Function at 0x11be0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x80], 0
cmp qword [rsp + 0x30], 0
je 0x11c42
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x8c]
xor edx, edx
xor ecx, ecx
call sub.FLTMGR.SYS_FltEnumerateFilters
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0xc0000023
je 0x11c63
jmp 0x11cbe
mov edx, dword [rsp + 0x8c]
shl rdx, 3
mov r8d, 0x6d6e6674
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x11c93
mov dword [rsp + 0x78], 0xc000009a
jmp 0x11cbe
lea r8, [rsp + 0x8c]
mov edx, dword [rsp + 0x8c]
mov rcx, qword [rsp + 0x30]
call sub.FLTMGR.SYS_FltEnumerateFilters
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0xc0000023
je 0x11c24
cmp dword [rsp + 0x78], 0
jge 0x11ce1
cmp qword [rsp + 0x30], 0
je 0x11cda
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
jmp 0x11f9a
mov edx, dword [rsp + 0x8c]
lea rcx, [0x000177c0]
call fcn.00013920
nop
mov eax, dword [rsp + 0x8c]
cmp dword [rsp + 0x88], eax
jae 0x11f3c
mov eax, dword [rsp + 0x88]
shl eax, 3
mov ecx, eax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + rcx]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x38], rax
lea rdi, [0x000203e0]
xor eax, eax
mov ecx, 0xd8
rep stosb byte [rdi], al
lea rdi, [rsp + 0xa0]
mov rsi, qword [rsp + 0x38]
add rsi, 0x38
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x40]
lea rsi, [rsp + 0xa0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x48], 0
je 0x11d94
movzx eax, word [rsp + 0x42]
cmp eax, 0xd8
jge 0x11d94
movzx ecx, word [rsp + 0x42]
lea rdi, [0x000203e0]
mov rsi, qword [rsp + 0x48]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x000203e0]
call qword [sym.imp.ntoskrnl.exe__wcslwr]
lea rdx, [0x000177f0]
lea rcx, [0x000203e0]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
mov qword [rsp + 0x68], rax
lea rdx, [0x00017810]
lea rcx, [0x000203e0]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x68], 0
jne 0x11dee
cmp qword [rsp + 0x80], 0
jne 0x11dee
jmp 0x11f1c
mov ecx, dword [0x0001a110]
mov rax, qword [rsp + 0x70]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
cmp eax, 0x80
je 0x11edf
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
test eax, eax
jne 0x11ecc
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r9, qword [r9 + 8]
mov r8, qword [rsp + 0x70]
lea rdx, [0x000203e0]
lea rcx, [0x00017830]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rsp + 0x60]
cmp qword [rdx + 8], 0
je 0x11e96
call fcn.000114d0
mov byte [rsp + 0x90], al
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
mov eax, dword [0x0001a114]
mov dword [rcx], eax
movzx ecx, byte [rsp + 0x90]
call fcn.00011510
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x10], 0
je 0x11ecc
call fcn.000114d0
mov byte [rsp + 0x91], al
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
mov eax, dword [0x0001a114]
mov dword [rcx], eax
movzx ecx, byte [rsp + 0x91]
call fcn.00011510
mov rax, qword [rsp + 0x60]
add rax, 0x20
mov qword [rsp + 0x60], rax
jmp 0x11e0e
jmp 0x11f1c
mov eax, dword [rsp + 0x88]
add eax, 1
mov dword [rsp + 0x88], eax
mov rcx, qword [rsp + 0x70]
call sub.FLTMGR.SYS_FltObjectDereference
jmp 0x11cf5
jmp 0x11f79
cmp qword [rsp + 0x30], 0
je 0x11f96
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsp + 0x78], 0
mov eax, dword [rsp + 0x58]
add rsp, 0xb8
pop rdi
pop rsi
ret