
cmp byte [0x000266c2], r15b
je 0x1d6f2
mov ecx, dword [rdi + 0x20]
mov r9d, dword [rdi + 0x10]
mov r8, qword [rdi + 8]
mov edx, dword [rdi]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rcx
lea rcx, [0x00022f00]
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret